Audit methodology: repo-aware static analysis, targeted auth/ownership fixes, and focused test verification.
Fixed Findings
Critical
Fly rclone service previously trusted callers without server-side authentication.
Affected: fly-rclone/server.js, fly-rclone/src/middleware/auth.js
Why it matters: Any network-reachable caller could hit operational rclone endpoints if they could reach the service, regardless of the client’s bearer-token support.
Fix status: Fixed now. The service now enforces requireServiceAuth globally, accepts Bearer and X-API-Key headers, and compares keys with crypto.timingSafeEqual.
Batch copy accepted caller-supplied userId on a publicly matched route.
Affected: src/app/api/rclone/batch-copy/route.ts
Why it matters: A crafted request could impersonate another user when resolving tokens or recording operation ownership.
Fix status: Fixed now. The route now requires Clerk auth and rejects any requestUserId that does not match the authenticated user.
High
Operation status and cancellation endpoints were missing user ownership enforcement.
Affected: src/app/api/rclone/operations/route.ts, src/app/api/rclone/operations/[id]/route.ts, src/app/api/ops/route.ts, src/lib/database/operations.ts
Why it matters: Authenticated users could poll or interfere with operations they did not own by guessing operation IDs.
Fix status: Fixed now. Routes now require auth and use persisted user-scoped helpers before returning operation details or snapshots.
Operational logs included token prefixes in several flows.
Affected: src/app/api/auth/refresh/route.ts, src/lib/session-server.ts, src/lib/rclone/core/flyio-client.ts, src/lib/rclone/core/config-templates.ts
Why it matters: Even partial token material increases blast radius in log sinks and during incident review.
Fix status: Fixed now. The updated logging paths record token presence and length only, not token prefixes.
Medium
Database bootstrap relied on driver defaults for remote transport security.
Affected: src/lib/database/client.ts, src/lib/database/tests/client.test.ts
Why it matters: A remote connection string without explicit TLS settings left security posture dependent on environment defaults rather than code-level enforcement.
Fix status: Fixed now. Remote DATABASE_URL values are now normalized to require sslmode=require, while localhost and placeholder URLs keep the existing build-safe behavior.
Token debug surfaces were available to any authenticated user.
Affected: src/app/api/debug/tokens/route.ts, src/app/dev/tokens/page.tsx, src/app/dev/tokens/TokenDebugDashboard.tsx
Why it matters: Even redacted token metadata should stay within developer-only tooling to avoid unnecessary production exposure.
Fix status: Fixed now. The debug API now returns 403 for non-dev users, and the /dev/tokens page redirects non-dev users before rendering the dashboard.
Open Findings
Audit Notes
Audit 01: Token Encryption
DATABASE_URL not set; skipped live database token verification.
Audit 02: API Authentication and Authorization
The app middleware keeps broad public API matchers for provider and rclone routes, so route-level auth remains critical.
Audit 03: Input Validation and Command Construction
No eval usage, shell:true child processes, or unsanitized path joins were detected.
The existing JSON-LD dangerouslySetInnerHTML usage is allowlisted as static JSON.stringify output.
Audit 04: Secrets and Logging
Logger scan is heuristic and focuses on obvious token-prefix exposure and hard-coded secret patterns.
Direct env-var response detection was intentionally left out after it produced low-signal false positives in repo helpers.
Audit 05: Fly rclone Service
Auth middleware currently allows only health/docs/streaming endpoints to bypass service authentication.
Audit 06: Database Security
DATABASE_URL not set; skipped live database scoping checks.