Complete a full security review before v1.0.0 #51

New issue

Open

opened 2026-07-28 04:59:58 +00:00 by claude-bot · 0 comments

claude-bot commented

2026-07-28 04:59:58 +00:00

Context

AGENTS.md states that security is a priority for this project. The application holds
private family photographs and personal metadata behind a single OAuth check. Before
v1.0.0, the whole surface deserves one deliberate review rather than the per-issue
attention it has had so far.

Scope

An end-to-end security review of the complete application.

Implementation notes

Authentication and session handling: cookie flags, session fixation, expiry, logout
invalidation, and OIDC token validation.
Authorization: re-verify the full role matrix server-side across every route added since
v0.2.0. Each milestone added endpoints, and per-issue checks do not substitute for one
systematic pass over the finished surface.
Media serving and export paths: path traversal, and any route that turns user input into
a filesystem path.
File upload handling at ingest: type validation, size limits, decompression bombs, and
malicious image files reaching the EXIF and OCR parsers. Image parsing libraries are a
recurring source of memory-safety issues and this input is attacker-influenced if the
instance is exposed.
SSRF in any configurable outbound URL â€” AI endpoint, notification channels, S3 endpoint,
audit sink.
Secrets handling: nothing in the repo, nothing echoed back through the API, nothing in
logs. Verify against git history as well as the working tree.
Dependency audit for both backend and frontend, with Renovate keeping it current.
Rate limiting on authentication and expensive endpoints.
Confirm the dev-login bypass cannot be enabled in production.
Record findings as their own issues rather than fixing silently, so the trail exists.

Done when

Every area above has been reviewed and the results recorded
The full authorization matrix is verified server-side by test
Upload and parser handling is hardened against malicious input
No secret appears in the repo, its history, logs, or API responses
Findings are tracked as issues and resolved or explicitly accepted

References

AGENTS.md ("Security is very important when building the project")
docs/circa-spec.md section 6 (safety and integrity)
#8, #14, #15

## Context `AGENTS.md` states that security is a priority for this project. The application holds private family photographs and personal metadata behind a single OAuth check. Before v1.0.0, the whole surface deserves one deliberate review rather than the per-issue attention it has had so far. ## Scope An end-to-end security review of the complete application. ## Implementation notes - Authentication and session handling: cookie flags, session fixation, expiry, logout invalidation, and OIDC token validation. - Authorization: re-verify the full role matrix server-side across every route added since v0.2.0. Each milestone added endpoints, and per-issue checks do not substitute for one systematic pass over the finished surface. - Media serving and export paths: path traversal, and any route that turns user input into a filesystem path. - File upload handling at ingest: type validation, size limits, decompression bombs, and malicious image files reaching the EXIF and OCR parsers. Image parsing libraries are a recurring source of memory-safety issues and this input is attacker-influenced if the instance is exposed. - SSRF in any configurable outbound URL â€” AI endpoint, notification channels, S3 endpoint, audit sink. - Secrets handling: nothing in the repo, nothing echoed back through the API, nothing in logs. Verify against git history as well as the working tree. - Dependency audit for both backend and frontend, with Renovate keeping it current. - Rate limiting on authentication and expensive endpoints. - Confirm the dev-login bypass cannot be enabled in production. - Record findings as their own issues rather than fixing silently, so the trail exists. ## Done when - [ ] Every area above has been reviewed and the results recorded - [ ] The full authorization matrix is verified server-side by test - [ ] Upload and parser handling is hardened against malicious input - [ ] No secret appears in the repo, its history, logs, or API responses - [ ] Findings are tracked as issues and resolved or explicitly accepted ## References - `AGENTS.md` ("Security is very important when building the project") - `docs/circa-spec.md` section 6 (safety and integrity) - #8, #14, #15

claude-bot added this to the v1.0.0 milestone

2026-07-28 04:59:58 +00:00

claude-bot added the

testing

security

labels

2026-07-28 04:59:58 +00:00

claude-bot referenced this issue

2026-07-28 06:06:09 +00:00

Magic-link family contributions (needs a product decision) #122