fix(security): resolve audit findings — debug log, payment bypass, images #1

Merged

sathish merged 1 commits from fix/security-audit into main

2026-08-04 13:18:52 +00:00

sathish commented

2026-08-04 13:13:48 +00:00

Member

Addresses the RE:Quest code-audit findings for the admin panel.

Changes

Remove firebase-debug.log from the codebase and gitignore it
(firebase-debug.log*). It contained authorizing via signed-in user (ppradeepd@gmail.com) — a developer's personal Google account, indicating
Firebase/GCP resources may have been administered under a personal vendor
account.
Remove the client-side skipPaymentCheck approval flag. Investigation
finding: the flag was inert. It was declared on an inline request-body type and
the backend only ever reads status and note, so it never reached the server —
it only selected which branch of this page's own confirmation modal ran. Removing
it changes no server behaviour.
Replace the wildcard image remote host "**" with an explicit allowlist
(Contabo, AWS, DigitalOcean Spaces), closing the SSRF/abuse surface.

History rewrite (already applied to `main`)

firebase-debug.log was present in all 74 commits, so removing the file alone did
not close the finding. main has been rewritten with git-filter-repo and
force-pushed. Verified: the file and the personal email address now appear in zero
commits, and the old commit objects are pruned locally.

Everyone must delete their adminpanel clone and re-clone. A git pull onto an
existing clone merges the old commits — and the file — back in, and pushing from a
stale clone would restore it to the remote.

Follow-up for whoever administers the Gitea instance

Please run garbage collection on this repository. The old commits are unreferenced
but may remain as dangling objects reachable by direct SHA URL until GC runs, which
would leave the leaked address retrievable despite the rewrite.

Verification

next build clean. Working tree byte-identical to pre-rewrite — only history changed.

Addresses the RE:Quest code-audit findings for the admin panel. ## Changes - **Remove `firebase-debug.log`** from the codebase and gitignore it (`firebase-debug.log*`). It contained `authorizing via signed-in user (ppradeepd@gmail.com)` — a developer's personal Google account, indicating Firebase/GCP resources may have been administered under a personal vendor account. - **Remove the client-side `skipPaymentCheck` approval flag.** Investigation finding: the flag was inert. It was declared on an inline request-body type and the backend only ever reads `status` and `note`, so it never reached the server — it only selected which branch of this page's own confirmation modal ran. Removing it changes no server behaviour. - **Replace the wildcard image remote host `"**"`** with an explicit allowlist (Contabo, AWS, DigitalOcean Spaces), closing the SSRF/abuse surface. ## History rewrite (already applied to `main`) `firebase-debug.log` was present in all 74 commits, so removing the file alone did not close the finding. `main` has been rewritten with `git-filter-repo` and force-pushed. Verified: the file and the personal email address now appear in zero commits, and the old commit objects are pruned locally. **Everyone must delete their adminpanel clone and re-clone.** A `git pull` onto an existing clone merges the old commits — and the file — back in, and pushing from a stale clone would restore it to the remote. ## Follow-up for whoever administers the Gitea instance Please run garbage collection on this repository. The old commits are unreferenced but may remain as dangling objects reachable by direct SHA URL until GC runs, which would leave the leaked address retrievable despite the rewrite. ## Verification `next build` clean. Working tree byte-identical to pre-rewrite — only history changed.

sathish added 1 commit 2026-08-04 13:13:48 +00:00

fix(security): resolve audit findings — debug log, payment bypass, images df16a76909

- Remove the committed firebase-debug.log (contains a personal Google
  account) and gitignore it. NOTE: still present in history — a history
  rewrite or written confirmation is still outstanding
- Remove the client-side skipPaymentCheck approval bypass
- Replace the wildcard image remote host "**" with an explicit allowlist
  (adds DigitalOcean Spaces)

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

sathish merged commit 2101ee3e4f into main

2026-08-04 13:18:52 +00:00

sathish referenced this issue from a commit

2026-08-04 13:18:53 +00:00

Merge pull request 'fix(security): resolve audit findings — debug log, payment bypass, images' (#1) from fix/security-audit into main