VPS 4 Builder
69 lines
2.4 KiB
Markdown
69 lines
2.4 KiB
Markdown
# Security Audit Report
|
|
|
|
- Framework detected: javascript-app
|
|
- Total findings: 5
|
|
- Critical: 1, High: 4, Medium: 0, Low: 0
|
|
|
|
## Executive summary
|
|
This report is evidence-oriented. Findings marked probable or manual-review should be validated in source context before remediation planning is finalized.
|
|
|
|
## Critical
|
|
|
|
#### Hardcoded credential material
|
|
- Severity: critical
|
|
- Confidence: high
|
|
- Status: confirmed
|
|
- Evidence: Secret-like token or private key marker detected
|
|
- Impact: Credential compromise may permit direct unauthorized access
|
|
- Files: scripts/security-audit.js (Line: 159)
|
|
- Recommended fix: Remove from code, rotate credentials, and load via secure server-side environment management.
|
|
## High
|
|
|
|
#### Unsafe HTML rendering pattern
|
|
- Severity: high
|
|
- Confidence: medium
|
|
- Status: probable
|
|
- Evidence: dangerouslySetInnerHTML found
|
|
- Impact: Potential XSS if fed untrusted content
|
|
- Files: scripts/security-audit.js (Line: 126)
|
|
- Recommended fix: Sanitize content and restrict sources before rendering HTML.
|
|
#### Server boundary without obvious input validation
|
|
- Severity: high
|
|
- Confidence: low
|
|
- Status: manual-review
|
|
- Evidence: Request input usage
|
|
- Impact: Malformed or hostile input may reach sensitive logic
|
|
- Files: scripts/security-audit.js (Line: 144)
|
|
- Recommended fix: Validate request data at the server boundary with a schema.
|
|
#### LLM endpoint with prompt injection exposure
|
|
- Severity: high
|
|
- Confidence: medium
|
|
- Status: probable
|
|
- Evidence: LLM SDK call
|
|
- Impact: Model behavior may be steered to reveal or misuse privileged instructions and tools
|
|
- Files: scripts/security-audit.js (Line: 149)
|
|
- Recommended fix: Separate system instructions, validate tool args, add allowlists, and sanitize user content.
|
|
#### Potential SSRF pattern
|
|
- Severity: high
|
|
- Confidence: low
|
|
- Status: manual-review
|
|
- Evidence: Server-side outbound request
|
|
- Impact: Attacker may force calls to internal or unintended hosts
|
|
- Files: scripts/security-audit.js (Line: 154)
|
|
- Recommended fix: Enforce host allowlists and validate URLs before outbound requests.
|
|
## Medium
|
|
|
|
_No findings._
|
|
|
|
## Low
|
|
|
|
_No findings._
|
|
|
|
## Manual review checklist
|
|
|
|
- Verify authz on admin and privileged routes.
|
|
- Verify whether raw queries are parameterized upstream.
|
|
- Verify whether shared sanitization utilities are applied before dangerous HTML or LLM calls.
|
|
- Verify token handling and public env variables in client bundles.
|
|
|