| Fixed locally | Critical | Clerk middleware and Next.js advisories were present in lockfile dependencies. | CASA 6.1.1, CWE-1104 | package.json, pnpm-lock.yaml | next resolves to 15.5.21; Sharp, PostCSS, brace-expansion, UUID, esbuild, and Babel transitive advisories are patched. pnpm audit --prod reports no known vulnerabilities. |
| Fixed | High | Production dependencies had high audit findings in Drizzle and glob tooling paths. | ASVS 14.2, CWE-1104 | package.json, pnpm-lock.yaml | Upgraded drizzle-orm to ^0.45.2; added PNPM overrides for vulnerable transitive production packages. pnpm audit --prod is clean. |
| Fixed | High | /dev/docs was publicly allowlisted, exposing an internal route namespace in production. | ASVS 4.1/14.4, CWE-862 | src/middleware.ts, src/lib/public-routes.ts, docs routes/components | Public docs now render under /docs; /dev/docs is no longer public and remains protected by dev role middleware. |
| Fixed | Medium | Debug/service-health handlers relied on middleware without route-level role checks. | ASVS 4.1, CWE-862, CWE-200 | src/app/api/debug/file-id-lookup/route.ts, src/app/api/dev/rclone-health/route.ts | Added authenticated dev-or-admin checks and sanitized error responses. |
| Fixed | Medium | Download-session route could rely on downstream token resolution instead of explicit caller auth. | ASVS 4.1/8.3, CWE-639 | src/app/api/download/session/route.ts | Added explicit 401 before provider-token lookup. |
| Fixed | Medium | Delete and delete-stream flows could return raw provider errors to clients. | ASVS 7.4/8.3, CWE-209, CWE-532 | src/app/api/delete/*, src/lib/security/error-sanitizer.ts | Added explicit auth and centralized user-facing error sanitization. |
| Fixed | Medium | Core web security headers were incomplete. | ASVS 14.4, CWE-693, CWE-1021 | next.config.js, vercel.json | Added HSTS, CSP frame/object/base restrictions, X-Frame-Options, nosniff, Referrer-Policy, and Permissions-Policy. |
| Fixed | Low | Local security-audit scripts produced false positives for static JSON-LD and local Codex caches. | ASVS 14.2 | scripts/security-audit/* | Allowlisted static JSON.stringify JSON-LD and excluded local cache/build folders. OAuth client IDs are documented as public identifiers, not secrets. |
| Fixed locally; production evidence partial | High | Admin routes required role but did not require signed second-factor session evidence. | CASA 3.3.1, ASVS V2/V4 | src/lib/auth/admin-access-policy.ts, admin middleware/layout/API routes | All admin boundaries fail closed unless Clerk fva[1] records second-factor verification within 10 minutes. Both configured admins are enrolled and a current admin session rendered the protected production boundary; deployed stale/missing/unverified rejection evidence remains open. |
| Fixed locally | High | Account-scoped browser data could remain after application or Clerk-hosted sign-out. | CASA 6.6.1, CWE-922 | src/lib/auth/browser-logout.ts, ServiceManagerContext, AuthWrapper | Logout clears all app-origin local/session storage and deletes encrypted provider tokens while deliberately preserving connected-account metadata and user preferences; Clerk invalidation evidence remains open. |
| Fixed locally | High | Mutating API routes lacked one fail-closed, API-wide cross-origin request-integrity boundary. | CASA 3.1.5, CWE-352 | src/lib/auth/request-integrity.ts, src/middleware.ts, authorization scan | All 71 mutating route modules are covered before handler dispatch; cross-site/sibling-origin and unverifiable cookie-bearing mutations return non-cacheable 403 responses. Credentialless machine endpoints retain handler authentication. |
| Fixed locally | High | Cross-user negative evidence was incomplete across resource families. | CASA 3.1.1/3.1.2/3.1.4, CWE-639 | service-account, job, operation, and indexing route tests | Two-user tests reuse identifiers and prove foreign identities cannot reach provider, worker, or mutation calls. |
| Fixed locally | High | OpenXML extraction relied on parser behavior without a pre-decompression package-expansion policy. | CASA 5.2.1, CWE-409/CWE-22 | DOCX/XLSX/PPTX extraction and package-guard tests | Central-directory metadata is validated before parsing, with entry, expansion, ratio, encryption, ZIP64, path, and consistency limits. |
| Fixed locally | High | Worker traversal validation did not canonicalize nested encodings and Unicode/mixed separators first. | CASA 5.1.10, CWE-22 | worker validation middleware and tests | Bounded decoding, residual-encoding rejection, NFKC/slash canonicalization, and drive/UNC/system-path checks run before rclone launch. |
| Fixed locally | High | Configured worker targets and download proxy redirects allowed a broader outbound-request surface than required. | CASA 5.1.5, CWE-918 | rclone URL helper and download stream route | Remote targets require public pathless HTTPS, the fixed loopback development target is explicit, tokens are bounded, and upstream redirects are refused. DNS-rebinding DAST remains open. |
| Fixed locally | Medium | Provider-supplied SharePoint URLs were rendered directly into an external anchor. | CASA 5.1.4/5.1.7, CWE-79/CWE-601 | SharePoint sites component and safe URL helper | Links render only for credential-free, port-free HTTPS sharepoint.com hosts; unsafe values render no anchor. |
| Partially resolved; deploy pending | High | Production now serves the configured security headers and /dev/docs returns only the authenticated-app initializer to an anonymous client. Production /robots.txt and /sitemap.xml still redirect to sign-in. | CASA 3.1/4.1/6.2, CWE-862, CWE-693 | OVH production and uncommitted crawler-route work | Deploy the already-present public crawler routes after approval, then repeat crawler and anonymous docs checks. |
| Fixed locally; deploy pending | High | Direct-provider OAuth state was unsigned JSON and carried the popup user ID. | CASA 3.2.2, CWE-352 | src/lib/oauth-state.ts, provider callback routes and tests | HMAC-SHA256 signature, random nonce, ten-minute expiry, strict schema, authenticated popup binding, and fail-closed callback handling implemented. Deploy and perform provider E2E callbacks. |
| Monitored development-only risk | High/Low | Full pnpm audit reports two high image-size and one low elliptic advisory only below @storybook/nextjs; upstream lists no patched version. | CASA 6.1.1, ASVS 14.2, CWE-1104 | non-deployed Storybook dependency tree | Both production graphs audit at zero. Reachability, compensating controls, owner, and review date are recorded in private Phase 1 evidence; no assessor acceptance is claimed. |
| Needs assessor clarification | Medium | Several legacy API routes still return provider or library error strings in some failure paths. | ASVS 7.4, CWE-209 | broad src/app/api surface | Highest-risk debug/delete/download flows were fixed. A full API-wide error contract migration should be completed or accepted by the lab as residual risk. |
| Historical evidence captured | Medium | Live database scoping/encryption checks previously lacked environment-specific evidence. | ASVS V4/V8 | scripts/security-audit/01-token-encryption.ts, 06-db-security-check.ts | Re-run on 2026-05-13 with private, untracked local, former-development, and production DATABASE_URL values. Token encryption and DB ownership checks passed at that time; the shared environment is now retired. |
| Evidence captured | Medium | Actual Google Cloud OAuth consent-screen scopes must be verified against production project configuration. | ASVS V1/V2/V8 | Google Cloud Console, OAuth video/demo evidence | Google Auth Platform evidence was captured for project statafusion/StratoFusion: verified branding, authorized domains, audience status, OAuth clients list, and data-access scopes. No client secrets were opened or exported. |