fix(security): resolve audit findings — logging, endpoints, contact details #3

sathish · 2026-08-04T13:15:22Z

sathish commented

2026-08-04 13:15:22 +00:00

Addresses the RE:Quest code-audit findings for the web app. 10 files, all
low-risk: no logic changes, no new dependencies, no API changes.

Security

Stop logging password forms to the browser console. Both change-password
pages ran console.log('Updating … password:', data), writing the submitted
form — including current and new password — to the console in cleartext.
Password changing itself is unaffected: PasswordSecurityForm posts to
/auth/change-password directly, the removed handler was only a logging stub.
Replace the wildcard image remote host "**" with an explicit allowlist
(Contabo, AWS, DigitalOcean Spaces). hostname: "**" allowed the Next image
handler to fetch from any host — an SSRF/abuse surface.

Vendor decoupling

Analytics is now env-driven. layout.tsx hardcoded
https://analytics.superlabs.co/script.js with a fixed
data-website-id, so visitor data flowed to a vendor-owned instance. Now reads
NEXT_PUBLIC_UMAMI_URL / NEXT_PUBLIC_UMAMI_WEBSITE_ID and renders nothing when
unset — production currently sets neither, so no analytics script is emitted.

Correctness

Socket URL fallback fixed to http://localhost:3001/api/v1 (was
http://localhost:4000). The socket base URL is derived by stripping /api/v1
off the API URL; the old fallback had no such suffix, so the strip was a no-op and
:4000 passed through. Giving the fallback the same shape as the real env var
means one code path handles both. Confirming the audit's §7 question: :4000 was
a stale value, not a separate service — the only remaining 4000 in the repo is
an unrelated setTimeout.

Note this fallback only ever applied in local dev, since production sets
NEXT_PUBLIC_API_URL. The production-side websocket fix is in the backend PR
(CORS_ORIGINS being read before .env loaded).

Contact details

Replaced placeholder and personal contact emails with support@re-quest.com
across contact, FAQ, privacy policy, terms of service and the subscription form.
These were user-facing on the legal pages and included personal Gmail accounts
(request.sha@gmail.com, officialteam.request@gmail.com), a placeholder
(123support@gmail.com), and support@requesn.com — a misspelled domain, so
that mailto link was broken.

⚠️ support@re-quest.com needs to be a live, monitored mailbox before this ships
— it is now the published support address on the legal pages.

Verification

next build and tsc --noEmit clean.

Not addressed (acknowledged in the audit, needs a decision)

Auth tokens are still written to localStorage (login, verify-2fa,
services/api.ts), which is XSS-exfiltratable. The audit asked only for
acknowledgement here. Moving to httpOnly cookies is a behaviour change affecting
the whole auth flow and should be its own PR, not bundled with a go-live fix.

Addresses the RE:Quest code-audit findings for the web app. 10 files, all low-risk: no logic changes, no new dependencies, no API changes. ## Security - **Stop logging password forms to the browser console.** Both change-password pages ran `console.log('Updating … password:', data)`, writing the submitted form — including current and new password — to the console in cleartext. Password changing itself is unaffected: `PasswordSecurityForm` posts to `/auth/change-password` directly, the removed handler was only a logging stub. - **Replace the wildcard image remote host `"**"`** with an explicit allowlist (Contabo, AWS, DigitalOcean Spaces). `hostname: "**"` allowed the Next image handler to fetch from any host — an SSRF/abuse surface. ## Vendor decoupling - **Analytics is now env-driven.** `layout.tsx` hardcoded `https://analytics.superlabs.co/script.js` with a fixed `data-website-id`, so visitor data flowed to a vendor-owned instance. Now reads `NEXT_PUBLIC_UMAMI_URL` / `NEXT_PUBLIC_UMAMI_WEBSITE_ID` and renders nothing when unset — production currently sets neither, so no analytics script is emitted. ## Correctness - **Socket URL fallback fixed** to `http://localhost:3001/api/v1` (was `http://localhost:4000`). The socket base URL is derived by stripping `/api/v1` off the API URL; the old fallback had no such suffix, so the strip was a no-op and `:4000` passed through. Giving the fallback the same shape as the real env var means one code path handles both. Confirming the audit's §7 question: `:4000` was a stale value, not a separate service — the only remaining `4000` in the repo is an unrelated `setTimeout`. Note this fallback only ever applied in local dev, since production sets `NEXT_PUBLIC_API_URL`. The production-side websocket fix is in the backend PR (`CORS_ORIGINS` being read before `.env` loaded). ## Contact details - Replaced placeholder and personal contact emails with `support@re-quest.com` across contact, FAQ, privacy policy, terms of service and the subscription form. These were user-facing on the legal pages and included personal Gmail accounts (`request.sha@gmail.com`, `officialteam.request@gmail.com`), a placeholder (`123support@gmail.com`), and `support@requesn.com` — a misspelled domain, so that mailto link was broken. ⚠️ `support@re-quest.com` needs to be a live, monitored mailbox before this ships — it is now the published support address on the legal pages. ## Verification `next build` and `tsc --noEmit` clean. ## Not addressed (acknowledged in the audit, needs a decision) Auth tokens are still written to `localStorage` (`login`, `verify-2fa`, `services/api.ts`), which is XSS-exfiltratable. The audit asked only for acknowledgement here. Moving to httpOnly cookies is a behaviour change affecting the whole auth flow and should be its own PR, not bundled with a go-live fix.

sathish added 1 commit 2026-08-04 13:15:22 +00:00

fix(security): resolve audit findings — logging, endpoints, contact details fc932dbc7e

- Stop logging submitted password forms to the browser console
- Drive analytics from NEXT_PUBLIC_UMAMI_* instead of a hardcoded vendor
  script URL and site ID; renders nothing when unset
- Replace the wildcard image remote host "**" with an explicit allowlist
  (adds DigitalOcean Spaces)
- Fix the socket URL fallback to the API port (:3001, was :4000)
- Replace placeholder and personal contact emails with support@re-quest.com,
  including the privacy policy and terms pages

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

sathish merged commit 1094460353 into main

2026-08-04 13:18:56 +00:00

sathish referenced this issue from a commit

2026-08-04 13:18:56 +00:00

Merge pull request 'fix(security): resolve audit findings — logging, endpoints, contact details' (#3) from fix/security-audit into main

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: Re-Quest/frontend#3