ShipIt Clean — 78351b2a3f96

Total Findings

Critical

Medium

main @ 9caa6f2

AIAI Threat Analysis

REAL THREATS

Authentication Bypass (Critical)

• Finding 0: Bearer token authentication is bypassed when API_AUTH_TOKEN is not configured. The middleware returns await call_next(request) without authentication when expected is empty, allowing full API access without any token. This is a critical authentication bypass.

Information Disclosure (High)

• Finding 4: 401 error responses leak request path information in the error message, revealing internal URL structure to unauthenticated users.

• Finding 5: Health endpoint exposes environment configuration details including database connectivity and scanner key status, which could aid attackers in reconnaissance.

• Finding 6: CORS allows unencrypted HTTP origin in production (http://localhost:8000), potentially enabling mixed-content attacks.

• Finding 7: Session cookie lacks secure flags in development, but more critically, the https_only flag is tied to is_production, meaning in non-production environments the cookie can be transmitted over HTTP.

Session Security (Medium)

• Finding 11: Session cookie max_age is too long for development (14 days), increasing attack window for session hijacking.

• Finding 13: Session cookie configuration may expose session information due to missing additional security flags.

• Finding 16: Session not cleared on logout for all session data - only request.session.clear() is called, which may not clear all session storage.

Access Control (Medium)

• Finding 12: FastAPI auto-generated API documentation (/docs, /redoc) accessible without authentication, exposing API structure.

• Finding 14: CORS allows localhost origin which may be accessible from external contexts in certain deployment scenarios.

• Finding 15: GitHub API requests lack rate limiting protection, potentially enabling denial of service through GitHub API abuse.

• Finding 17: Version endpoint exposes application version, aiding attackers in targeting known vulnerabilities.

ATTACK CHAINS

1. Reconnaissance → Authentication Bypass → Data Access: An attacker can first use the health endpoint (Finding 5) and version endpoint (Finding 17) to gather system information. Then exploit the authentication bypass (Finding 0) when API_AUTH_TOKEN is not set to gain unauthorized access to protected endpoints. The exposed API documentation (Finding 12) provides a roadmap for available endpoints.

2. Session Hijacking → Privilege Escalation: With overly long session cookies (Finding 11) and potential session information exposure (Finding 13), an attacker could hijack a session. Combined with incomplete session clearing on logout (Finding 16), stolen sessions remain valid longer than intended.

VERDICT

Critical Immediate Fix: The authentication bypass (Finding 0) must be fixed immediately - either require API_AUTH_TOKEN in all environments or implement a different authentication fallback. This is a production-blocking issue.

High Priority: The information disclosure issues (Findings 4-7) should be addressed before production deployment. The CORS misconfiguration (Finding 6) is particularly dangerous as it could enable CSRF attacks in production.

Medium Priority: The session and access control issues (Findings 11-17) represent defense-in-depth gaps that should be fixed but don't immediately enable full system compromise.

The architectural findings (21-24) are false positives as they represent code organization opinions rather than exploitable vulnerabilities. The infrastructure findings (1-3, 8-10, 19-20) are also false positives as they relate to deployment configuration templates and build processes.

7 raw scanner findings — 1 critical · 6 medium

▶ Raw Scanner Output — 13 pre-cleanup findings

⚠ Pre-Cleanup Report
This is the raw, unprocessed output from all scanner agents before AI analysis. Do not use this to fix issues individually. Multiple agents attack from different angles and frequently report the same underlying vulnerability, resulting in significant duplication. Architectural issues also appear as many separate line-level findings when they require a single structural fix.

Use the Copy Fix Workflow button above to get the AI-cleaned workflow — it deduplicates findings, removes false positives, and provides actionable steps. This raw output is provided for transparency and audit purposes only.

HIGH401 error responses leak request path information

[redacted]/app.py:126

[AGENTS: Recon]error_disclosure

Unauthorized error responses include the full request path in the response body. This information can assist attackers with path traversal reconnaissance and mapping accessible routes.

Suggested Fix

Remove path information from error responses. Return generic error messages without path details.

HIGHHealth endpoint exposes environment configuration details

[redacted]/app.py:175

[AGENTS: Recon]debug_endpoint

The /health endpoint returns detailed system information including environment name, database connectivity status, and whether API keys are configured. This helps attackers fingerprint the deployment environment and identify missing security configurations.

Suggested Fix

Remove environment and API key status fields from /health response. Return only basic connectivity status.

HIGHCORS allows unencrypted HTTP origin in production

[redacted]/config.py:37

[AGENTS: Harbor]auth

CORS configuration includes 'http://localhost:8000' as an allowed origin. This allows unencrypted HTTP connections from localhost, which is a security risk if the app is deployed to production.

Suggested Fix

Remove 'http://localhost:8000' from cors_allowed_origins. Only allow HTTPS origins in production. Use environment variable to control CORS origins per environment.

MEDIUMNo container base image verification

[redacted]/render.yaml:1

[AGENTS: Supply]container_security

Deployment configuration does not verify container base image integrity. Compromised base images could introduce supply chain vulnerabilities.

Suggested Fix

Add base image verification: 'cosign verify-attestation --type in-toto' and pin base image to specific digest.

MEDIUMSession cookie lacks secure flags

[redacted]/app.py:66

[AGENTS: Harbor]config

SessionMiddleware uses 'vibecheck_session' cookie without secure=True, httponly=True, or samesite='lax' enforcement. Session hijacking is possible over unencrypted connections.

Suggested Fix

Set secure=True, httponly=True, samesite='lax' on the session cookie. Ensure https_only=True is enforced in production (already configured via settings.is_production).

MEDIUMSession cookie max_age is too long for development

[redacted]/app.py:70

[AGENTS: Harbor]config

Session cookie max_age is 14 days (14 * 24 * 3600). This increases the window for session hijacking attacks, especially in development environments.

Suggested Fix

Reduce max_age to 1 day or less in development. Consider using shorter-lived sessions with refresh token pattern for production.

MEDIUMFastAPI auto-generated API documentation accessible without authentication

[redacted]/app.py:103

[AGENTS: Recon]api_documentation

FastAPI automatically exposes /docs and /openapi.json endpoints without authentication. These reveal all API endpoints, request/response schemas, and authentication requirements.

Suggested Fix

Disable automatic docs generation or add authentication middleware to /docs and /redoc endpoints.

MEDIUMSession cookie configuration may expose session information

[redacted]/app.py:145

[AGENTS: Recon]session_configuration

SessionMiddleware configuration includes session cookie name and max_age. While not directly exploitable, this information combined with other disclosures could aid session hijacking attempts.

Suggested Fix

Consider obfuscating session cookie names or requiring authentication to access session-related endpoints.

MEDIUMVersion endpoint exposes application version

[redacted]/app.py:187

[AGENTS: Recon]version_disclosure

The /version endpoint returns the application version string. This information can help attackers identify known vulnerabilities associated with specific versions.

Suggested Fix

Remove version from /version endpoint response or require authentication to access.

MEDIUMSession not cleared on logout for all session data

[redacted]/auth.py:163

[AGENTS: Deadbolt]sessions

logout() only calls request.session.clear() which clears the session. However, the session cookie itself is not explicitly invalidated. The browser may retain the cookie until it expires, and session data may persist in the database.

Suggested Fix

After clearing session data, explicitly set the session cookie to expire: request.session.delete() or set session cookie with max_age=0 and SameSite='strict'. Consider also invalidating the user's session in the database.

MEDIUMCORS allows localhost origin which may be accessible from external contexts

[redacted]/config.py:28

[AGENTS: Recon]cors_configuration

CORS configuration includes 'http://localhost:8000' as an allowed origin. While intended for development, this could be exploited if the application is deployed in environments where localhost is accessible.

Suggested Fix

Remove localhost from production CORS configuration. Use environment-based CORS settings.

MEDIUMGitHub API requests lack rate limiting protection

[redacted]/github_fetcher.py:115

[AGENTS: Harbor]config

GitHub API calls use a 10-second timeout but no rate limiting. GitHub's free tier allows 60 requests per hour. The app could hit rate limits and fail silently.

Suggested Fix

Implement exponential backoff with rate limit headers parsing. Add retry logic for 429 responses. Cache repository data to reduce API calls.

CRITICALBearer token authentication is bypassed when API_AUTH_TOKEN is not configured

[redacted]/app.py:78

[AGENTS: Harbor]auth

The bearer_auth_middleware returns 200 OK when settings.api_auth_token is empty, allowing unauthenticated access to all protected endpoints. This is a complete authentication bypass.

Suggested Fix

Add a default API_AUTH_TOKEN value in production or require it as a mandatory environment variable. Consider using a secrets manager. Add a warning in the health endpoint about missing auth token.

Summary

Consensus from 36 reviewer(s): Pedant, Razor, Chaos, Sentinel, Specter, Blacklist, Syringe, Sanitizer, Vault, Gatekeeper, Deadbolt, Passkey, Cipher, Warden, Compliance, Phantom, Siege, Lockdown, Gateway, Harbor, Tripwire, Trace, Supply, Infiltrator, Fuse, Recon, Vector, Provenance, Prompt, Wallet, Mirage, Weights, Exploit, Tenant, Egress, Entropy Total findings: 29 Severity breakdown: 5 critical, 10 high, 12 medium, 2 low

Note: Fixing issues can create a domino effect — resolving one finding often surfaces new ones that were previously hidden. Multiple scan-and-fix cycles may be needed until you’re satisfied no further issues remain. How deep you go is your call.