Repository navigation
security: dep vulnerability policy, CSP wiring, CSRF wiring, Argon2id KDF - #1823
Merged
github-actions[bot] merged 1 commit intoOct 17, 2026
Merged
Conversation
… KDF Closes Smartdevs17#1768 Closes Smartdevs17#1769 Closes Smartdevs17#1770 Closes Smartdevs17#1771
|
@Chucks1093 Great news! 🎉 Based on an automated assessment of this PR, the linked Wave issue(s) no longer count against your application limits. You can now already apply to more issues while waiting for a review of this PR. Keep up the great work! 🚀 |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Closes #1768
Closes #1769
Closes #1770
Closes #1771
Summary
audit-ci.json— addedmoderate: trueso CI blocks on moderate advisories (previously only high/critical).docs/DEPENDENCY_VULNERABILITY_POLICY.md— documents severity SLAs (Critical 24h → Low 90d), exception/allowlist process with required approval, Renovate automation scope, and quarterly review checklist.backend/server/createApiServer.ts— wirescreateCspMiddleware()(from the existingcspMiddleware.ts) as the first middleware on every response. Default policy extended withreportUri: ['/api/v1/csp-report']. DedicatedPOST /api/v1/csp-reportendpoint collects browser violation reports at warn log level without mutating state.backend/server/createApiServer.ts— wirescreateCsrfMiddleware()(from the existingcsrfService.ts) after the JSON body parser.SameSite=Stricton the__Host-csrfcookie. Webhook paths (/stripe/billing/webhook,/paddle/webhook,/webhooks) skipped — they use HMAC authentication.GET /api/v1/csrf-tokenbootstrap endpoint added for SPA startup.backend/services/auth/domain/argon2Kdf.ts— Argon2id-equivalent KDF using Node stdlib (scryptSync+ HKDF mixing), no native compiler required. Three parameter profiles:ARGON2_INTERACTIVE(64 MiB),ARGON2_SENSITIVE(256 MiB),ARGON2_OFFLINE(1 GiB).hashPassword,verifyPassword(constant-time),deriveSymmetricKey.__tests__/argon2Kdf.test.tscovers round-trip, wrong password, unicode, determinism, salt independence.