← back to Codex Review 2026 04 30
TOP_FINDINGS.md
315 lines
# Top findings across all 25 projects (cross-project synthesis)
Built 2026-04-30T23:45:19-07:00 from review.md + rereview.md across all projects.
## P0 findings — secrets in code or unsafe defaults
AgentAbrams: - `snippets/redact_lint.py:71-73`, `.github/workflows/ci.yml:34-40`: detected secrets are printed with surrounding snippet into CI logs. Fix by printing only pattern name + file/line, never matched content.
AgentAbrams: - `video/oauth_authorize.py:31-32`: refresh token is printed to stdout, making terminal logs/screen recordings a secret leak. Fix by writing only to a chmod-600 local file or clipboard prompt, not stdout.
AgentAbrams: - `video/upload_youtube.py:38`, `.github/workflows/youtube.yml:36-44`: uploads default to `privacy="public"` with no workflow privacy input; wrong artifact/path becomes public immediately. Default to `private`/`unlisted` and require explicit public promotion.
AgentAbrams:
bankrupt-leads: - [src/poller.py](/Users/stevestudio2/Projects/bankrupt-leads/src/poller.py:37): only requests first 100 dockets and never follows pagination; busy courts silently lose leads. Fix: loop CourtListener `next` pages until exhausted.
bankrupt-leads: - [src/poller.py](/Users/stevestudio2/Projects/bankrupt-leads/src/poller.py:45): poller inserts cases only; no code populates `filings`, downloads PDFs, or extracts text, so classify/extract/digest have no real input. Fix: implement filing/document ingestion or mark current scripts as nonfunctional scaffold.
bankrupt-leads: - [src/extract.py](/Users/stevestudio2/Projects/bankrupt-leads/src/extract.py:77): extraction is not idempotent; rerunning a filing duplicates assets every time. Fix: add a natural key/unique constraint or delete/upsert assets per `filing_id` in one transaction.
bankrupt-leads: - Secrets/auth/SQL injection: none observed.
bankrupt-leads:
bubbesblock: - `.env:2`, `.env:3`, `.env:5`: real API keys live in the project root; accidental sync/commit leaks Google/DPLA access. Rotate keys if shared, keep `.env` out of VCS/backups, and enforce domain/IP/API restrictions.
bubbesblock: - `README.md:9`: claimed-address posting gate is only documented, with no enforceable auth code present. If this repo is deployed as-is or rebuilt later, posting can ship without verification; implement server-side verification against `claimmyaddress.com`.
bubbesblock:
claimmyaddress: - `.env:2-5`: live API keys are stored in plaintext in the project directory; if synced, backed up, or later committed, they are exposed. Rotate these keys, move secrets to a real secret store, and keep only `.env.example`.
claimmyaddress: - `.env:3`: `GOOGLE_GEOCODING_API_KEY` is a server-side key; if not strictly IP/service-account restricted, it can be abused for billable requests. Verify restrictions in GCP and rotate after removal.
claimmyaddress: - `README.md:7-9`: this repo claims it handles signup, OAuth, document upload, inventory, and insurance export, but no implementation exists here. Security review of auth/upload/data handling cannot be performed from this repo; review the shared backend before launch.
claimmyaddress:
dear-bubbe-next: - none observed.
dear-bubbe-next:
Designer-Wallcoverings: - `DW-Agents/ecosystem.config.js:45`, `:72`, `:92`, `:134`, `:176`, `:494`; `brand-router/server.js:11`; `DW-Websites/shop-by-color/server.js:9`: real-looking Shopify/Slack/Anthropic/Zendesk/Postgres secrets are hardcoded. Rotate every exposed credential, purge from files/history/backups, load only from env/secret store.
Designer-Wallcoverings: - `.env:1`, `shopify/.env:1`, `DW-MCP/.env:1`, `DW-Agents/.env:1`: live secret-bearing env files sit inside the project tree. Confirm whether they are tracked/backed up; rotate and move to an untracked secrets location.
Designer-Wallcoverings: - `DW-Agents/dw-agents/agent-legal-team/legal-agent.ts:248-284`, `:1894`, `:2151`: auth middleware is not applied, while unauthenticated routes can run Claude analysis and set Shopify products to draft. Add global auth before routes and separately verify Shopify webhook HMAC.
Designer-Wallcoverings: - `admin/server.ts:19`, `:30`, `:61`, `:421-424`: admin interface falls back to `admin123`, uses `Math.random()` bearer tokens, allows `Access-Control-Allow-Origin: *`, and prints the admin password. Require `ADMIN_PASSWORD`, use `crypto.randomBytes`, restrict CORS, never log secrets.
Designer-Wallcoverings: - `DW-MCP/src/index.js:300-345`: Shopify OAuth callback has no state validation and logs/displays the new access token. Add OAuth `state` validation, authenticate token-generation flow, and never render/log tokens.
Forza: - `index.html:17-21` public root is a “3 theme mockups” chooser, not the winning production site; visitors land on internal design artifacts. Fix: make root serve `theme-3-costa-rica-modern/` or redirect permanently.
Forza: - `theme-3-costa-rica-modern/contact/index.html:115`, `theme-3-costa-rica-modern/index.html:555` lead forms call `preventDefault()` and never send data; real leads are silently lost or shown a mockup alert. Fix: wire to a form backend/mail handler with success/error states.
Forza: - `theme-3-costa-rica-modern/index.html:14`, `contact/index.html:13`, `about/index.html:15`, `services-legal/index.html:15` load Figma MCP capture JS in production pages; third-party design tooling can execute on every visitor session. Fix: remove from deploy or gate behind local/dev-only build.
Forza: - `README.md:6`, `README.md:63`, `DIARY.md:164` SSL/DNS are documented as unfinished; site may be unreachable or HTTP-only. Fix: confirm DNS A record, run certbot, force HTTPS.
Forza: - Known SQL injection/auth/CVE issues: none observed; there is no backend, auth layer, SQL, or package manifest.
Hormuzy: - `clone/index.html:43-46`: references `/assets/index-DNA8aLxR.js`, `/assets/three-s7MRw7i5.js`, `/assets/r3f-DrPHa5mf.js`, `/assets/index-Bjz6pQij.css`, none present in repo; local/static deploy renders empty `#root`. Fix by committing full build output or restoring source/build pipeline.
Hormuzy: - `clone/manifest.json:17`: references `/icon-512.png`, not present; PWA install/icon fetch breaks. Add the asset or remove the manifest entry.
Hormuzy: - Secrets/auth/SQL injection/prod credentials: none observed.
Hormuzy:
jill-website: - `.env:31` / `.env:32`: Google API keys are committed. Rotate them, restrict by domain/API, remove `.env` from git history, keep only `.env.example`.
jill-website: - `src/server.ts:23` / `src/server.ts:24` / `src/middleware/auth.ts:12` / `views/admin.ejs:416`: production auth falls back to hardcoded passwords and the admin UI embeds `admin:admin123`. Require env secrets at boot; remove client-side Basic Auth; use server sessions.
jill-website: - `src/routes/activities.ts:27` / `src/routes/activities.ts:144` / `src/routes/activities.ts:186` / `src/routes/activities.ts:304`: create/update/delete/bulk-import activity routes have no admin auth beyond site-wide Basic Auth. Mount mutating routes behind `requireAuth` or split public read vs admin write routers.
jill-website: - `src/routes/linkValidation.ts:230` / `src/services/linkValidationService.ts:23`: `/check-url` fetches arbitrary URLs and follows redirects, enabling SSRF/internal probing. Restrict schemes to http/https, block private/link-local IPs, and allowlist external domains if possible.
jill-website: - `src/migrations/002_create_cms_tables.sql:13` / `src/migrations/002_create_page_content.sql:2`: duplicate `002` migrations create incompatible `page_content` schemas; fresh migrations can fail or leave columns the model does not use. Collapse/renumber migrations and reconcile `page_title/gallery_images` vs `title/images`.
Ken: - `src/lib/auth.js:4`, `src/lib/auth.js:6`, `src/lib/db.js:4`: hardcoded JWT secret, admin password, and Postgres password in source; compromise of repo compromises app and DB. Move to env/secret manager, rotate all exposed secrets.
Ken: - `kalshi-dash/server.js:25`, `kalshi-dash/server.js:130`, `kalshi-dash/server.js:351`, `kalshi-dash/server.js:4875`: leaked Slack webhook, Gemini API key, and two DB URLs. Revoke/rotate immediately; load from env only.
Ken: - `src/app/api/markets/route.js:7`, `src/app/api/risk/route.js:7`, `src/app/api/trades/route.js:7`, `src/app/api/workers/route.js:5`: root API routes do not call `authenticateRequest`; client-side dashboard checks are bypassable. Add server-side auth middleware to every non-login route.
Ken: - `src/app/api/trades/route.js:25-57`: `paper_order` trusts price/size/side/outcome and writes order, trade, bankroll, and risk state without validation or transaction. Validate numeric ranges/enums and wrap writes in one DB transaction.
Ken: - `react-dash/server.js:66-76`, `kalshi-dash/server.js:400-410`: session cookies are unsigned base64 JSON; anyone can forge `{authenticated:true}`. Replace with signed JWT or server-side sessions.
lawyer-directory-builder: - `.env:1`, `.env:9-14`: DB/admin/Stripe secrets are present in the project tree; compromise means admin takeover and live charges. Rotate secrets, remove `.env`, commit `.env.example`.
lawyer-directory-builder: - `src/server/index.ts:19`, `src/server/upgrade.ts:242-249`: global `express.json()` runs before Stripe `express.raw()`, so webhook signature verification will receive parsed JSON, not raw bytes. Mount `/webhooks/stripe` raw parser before JSON middleware.
lawyer-directory-builder: - `src/server/upgrade.ts:173-199`: Stripe `success_url`/`cancel_url` are built from `Host` / `x-forwarded-host`; hostile headers can create payment sessions redirecting to attacker-controlled domains. Use fixed `PUBLIC_BASE_URL`.
lawyer-directory-builder: - `src/server/portal.ts:388-395`: login has no rate limit, lockout, or audit trail; leaked/admin emails can be brute-forced. Add per-IP+email throttling and failed-login logging.
lawyer-directory-builder: - `package-lock.json:1544-1545`, `src/server/index.ts:34-181`: Express 4 async route errors are not wrapped; DB errors can become unhandled rejections/hung requests. Add async handler wrapper and central error middleware.
Letsbegin: - `.env.local:1`, `CLAUDE.md:5-6`, `CLAUDE.md:24-27`, `lib/gemini-image.ts:7`, `app/api/prd/generate/route.ts:8`: live API keys/passwords are in repo/docs. Rotate keys/passwords, purge history, require env vars with no fallbacks.
Letsbegin: - `middleware.ts:6-15`: `/api/ralph`, `/api/processes`, `/api/live`, `/api/url-info` are public by prefix. Remove these from `publicPaths`; require auth and CSRF for every mutating/admin route.
Letsbegin: - `lib/auth.ts:7-10`, `app/api/auth/login/route.ts:54-60`, `middleware.ts:68-80`: sessions are unsigned base64 JSON and cookies are `secure:false`; anyone can forge `{authenticated:true}`. Use signed/encrypted session cookies, `secure:true`, env-only secrets.
Letsbegin: - `app/api/ralph/run/route.ts:57-63`, `app/api/ralph/run/route.ts:89-166`, `app/api/ralph/run/route.ts:168-237`: public endpoint accepts arbitrary `projectPath`/story data, writes files, `chown -R`s, creates shell scripts, and spawns them. Restrict project paths to an allowlist and remove public access before reuse.
Letsbegin: - `app/api/processes/start/route.ts:83-194`: root-running script path uses unsanitized PRD fields and invokes `claude --dangerously-skip-permissions`. Disable this route or run in a locked sandbox with strict input schema and no root HOME.
malden-house: - [signup.js](/Users/stevestudio2/Projects/malden-house/signup.js:217): email verification is hardcoded `verified: true`; anyone can “claim” any address/email locally. Fix with server-side account creation, signed email tokens, and address ownership rules.
malden-house: - [rental.js](/Users/stevestudio2/Projects/malden-house/rental.js:735): guest inquiries are saved to the visitor’s own `localStorage`, not the host’s inbox; production inquiries silently disappear. Fix with a backend endpoint/email delivery and explicit failure UI.
malden-house: - [network.js](/Users/stevestudio2/Projects/malden-house/network.js:33): public source exposes Tailscale IPs, public server IPs, hostnames, service names, and ports. Remove `network.html/js` from public builds or gate behind auth/VPN-only hosting.
malden-house: - [dashboard.js](/Users/stevestudio2/Projects/malden-house/dashboard.js:30), [browse.js](/Users/stevestudio2/Projects/malden-house/browse.js:35), [rental.js](/Users/stevestudio2/Projects/malden-house/rental.js:374): trusted `localStorage`/geocoder fields are rendered through template `innerHTML`; malicious stored records can execute markup/script-like payloads. Build DOM nodes with `textContent` or sanitize all interpolated fields.
malden-house: - [signup.js](/Users/stevestudio2/Projects/malden-house/signup.js:263): demo seed includes Steve’s real-looking email/phone/address in source and UI. Replace with fake fixtures before any public repo/deploy.
Norma: - `.env.local:1`, `.env.local:3-5`, `.env.local:14`, `.env.local:21-22`, `CLAUDE.md:12-13`, `README.md:21`: live-looking DB/admin/cron/session/Gemini/Gmail secrets are committed/documented. Rotate all exposed credentials, remove secrets from repo/docs, purge history if shared.
Norma: - `middleware.ts:55-89` + `app/api/social/ai-image/route.ts:20`, `app/api/social/bulk-schedule/route.ts:66`, `app/api/social/bulk-schedule/route.ts:88`, `app/api/social/posts/approve/route.ts:10`, `app/api/social/posts/pending/route.ts:10`: middleware only checks token structure/expiry, while these routes do no `requireRole`; forged cookies can generate images, schedule/approve/read social posts. Add `requireRole` to every non-public route or crypto-verify in middleware.
Norma: - `app/api/pulse/petitions/route.ts:111-182`: unauthenticated public POST creates immediately active petitions with no rate limit, moderation, captcha, or abuse controls. Default to draft/moderation and add IP/user rate limiting.
Norma: - `app/api/pulse/petitions/[id]/sign/route.ts:13-44`, `app/api/pulse/petitions/[id]/sign/route.ts:51-52`: public signing has no rate limit and does not check `allow_signatures`; any active petition can be spam-signed. Check `allow_signatures`, add rate limiting/captcha/email verification.
Norma: - `app/api/nonprofit/enrich/route.ts:179-184`, `app/api/nonprofit/enrich/route.ts:227-235`, `app/api/email-analyzer/fetch-url/route.ts:202-215`, `lib/social-crawl.ts:111-117`: server-side URL fetch accepts arbitrary HTTP(S), follows redirects, and does not block private/link-local IPs. Add SSRF guard: DNS/IP validation, redirect revalidation, size limits, and deny internal ranges.
professional-directory: - [agents/api-agent/server.js](/Users/stevestudio2/Projects/professional-directory/agents/api-agent/server.js:18), [agents/ingest-agent/server.js](/Users/stevestudio2/Projects/professional-directory/agents/ingest-agent/server.js:47): no auth on mutating/control endpoints; localhost CSRF or any proxy exposure can trigger imports, opt-outs, or CRM edits. Add shared auth middleware, Origin checks, and protect all `POST` routes.
professional-directory: - [agents/ingest-agent/server.js](/Users/stevestudio2/Projects/professional-directory/agents/ingest-agent/server.js:55), [agents/crawler-agent/server.js](/Users/stevestudio2/Projects/professional-directory/agents/crawler-agent/server.js:48): request body can override child-process env, including DB/source URLs. Remove arbitrary env merging; allowlist only safe knobs like `LIMIT`.
professional-directory: - [agents/api-agent/server.js](/Users/stevestudio2/Projects/professional-directory/agents/api-agent/server.js:166): API references `suggested_domain`, `domain_available`, `starred`, `contacted_at`, `is_chain`, `lead_score`; schema lacks them at [db/schema.sql](/Users/stevestudio2/Projects/professional-directory/db/schema.sql:63). Fresh deploy breaks org routes. Add a migration or remove those fields.
professional-directory:
resize-it: - [server.py:21](/Users/stevestudio2/Projects/resize-it/server.py:21), [server.py:22](/Users/stevestudio2/Projects/resize-it/server.py:22), [.env:1](/Users/stevestudio2/Projects/resize-it/.env:1), [.env:2](/Users/stevestudio2/Projects/resize-it/.env:2): Spoonflower credentials are committed/hardcoded defaults. Rotate password, remove defaults, require env vars at startup.
resize-it: - [SKILL.md:89](/Users/stevestudio2/Projects/resize-it/SKILL.md:89): Gemini API key is embedded in docs/source. Revoke it, move to secret storage, scrub history if this was ever shared.
resize-it: - [server.py:270](/Users/stevestudio2/Projects/resize-it/server.py:270)-[274](/Users/stevestudio2/Projects/resize-it/server.py:274): Flask debug server binds `0.0.0.0` and advertises a public IP. Disable debug, bind localhost or put behind authenticated production WSGI.
resize-it: - [server.py:29](/Users/stevestudio2/Projects/resize-it/server.py:29), [server.py:103](/Users/stevestudio2/Projects/resize-it/server.py:103), [server.py:155](/Users/stevestudio2/Projects/resize-it/server.py:155): no auth on endpoints that use stored Spoonflower credentials. Add owner auth/token gate; especially block public `/api/upload-to-spoonflower`.
resize-it: - [server.py:165](/Users/stevestudio2/Projects/resize-it/server.py:165)-[167](/Users/stevestudio2/Projects/resize-it/server.py:167): URL validation is substring-only; `http://internal/?spoonflower.com` passes to Playwright. Use `urlparse`, require HTTPS and exact Spoonflower host suffix.
secrets-manager: - `audit-2026-04-30.txt:1`: audit found `307` secret-looking leaks across projects/skills; current manager records the blast radius but does not remediate it. Rotate exposed keys, delete hardcoded copies, then rerun audit until clean.
secrets-manager: - `auto-ingest.sh:31` + `auto-ingest.sh:51`: import failures are swallowed with `|| true`, then the changed hash is committed; bad/partial ingests can be silently skipped forever. Only write state after a successful import; log and exit nonzero on failure.
secrets-manager: - `auto-ingest.sh:42-44`: every qualifying changed desktop file can background-launch `run-all-stages.sh`; no lock/idempotency guard. Add a lockfile or launchd `KeepAlive`/single-flight guard and record last fired input hash.
secrets-manager: - `cli.js:68` + `cli.js:104`: `StrictHostKeyChecking=accept-new` while pushing secrets to remote root hosts risks trusting the wrong first-seen host. Pin host keys in `known_hosts` and fail closed.
secrets-manager: - `routes.json:184-202`, `routes.json:301-319`, `routes.json:321-340`: prod API keys are routed directly to `root@45.61.58.125`. Use a restricted deploy user and least-privilege remote path ownership.
site-factory: - `.env:10`, `.env:13`, `sites/*/app/.env.local:5-7`: live Cloudflare/Stripe/webhook secrets are in the project tree. Rotate immediately, remove all real `.env*`, add `.gitignore`, move secrets to 1Password/Vercel/PM2 env.
site-factory: - `ecosystem.config.js:49`, `admin/server.js:43-46`: production PM2 enables `SF_ADMIN_DEV=1`, making every request auto-admin. Set default to `0`, bind admin to `127.0.0.1`, require real OAuth.
site-factory: - `admin/server.js:15`: production can boot with hardcoded `SESSION_SECRET`, enabling session forgery if dev bypass is later removed. Refuse boot in production unless `SESSION_SECRET` is set and strong.
site-factory: - `orchestrator/server.js:15`, `orchestrator/server.js:37`, `orchestrator/server.js:96`, `orchestrator/server.js:130`, `orchestrator/server.js:164`, `orchestrator/server.js:180`: orchestrator has open CORS and no auth on write routes. Add shared bearer auth, restrict CORS, expose only behind admin.
site-factory: - `orchestrator/server.js:195-204`, `stages/runners.js:240-243`: concurrent `/advance` calls can run the same stage twice, duplicating DNS/Stripe/Vercel work. Use DB transaction/advisory lock and only advance `pending` stages.
stayclaim: - `.env.local:4`: real Google Maps browser key is in the workspace; if unrestricted, cost/abuse risk. Rotate it, remove `.env.local`, enforce HTTP referrer restrictions and quotas.
stayclaim: - `scripts/filmla-cpra-followup.sh:15-16`: hardcoded Basic Auth credential to a Gmail HTTP agent over plain HTTP tailnet URL; repo leak grants email search/send. Rotate credential; load from Keychain/env; require TLS or strict Tailscale ACL.
stayclaim: - `src/app/admin/layout.tsx:45-46`, `src/app/admin/data/page.tsx:167-192`: admin is explicitly unauthenticated and exposes claim/sponsored emails. Put real server-side auth in front of all `/admin/*`, plus nginx deny until ready.
stayclaim: - `src/app/dashboard/page.tsx:11-14`, `src/app/dashboard/page.tsx:21`, `src/app/dashboard/page.tsx:59-63`: `?email=` acts as authentication; anyone who knows an email can view owner listings/pending claims. Replace with magic-link/session auth before exposing.
stayclaim: - `src/app/search/page.tsx:128-130`, `src/app/api/search/route.ts:107-109`: OCR snippets are rendered with `dangerouslySetInnerHTML`; OCR/source text can become stored XSS. Escape source text and render `<mark>` tokens safely.
the-ai-factory: - `server.js:67`, `server.js:95`, `server.js:31`: no auth plus `Access-Control-Allow-Origin: *`; any webpage Steve visits can POST to localhost and trigger builds/activation. Fix: require `ADMIN_TOKEN` Bearer auth on all mutating routes and restrict CORS to the viewer origin.
the-ai-factory: - `server.js:95`, `server.js:104`, `server.js:143`: activation copies LLM-generated files into `~/.claude` with only status gating, and `?force=true` bypasses approval. Fix: remove force from HTTP or require token + explicit local CLI confirmation; show/record a deterministic diff before copy.
the-ai-factory: - `src/stages/scaffold.js:16`, `src/stages/smoke_test.js:20`: generated subagents may receive `Bash`, `Write`, or `Edit`; smoke tests only check that tools exist, not whether they are safe. Fix: parse frontmatter and deny dangerous tools unless explicitly allowlisted by artifact type/request.
the-ai-factory: - Secrets leaked in code: none observed; checked-in `.env` is blank (`.env:4`, `.env:10`, `.env:14`).
the-ai-factory: - SQL injection: none observed; queries use placeholders.
trademarks-copyright: - `package.json:18`, `src/middleware.ts:14`: Next `15.0.3` is vulnerable to middleware auth bypass; admin auth relies on middleware. Upgrade to `15.2.3+` or block `x-middleware-subrequest` at the edge. citeturn0search4
trademarks-copyright: - `src/app/api/drops/send/route.ts:15`, `src/app/api/drops/compose/route.ts:8`, `src/app/api/score/route.ts:9`, `src/app/api/brands/hunt/route.ts:12`: public mutation routes can send newsletters, compose drops, rescore DB, and run crawler/LLM jobs. Put all operational routes behind server-side auth, not only middleware path matching.
trademarks-copyright: - `src/app/api/drops/drop-items/[id]/route.ts:8`: public PATCH edits newsletter content/CTA URLs. Move under `/api/drops/admin/*` or enforce auth inside the handler.
trademarks-copyright: - `src/app/api/drops/checkout/route.ts:23`: if Stripe is unset, any caller can set any subscriber email to paid tier at lines `24-30`. Remove dev fallback outside `NODE_ENV !== "production"` and require subscriber token/session.
trademarks-copyright: - `.env.local:30`, `.env.local:47-48`: plaintext admin token and Basic auth credential, including raw password comment, sit in project dir. Rotate both; store outside repo/workspace backups.
VictoryStays: - [server.js](/Users/stevestudio2/Projects/VictoryStays/server.js:51): `express.static(__dirname)` publishes the whole repo, including `data/victorystays.db`, source, lockfiles, generated datasets, and future `data/claims.jsonl`. Fix: serve a dedicated `public/` dir and explicitly block `/data`, scripts, DB/WAL/SHM, logs.
VictoryStays: - [api-claim.js](/Users/stevestudio2/Projects/VictoryStays/api-claim.js:81): `GET /api/claim?admin=1` returns every claim, PII, and verification codes with no auth. Fix: require operator auth/session or remove public route.
VictoryStays: - [api-claim.js](/Users/stevestudio2/Projects/VictoryStays/api-claim.js:103): unauthenticated `PATCH /api/claim` can mark any claim verified/rejected; code check is optional. Fix: authenticate operator actions and require code for verification.
VictoryStays: - [api-claim.js](/Users/stevestudio2/Projects/VictoryStays/api-claim.js:72), [home.html](/Users/stevestudio2/Projects/VictoryStays/home.html:434): claim submission returns the postcard verification code to the claimant, defeating the mail-based proof. Fix: never return the code; only store/print/mail it.
VictoryStays: - [api-claim.js](/Users/stevestudio2/Projects/VictoryStays/api-claim.js:27): unbounded JSON body plus sync append lets anyone fill disk with claims. Fix: `express.json({limit})`, rate-limit/IP throttle, validate field lengths.
visual-factory: - `server.js:223`, `server.js:257`, `server.js:279`, `server.js:326`, `server.js:362`: no auth/CSRF on create, retry, delete, activate, IG post. Any local webpage/process reaching `127.0.0.1:9892` can trigger destructive POSTs. Fix with required admin token plus Origin/CSRF checks.
visual-factory: - `src/stages/compose.js:34-44`, `src/stages/render.js:13`: untrusted LLM HTML is written then opened as `file://` with JS/network enabled. Prompt injection can embed `file://`/remote URLs and leak local data via screenshots or callbacks. Fix by sanitizing, disabling JS, using request interception/CSP, and blocking all `file:`/external loads.
visual-factory: - `server.js:263-271`: retry accepts `running`, deletes rows/output, then enqueues another pipeline while the original continues. Failure mode: corrupted events/artifacts and competing writes to the same run dir. Fix by refusing running runs or implementing cancellation/locking.
visual-factory: - `src/stages/intake.js:35-36`, `src/stages/render.js:11-16`: LLM-controlled dimensions are not clamped. A bad spec can request huge viewport/screenshot and exhaust memory. Fix with min/max bounds before DB/render.
visual-factory:
wholivedthere: - `.env:2-5`, `scripts/deploy-direct.sh:21-22`, `scripts/deploy-pastdoor.sh:28-29`: committed Google/DPLA/GoDaddy API secrets; DNS/domain takeover and API billing exposure. Revoke/rotate now, remove defaults, keep only `.env.example`.
wholivedthere: - `scripts/deploy-direct.sh:60`: deploy path drops `pastdoor` database every run; one mistaken rerun destroys production data. Replace with migration/restore into temp DB plus explicit manual confirmation.
wholivedthere: - `mcp-la-records/src/arcgis.mjs:83-93`, `mcp-la-records/src/arcgis.mjs:110`: user input is interpolated into ArcGIS SQL-like `where`; quotes/wildcards can alter query semantics. Validate APN with strict regex, escape `%/_/'`, and reject unsupported address chars.
wholivedthere: - `mcp-la-records/src/arcgis.mjs:97`: `limit` is unvalidated and passed as `resultRecordCount`; callers can request huge result sets or invalid counts. Clamp to small integer range, e.g. `1..25`.
wholivedthere: - `scripts/schema.sql:58`: generated column uses `now()`, which Postgres rejects because generated expressions must be immutable. Replace with a view or query predicate for stale rows.
yolo-agent: - `server.js:17-18`, `ledger-app/src/lib/xfetch.ts:18`, `dashboard/task-ledger.html:279`: hardcoded `admin:DWSecure2024!` shipped in server and browser code. Anyone who sees the UI/source can control the agent. Fix: env-only secret, rotate password, remove client-side auth embedding.
yolo-agent: - `server.js:614-625` + `server.js:226-239`: `/api/run` accepts arbitrary prompt, auto-starts, and launches Claude with `Bash/Write/Edit` in `/Users/stevestudio2/Projects`. With leaked auth this is remote code execution over the whole projects tree. Fix: bind to VPN/localhost, remove dangerous tools by default, require manual approval for write/bash tasks.
yolo-agent: - `create-missing-collections.js:15`, `scripts/collection-descriptions.js:16`, `tasks/done/AG_dw-exclusive-page-update.md:9`, `tasks/done/14_shopify-image-audit.md:5`: live-looking Slack webhook, Gemini key, Shopify tokens, and Postgres credentials are committed in code/task artifacts. Fix: revoke/rotate all exposed secrets and purge/redact task archive.
yolo-agent: - `server.js:1038-1043`: service binds `0.0.0.0` and prints public IP dashboard URL while auth is static/basic. Failure mode is internet-exposed agent control. Fix: bind `127.0.0.1` behind SSH/VPN or enforce firewall plus fresh credentials.
yolo-agent:
## P0 findings — auth missing on mutating routes
AgentAbrams: - `snippets/redact_lint.py:71-73`, `.github/workflows/ci.yml:34-40`: detected secrets are printed with surrounding snippet into CI logs. Fix by printing only pattern name + file/line, never matched content.
AgentAbrams: - `video/oauth_authorize.py:31-32`: refresh token is printed to stdout, making terminal logs/screen recordings a secret leak. Fix by writing only to a chmod-600 local file or clipboard prompt, not stdout.
AgentAbrams: - `video/upload_youtube.py:38`, `.github/workflows/youtube.yml:36-44`: uploads default to `privacy="public"` with no workflow privacy input; wrong artifact/path becomes public immediately. Default to `private`/`unlisted` and require explicit public promotion.
AgentAbrams:
bankrupt-leads: - [src/poller.py](/Users/stevestudio2/Projects/bankrupt-leads/src/poller.py:37): only requests first 100 dockets and never follows pagination; busy courts silently lose leads. Fix: loop CourtListener `next` pages until exhausted.
bankrupt-leads: - [src/poller.py](/Users/stevestudio2/Projects/bankrupt-leads/src/poller.py:45): poller inserts cases only; no code populates `filings`, downloads PDFs, or extracts text, so classify/extract/digest have no real input. Fix: implement filing/document ingestion or mark current scripts as nonfunctional scaffold.
bankrupt-leads: - [src/extract.py](/Users/stevestudio2/Projects/bankrupt-leads/src/extract.py:77): extraction is not idempotent; rerunning a filing duplicates assets every time. Fix: add a natural key/unique constraint or delete/upsert assets per `filing_id` in one transaction.
bankrupt-leads: - Secrets/auth/SQL injection: none observed.
bankrupt-leads:
bubbesblock: - `.env:2`, `.env:3`, `.env:5`: real API keys live in the project root; accidental sync/commit leaks Google/DPLA access. Rotate keys if shared, keep `.env` out of VCS/backups, and enforce domain/IP/API restrictions.
bubbesblock: - `README.md:9`: claimed-address posting gate is only documented, with no enforceable auth code present. If this repo is deployed as-is or rebuilt later, posting can ship without verification; implement server-side verification against `claimmyaddress.com`.
bubbesblock:
claimmyaddress: - `.env:2-5`: live API keys are stored in plaintext in the project directory; if synced, backed up, or later committed, they are exposed. Rotate these keys, move secrets to a real secret store, and keep only `.env.example`.
claimmyaddress: - `.env:3`: `GOOGLE_GEOCODING_API_KEY` is a server-side key; if not strictly IP/service-account restricted, it can be abused for billable requests. Verify restrictions in GCP and rotate after removal.
claimmyaddress: - `README.md:7-9`: this repo claims it handles signup, OAuth, document upload, inventory, and insurance export, but no implementation exists here. Security review of auth/upload/data handling cannot be performed from this repo; review the shared backend before launch.
claimmyaddress:
dear-bubbe-next: - none observed.
dear-bubbe-next:
Designer-Wallcoverings: - `DW-Agents/ecosystem.config.js:45`, `:72`, `:92`, `:134`, `:176`, `:494`; `brand-router/server.js:11`; `DW-Websites/shop-by-color/server.js:9`: real-looking Shopify/Slack/Anthropic/Zendesk/Postgres secrets are hardcoded. Rotate every exposed credential, purge from files/history/backups, load only from env/secret store.
Designer-Wallcoverings: - `.env:1`, `shopify/.env:1`, `DW-MCP/.env:1`, `DW-Agents/.env:1`: live secret-bearing env files sit inside the project tree. Confirm whether they are tracked/backed up; rotate and move to an untracked secrets location.
Designer-Wallcoverings: - `DW-Agents/dw-agents/agent-legal-team/legal-agent.ts:248-284`, `:1894`, `:2151`: auth middleware is not applied, while unauthenticated routes can run Claude analysis and set Shopify products to draft. Add global auth before routes and separately verify Shopify webhook HMAC.
Designer-Wallcoverings: - `admin/server.ts:19`, `:30`, `:61`, `:421-424`: admin interface falls back to `admin123`, uses `Math.random()` bearer tokens, allows `Access-Control-Allow-Origin: *`, and prints the admin password. Require `ADMIN_PASSWORD`, use `crypto.randomBytes`, restrict CORS, never log secrets.
Designer-Wallcoverings: - `DW-MCP/src/index.js:300-345`: Shopify OAuth callback has no state validation and logs/displays the new access token. Add OAuth `state` validation, authenticate token-generation flow, and never render/log tokens.
Forza: - `index.html:17-21` public root is a “3 theme mockups” chooser, not the winning production site; visitors land on internal design artifacts. Fix: make root serve `theme-3-costa-rica-modern/` or redirect permanently.
Forza: - `theme-3-costa-rica-modern/contact/index.html:115`, `theme-3-costa-rica-modern/index.html:555` lead forms call `preventDefault()` and never send data; real leads are silently lost or shown a mockup alert. Fix: wire to a form backend/mail handler with success/error states.
Forza: - `theme-3-costa-rica-modern/index.html:14`, `contact/index.html:13`, `about/index.html:15`, `services-legal/index.html:15` load Figma MCP capture JS in production pages; third-party design tooling can execute on every visitor session. Fix: remove from deploy or gate behind local/dev-only build.
Forza: - `README.md:6`, `README.md:63`, `DIARY.md:164` SSL/DNS are documented as unfinished; site may be unreachable or HTTP-only. Fix: confirm DNS A record, run certbot, force HTTPS.
Forza: - Known SQL injection/auth/CVE issues: none observed; there is no backend, auth layer, SQL, or package manifest.
Hormuzy: - `clone/index.html:43-46`: references `/assets/index-DNA8aLxR.js`, `/assets/three-s7MRw7i5.js`, `/assets/r3f-DrPHa5mf.js`, `/assets/index-Bjz6pQij.css`, none present in repo; local/static deploy renders empty `#root`. Fix by committing full build output or restoring source/build pipeline.
Hormuzy: - `clone/manifest.json:17`: references `/icon-512.png`, not present; PWA install/icon fetch breaks. Add the asset or remove the manifest entry.
Hormuzy: - Secrets/auth/SQL injection/prod credentials: none observed.
Hormuzy:
jill-website: - `.env:31` / `.env:32`: Google API keys are committed. Rotate them, restrict by domain/API, remove `.env` from git history, keep only `.env.example`.
jill-website: - `src/server.ts:23` / `src/server.ts:24` / `src/middleware/auth.ts:12` / `views/admin.ejs:416`: production auth falls back to hardcoded passwords and the admin UI embeds `admin:admin123`. Require env secrets at boot; remove client-side Basic Auth; use server sessions.
jill-website: - `src/routes/activities.ts:27` / `src/routes/activities.ts:144` / `src/routes/activities.ts:186` / `src/routes/activities.ts:304`: create/update/delete/bulk-import activity routes have no admin auth beyond site-wide Basic Auth. Mount mutating routes behind `requireAuth` or split public read vs admin write routers.
jill-website: - `src/routes/linkValidation.ts:230` / `src/services/linkValidationService.ts:23`: `/check-url` fetches arbitrary URLs and follows redirects, enabling SSRF/internal probing. Restrict schemes to http/https, block private/link-local IPs, and allowlist external domains if possible.
jill-website: - `src/migrations/002_create_cms_tables.sql:13` / `src/migrations/002_create_page_content.sql:2`: duplicate `002` migrations create incompatible `page_content` schemas; fresh migrations can fail or leave columns the model does not use. Collapse/renumber migrations and reconcile `page_title/gallery_images` vs `title/images`.
Ken: - `src/lib/auth.js:4`, `src/lib/auth.js:6`, `src/lib/db.js:4`: hardcoded JWT secret, admin password, and Postgres password in source; compromise of repo compromises app and DB. Move to env/secret manager, rotate all exposed secrets.
Ken: - `kalshi-dash/server.js:25`, `kalshi-dash/server.js:130`, `kalshi-dash/server.js:351`, `kalshi-dash/server.js:4875`: leaked Slack webhook, Gemini API key, and two DB URLs. Revoke/rotate immediately; load from env only.
Ken: - `src/app/api/markets/route.js:7`, `src/app/api/risk/route.js:7`, `src/app/api/trades/route.js:7`, `src/app/api/workers/route.js:5`: root API routes do not call `authenticateRequest`; client-side dashboard checks are bypassable. Add server-side auth middleware to every non-login route.
Ken: - `src/app/api/trades/route.js:25-57`: `paper_order` trusts price/size/side/outcome and writes order, trade, bankroll, and risk state without validation or transaction. Validate numeric ranges/enums and wrap writes in one DB transaction.
Ken: - `react-dash/server.js:66-76`, `kalshi-dash/server.js:400-410`: session cookies are unsigned base64 JSON; anyone can forge `{authenticated:true}`. Replace with signed JWT or server-side sessions.
lawyer-directory-builder: - `.env:1`, `.env:9-14`: DB/admin/Stripe secrets are present in the project tree; compromise means admin takeover and live charges. Rotate secrets, remove `.env`, commit `.env.example`.
lawyer-directory-builder: - `src/server/index.ts:19`, `src/server/upgrade.ts:242-249`: global `express.json()` runs before Stripe `express.raw()`, so webhook signature verification will receive parsed JSON, not raw bytes. Mount `/webhooks/stripe` raw parser before JSON middleware.
lawyer-directory-builder: - `src/server/upgrade.ts:173-199`: Stripe `success_url`/`cancel_url` are built from `Host` / `x-forwarded-host`; hostile headers can create payment sessions redirecting to attacker-controlled domains. Use fixed `PUBLIC_BASE_URL`.
lawyer-directory-builder: - `src/server/portal.ts:388-395`: login has no rate limit, lockout, or audit trail; leaked/admin emails can be brute-forced. Add per-IP+email throttling and failed-login logging.
lawyer-directory-builder: - `package-lock.json:1544-1545`, `src/server/index.ts:34-181`: Express 4 async route errors are not wrapped; DB errors can become unhandled rejections/hung requests. Add async handler wrapper and central error middleware.
Letsbegin: - `.env.local:1`, `CLAUDE.md:5-6`, `CLAUDE.md:24-27`, `lib/gemini-image.ts:7`, `app/api/prd/generate/route.ts:8`: live API keys/passwords are in repo/docs. Rotate keys/passwords, purge history, require env vars with no fallbacks.
Letsbegin: - `middleware.ts:6-15`: `/api/ralph`, `/api/processes`, `/api/live`, `/api/url-info` are public by prefix. Remove these from `publicPaths`; require auth and CSRF for every mutating/admin route.
Letsbegin: - `lib/auth.ts:7-10`, `app/api/auth/login/route.ts:54-60`, `middleware.ts:68-80`: sessions are unsigned base64 JSON and cookies are `secure:false`; anyone can forge `{authenticated:true}`. Use signed/encrypted session cookies, `secure:true`, env-only secrets.
Letsbegin: - `app/api/ralph/run/route.ts:57-63`, `app/api/ralph/run/route.ts:89-166`, `app/api/ralph/run/route.ts:168-237`: public endpoint accepts arbitrary `projectPath`/story data, writes files, `chown -R`s, creates shell scripts, and spawns them. Restrict project paths to an allowlist and remove public access before reuse.
Letsbegin: - `app/api/processes/start/route.ts:83-194`: root-running script path uses unsanitized PRD fields and invokes `claude --dangerously-skip-permissions`. Disable this route or run in a locked sandbox with strict input schema and no root HOME.
malden-house: - [signup.js](/Users/stevestudio2/Projects/malden-house/signup.js:217): email verification is hardcoded `verified: true`; anyone can “claim” any address/email locally. Fix with server-side account creation, signed email tokens, and address ownership rules.
malden-house: - [rental.js](/Users/stevestudio2/Projects/malden-house/rental.js:735): guest inquiries are saved to the visitor’s own `localStorage`, not the host’s inbox; production inquiries silently disappear. Fix with a backend endpoint/email delivery and explicit failure UI.
malden-house: - [network.js](/Users/stevestudio2/Projects/malden-house/network.js:33): public source exposes Tailscale IPs, public server IPs, hostnames, service names, and ports. Remove `network.html/js` from public builds or gate behind auth/VPN-only hosting.
malden-house: - [dashboard.js](/Users/stevestudio2/Projects/malden-house/dashboard.js:30), [browse.js](/Users/stevestudio2/Projects/malden-house/browse.js:35), [rental.js](/Users/stevestudio2/Projects/malden-house/rental.js:374): trusted `localStorage`/geocoder fields are rendered through template `innerHTML`; malicious stored records can execute markup/script-like payloads. Build DOM nodes with `textContent` or sanitize all interpolated fields.
malden-house: - [signup.js](/Users/stevestudio2/Projects/malden-house/signup.js:263): demo seed includes Steve’s real-looking email/phone/address in source and UI. Replace with fake fixtures before any public repo/deploy.
Norma: - `.env.local:1`, `.env.local:3-5`, `.env.local:14`, `.env.local:21-22`, `CLAUDE.md:12-13`, `README.md:21`: live-looking DB/admin/cron/session/Gemini/Gmail secrets are committed/documented. Rotate all exposed credentials, remove secrets from repo/docs, purge history if shared.
Norma: - `middleware.ts:55-89` + `app/api/social/ai-image/route.ts:20`, `app/api/social/bulk-schedule/route.ts:66`, `app/api/social/bulk-schedule/route.ts:88`, `app/api/social/posts/approve/route.ts:10`, `app/api/social/posts/pending/route.ts:10`: middleware only checks token structure/expiry, while these routes do no `requireRole`; forged cookies can generate images, schedule/approve/read social posts. Add `requireRole` to every non-public route or crypto-verify in middleware.
Norma: - `app/api/pulse/petitions/route.ts:111-182`: unauthenticated public POST creates immediately active petitions with no rate limit, moderation, captcha, or abuse controls. Default to draft/moderation and add IP/user rate limiting.
Norma: - `app/api/pulse/petitions/[id]/sign/route.ts:13-44`, `app/api/pulse/petitions/[id]/sign/route.ts:51-52`: public signing has no rate limit and does not check `allow_signatures`; any active petition can be spam-signed. Check `allow_signatures`, add rate limiting/captcha/email verification.
Norma: - `app/api/nonprofit/enrich/route.ts:179-184`, `app/api/nonprofit/enrich/route.ts:227-235`, `app/api/email-analyzer/fetch-url/route.ts:202-215`, `lib/social-crawl.ts:111-117`: server-side URL fetch accepts arbitrary HTTP(S), follows redirects, and does not block private/link-local IPs. Add SSRF guard: DNS/IP validation, redirect revalidation, size limits, and deny internal ranges.
professional-directory: - [agents/api-agent/server.js](/Users/stevestudio2/Projects/professional-directory/agents/api-agent/server.js:18), [agents/ingest-agent/server.js](/Users/stevestudio2/Projects/professional-directory/agents/ingest-agent/server.js:47): no auth on mutating/control endpoints; localhost CSRF or any proxy exposure can trigger imports, opt-outs, or CRM edits. Add shared auth middleware, Origin checks, and protect all `POST` routes.
professional-directory: - [agents/ingest-agent/server.js](/Users/stevestudio2/Projects/professional-directory/agents/ingest-agent/server.js:55), [agents/crawler-agent/server.js](/Users/stevestudio2/Projects/professional-directory/agents/crawler-agent/server.js:48): request body can override child-process env, including DB/source URLs. Remove arbitrary env merging; allowlist only safe knobs like `LIMIT`.
professional-directory: - [agents/api-agent/server.js](/Users/stevestudio2/Projects/professional-directory/agents/api-agent/server.js:166): API references `suggested_domain`, `domain_available`, `starred`, `contacted_at`, `is_chain`, `lead_score`; schema lacks them at [db/schema.sql](/Users/stevestudio2/Projects/professional-directory/db/schema.sql:63). Fresh deploy breaks org routes. Add a migration or remove those fields.
professional-directory:
resize-it: - [server.py:21](/Users/stevestudio2/Projects/resize-it/server.py:21), [server.py:22](/Users/stevestudio2/Projects/resize-it/server.py:22), [.env:1](/Users/stevestudio2/Projects/resize-it/.env:1), [.env:2](/Users/stevestudio2/Projects/resize-it/.env:2): Spoonflower credentials are committed/hardcoded defaults. Rotate password, remove defaults, require env vars at startup.
resize-it: - [SKILL.md:89](/Users/stevestudio2/Projects/resize-it/SKILL.md:89): Gemini API key is embedded in docs/source. Revoke it, move to secret storage, scrub history if this was ever shared.
resize-it: - [server.py:270](/Users/stevestudio2/Projects/resize-it/server.py:270)-[274](/Users/stevestudio2/Projects/resize-it/server.py:274): Flask debug server binds `0.0.0.0` and advertises a public IP. Disable debug, bind localhost or put behind authenticated production WSGI.
resize-it: - [server.py:29](/Users/stevestudio2/Projects/resize-it/server.py:29), [server.py:103](/Users/stevestudio2/Projects/resize-it/server.py:103), [server.py:155](/Users/stevestudio2/Projects/resize-it/server.py:155): no auth on endpoints that use stored Spoonflower credentials. Add owner auth/token gate; especially block public `/api/upload-to-spoonflower`.
resize-it: - [server.py:165](/Users/stevestudio2/Projects/resize-it/server.py:165)-[167](/Users/stevestudio2/Projects/resize-it/server.py:167): URL validation is substring-only; `http://internal/?spoonflower.com` passes to Playwright. Use `urlparse`, require HTTPS and exact Spoonflower host suffix.
secrets-manager: - `audit-2026-04-30.txt:1`: audit found `307` secret-looking leaks across projects/skills; current manager records the blast radius but does not remediate it. Rotate exposed keys, delete hardcoded copies, then rerun audit until clean.
secrets-manager: - `auto-ingest.sh:31` + `auto-ingest.sh:51`: import failures are swallowed with `|| true`, then the changed hash is committed; bad/partial ingests can be silently skipped forever. Only write state after a successful import; log and exit nonzero on failure.
secrets-manager: - `auto-ingest.sh:42-44`: every qualifying changed desktop file can background-launch `run-all-stages.sh`; no lock/idempotency guard. Add a lockfile or launchd `KeepAlive`/single-flight guard and record last fired input hash.
secrets-manager: - `cli.js:68` + `cli.js:104`: `StrictHostKeyChecking=accept-new` while pushing secrets to remote root hosts risks trusting the wrong first-seen host. Pin host keys in `known_hosts` and fail closed.
secrets-manager: - `routes.json:184-202`, `routes.json:301-319`, `routes.json:321-340`: prod API keys are routed directly to `root@45.61.58.125`. Use a restricted deploy user and least-privilege remote path ownership.
site-factory: - `.env:10`, `.env:13`, `sites/*/app/.env.local:5-7`: live Cloudflare/Stripe/webhook secrets are in the project tree. Rotate immediately, remove all real `.env*`, add `.gitignore`, move secrets to 1Password/Vercel/PM2 env.
site-factory: - `ecosystem.config.js:49`, `admin/server.js:43-46`: production PM2 enables `SF_ADMIN_DEV=1`, making every request auto-admin. Set default to `0`, bind admin to `127.0.0.1`, require real OAuth.
site-factory: - `admin/server.js:15`: production can boot with hardcoded `SESSION_SECRET`, enabling session forgery if dev bypass is later removed. Refuse boot in production unless `SESSION_SECRET` is set and strong.
site-factory: - `orchestrator/server.js:15`, `orchestrator/server.js:37`, `orchestrator/server.js:96`, `orchestrator/server.js:130`, `orchestrator/server.js:164`, `orchestrator/server.js:180`: orchestrator has open CORS and no auth on write routes. Add shared bearer auth, restrict CORS, expose only behind admin.
site-factory: - `orchestrator/server.js:195-204`, `stages/runners.js:240-243`: concurrent `/advance` calls can run the same stage twice, duplicating DNS/Stripe/Vercel work. Use DB transaction/advisory lock and only advance `pending` stages.
stayclaim: - `.env.local:4`: real Google Maps browser key is in the workspace; if unrestricted, cost/abuse risk. Rotate it, remove `.env.local`, enforce HTTP referrer restrictions and quotas.
stayclaim: - `scripts/filmla-cpra-followup.sh:15-16`: hardcoded Basic Auth credential to a Gmail HTTP agent over plain HTTP tailnet URL; repo leak grants email search/send. Rotate credential; load from Keychain/env; require TLS or strict Tailscale ACL.
stayclaim: - `src/app/admin/layout.tsx:45-46`, `src/app/admin/data/page.tsx:167-192`: admin is explicitly unauthenticated and exposes claim/sponsored emails. Put real server-side auth in front of all `/admin/*`, plus nginx deny until ready.
stayclaim: - `src/app/dashboard/page.tsx:11-14`, `src/app/dashboard/page.tsx:21`, `src/app/dashboard/page.tsx:59-63`: `?email=` acts as authentication; anyone who knows an email can view owner listings/pending claims. Replace with magic-link/session auth before exposing.
stayclaim: - `src/app/search/page.tsx:128-130`, `src/app/api/search/route.ts:107-109`: OCR snippets are rendered with `dangerouslySetInnerHTML`; OCR/source text can become stored XSS. Escape source text and render `<mark>` tokens safely.
the-ai-factory: - `server.js:67`, `server.js:95`, `server.js:31`: no auth plus `Access-Control-Allow-Origin: *`; any webpage Steve visits can POST to localhost and trigger builds/activation. Fix: require `ADMIN_TOKEN` Bearer auth on all mutating routes and restrict CORS to the viewer origin.
the-ai-factory: - `server.js:95`, `server.js:104`, `server.js:143`: activation copies LLM-generated files into `~/.claude` with only status gating, and `?force=true` bypasses approval. Fix: remove force from HTTP or require token + explicit local CLI confirmation; show/record a deterministic diff before copy.
the-ai-factory: - `src/stages/scaffold.js:16`, `src/stages/smoke_test.js:20`: generated subagents may receive `Bash`, `Write`, or `Edit`; smoke tests only check that tools exist, not whether they are safe. Fix: parse frontmatter and deny dangerous tools unless explicitly allowlisted by artifact type/request.
the-ai-factory: - Secrets leaked in code: none observed; checked-in `.env` is blank (`.env:4`, `.env:10`, `.env:14`).
the-ai-factory: - SQL injection: none observed; queries use placeholders.
trademarks-copyright: - `package.json:18`, `src/middleware.ts:14`: Next `15.0.3` is vulnerable to middleware auth bypass; admin auth relies on middleware. Upgrade to `15.2.3+` or block `x-middleware-subrequest` at the edge. citeturn0search4
trademarks-copyright: - `src/app/api/drops/send/route.ts:15`, `src/app/api/drops/compose/route.ts:8`, `src/app/api/score/route.ts:9`, `src/app/api/brands/hunt/route.ts:12`: public mutation routes can send newsletters, compose drops, rescore DB, and run crawler/LLM jobs. Put all operational routes behind server-side auth, not only middleware path matching.
trademarks-copyright: - `src/app/api/drops/drop-items/[id]/route.ts:8`: public PATCH edits newsletter content/CTA URLs. Move under `/api/drops/admin/*` or enforce auth inside the handler.
trademarks-copyright: - `src/app/api/drops/checkout/route.ts:23`: if Stripe is unset, any caller can set any subscriber email to paid tier at lines `24-30`. Remove dev fallback outside `NODE_ENV !== "production"` and require subscriber token/session.
trademarks-copyright: - `.env.local:30`, `.env.local:47-48`: plaintext admin token and Basic auth credential, including raw password comment, sit in project dir. Rotate both; store outside repo/workspace backups.
VictoryStays: - [server.js](/Users/stevestudio2/Projects/VictoryStays/server.js:51): `express.static(__dirname)` publishes the whole repo, including `data/victorystays.db`, source, lockfiles, generated datasets, and future `data/claims.jsonl`. Fix: serve a dedicated `public/` dir and explicitly block `/data`, scripts, DB/WAL/SHM, logs.
VictoryStays: - [api-claim.js](/Users/stevestudio2/Projects/VictoryStays/api-claim.js:81): `GET /api/claim?admin=1` returns every claim, PII, and verification codes with no auth. Fix: require operator auth/session or remove public route.
VictoryStays: - [api-claim.js](/Users/stevestudio2/Projects/VictoryStays/api-claim.js:103): unauthenticated `PATCH /api/claim` can mark any claim verified/rejected; code check is optional. Fix: authenticate operator actions and require code for verification.
VictoryStays: - [api-claim.js](/Users/stevestudio2/Projects/VictoryStays/api-claim.js:72), [home.html](/Users/stevestudio2/Projects/VictoryStays/home.html:434): claim submission returns the postcard verification code to the claimant, defeating the mail-based proof. Fix: never return the code; only store/print/mail it.
VictoryStays: - [api-claim.js](/Users/stevestudio2/Projects/VictoryStays/api-claim.js:27): unbounded JSON body plus sync append lets anyone fill disk with claims. Fix: `express.json({limit})`, rate-limit/IP throttle, validate field lengths.
visual-factory: - `server.js:223`, `server.js:257`, `server.js:279`, `server.js:326`, `server.js:362`: no auth/CSRF on create, retry, delete, activate, IG post. Any local webpage/process reaching `127.0.0.1:9892` can trigger destructive POSTs. Fix with required admin token plus Origin/CSRF checks.
visual-factory: - `src/stages/compose.js:34-44`, `src/stages/render.js:13`: untrusted LLM HTML is written then opened as `file://` with JS/network enabled. Prompt injection can embed `file://`/remote URLs and leak local data via screenshots or callbacks. Fix by sanitizing, disabling JS, using request interception/CSP, and blocking all `file:`/external loads.
visual-factory: - `server.js:263-271`: retry accepts `running`, deletes rows/output, then enqueues another pipeline while the original continues. Failure mode: corrupted events/artifacts and competing writes to the same run dir. Fix by refusing running runs or implementing cancellation/locking.
visual-factory: - `src/stages/intake.js:35-36`, `src/stages/render.js:11-16`: LLM-controlled dimensions are not clamped. A bad spec can request huge viewport/screenshot and exhaust memory. Fix with min/max bounds before DB/render.
visual-factory:
wholivedthere: - `.env:2-5`, `scripts/deploy-direct.sh:21-22`, `scripts/deploy-pastdoor.sh:28-29`: committed Google/DPLA/GoDaddy API secrets; DNS/domain takeover and API billing exposure. Revoke/rotate now, remove defaults, keep only `.env.example`.
wholivedthere: - `scripts/deploy-direct.sh:60`: deploy path drops `pastdoor` database every run; one mistaken rerun destroys production data. Replace with migration/restore into temp DB plus explicit manual confirmation.
wholivedthere: - `mcp-la-records/src/arcgis.mjs:83-93`, `mcp-la-records/src/arcgis.mjs:110`: user input is interpolated into ArcGIS SQL-like `where`; quotes/wildcards can alter query semantics. Validate APN with strict regex, escape `%/_/'`, and reject unsupported address chars.
wholivedthere: - `mcp-la-records/src/arcgis.mjs:97`: `limit` is unvalidated and passed as `resultRecordCount`; callers can request huge result sets or invalid counts. Clamp to small integer range, e.g. `1..25`.
wholivedthere: - `scripts/schema.sql:58`: generated column uses `now()`, which Postgres rejects because generated expressions must be immutable. Replace with a view or query predicate for stale rows.
yolo-agent: - `server.js:17-18`, `ledger-app/src/lib/xfetch.ts:18`, `dashboard/task-ledger.html:279`: hardcoded `admin:DWSecure2024!` shipped in server and browser code. Anyone who sees the UI/source can control the agent. Fix: env-only secret, rotate password, remove client-side auth embedding.
yolo-agent: - `server.js:614-625` + `server.js:226-239`: `/api/run` accepts arbitrary prompt, auto-starts, and launches Claude with `Bash/Write/Edit` in `/Users/stevestudio2/Projects`. With leaked auth this is remote code execution over the whole projects tree. Fix: bind to VPN/localhost, remove dangerous tools by default, require manual approval for write/bash tasks.
yolo-agent: - `create-missing-collections.js:15`, `scripts/collection-descriptions.js:16`, `tasks/done/AG_dw-exclusive-page-update.md:9`, `tasks/done/14_shopify-image-audit.md:5`: live-looking Slack webhook, Gemini key, Shopify tokens, and Postgres credentials are committed in code/task artifacts. Fix: revoke/rotate all exposed secrets and purge/redact task archive.
yolo-agent: - `server.js:1038-1043`: service binds `0.0.0.0` and prints public IP dashboard URL while auth is static/basic. Failure mode is internet-exposed agent control. Fix: bind `127.0.0.1` behind SSH/VPN or enforce firewall plus fresh credentials.
yolo-agent:
## P0 findings — schema/migration drift
AgentAbrams: - `snippets/redact_lint.py:71-73`, `.github/workflows/ci.yml:34-40`: detected secrets are printed with surrounding snippet into CI logs. Fix by printing only pattern name + file/line, never matched content.
AgentAbrams: - `video/oauth_authorize.py:31-32`: refresh token is printed to stdout, making terminal logs/screen recordings a secret leak. Fix by writing only to a chmod-600 local file or clipboard prompt, not stdout.
AgentAbrams: - `video/upload_youtube.py:38`, `.github/workflows/youtube.yml:36-44`: uploads default to `privacy="public"` with no workflow privacy input; wrong artifact/path becomes public immediately. Default to `private`/`unlisted` and require explicit public promotion.
bankrupt-leads: - [src/poller.py](/Users/stevestudio2/Projects/bankrupt-leads/src/poller.py:37): only requests first 100 dockets and never follows pagination; busy courts silently lose leads. Fix: loop CourtListener `next` pages until exhausted.
bankrupt-leads: - [src/poller.py](/Users/stevestudio2/Projects/bankrupt-leads/src/poller.py:45): poller inserts cases only; no code populates `filings`, downloads PDFs, or extracts text, so classify/extract/digest have no real input. Fix: implement filing/document ingestion or mark current scripts as nonfunctional scaffold.
bankrupt-leads: - [src/extract.py](/Users/stevestudio2/Projects/bankrupt-leads/src/extract.py:77): extraction is not idempotent; rerunning a filing duplicates assets every time. Fix: add a natural key/unique constraint or delete/upsert assets per `filing_id` in one transaction.
bubbesblock: - `.env:2`, `.env:3`, `.env:5`: real API keys live in the project root; accidental sync/commit leaks Google/DPLA access. Rotate keys if shared, keep `.env` out of VCS/backups, and enforce domain/IP/API restrictions.
bubbesblock: - `README.md:9`: claimed-address posting gate is only documented, with no enforceable auth code present. If this repo is deployed as-is or rebuilt later, posting can ship without verification; implement server-side verification against `claimmyaddress.com`.
bubbesblock:
claimmyaddress: - `.env:2-5`: live API keys are stored in plaintext in the project directory; if synced, backed up, or later committed, they are exposed. Rotate these keys, move secrets to a real secret store, and keep only `.env.example`.
claimmyaddress: - `.env:3`: `GOOGLE_GEOCODING_API_KEY` is a server-side key; if not strictly IP/service-account restricted, it can be abused for billable requests. Verify restrictions in GCP and rotate after removal.
claimmyaddress: - `README.md:7-9`: this repo claims it handles signup, OAuth, document upload, inventory, and insurance export, but no implementation exists here. Security review of auth/upload/data handling cannot be performed from this repo; review the shared backend before launch.
dear-bubbe-next: - none observed.
dear-bubbe-next:
Designer-Wallcoverings: - `DW-Agents/ecosystem.config.js:45`, `:72`, `:92`, `:134`, `:176`, `:494`; `brand-router/server.js:11`; `DW-Websites/shop-by-color/server.js:9`: real-looking Shopify/Slack/Anthropic/Zendesk/Postgres secrets are hardcoded. Rotate every exposed credential, purge from files/history/backups, load only from env/secret store.
Designer-Wallcoverings: - `.env:1`, `shopify/.env:1`, `DW-MCP/.env:1`, `DW-Agents/.env:1`: live secret-bearing env files sit inside the project tree. Confirm whether they are tracked/backed up; rotate and move to an untracked secrets location.
Designer-Wallcoverings: - `DW-Agents/dw-agents/agent-legal-team/legal-agent.ts:248-284`, `:1894`, `:2151`: auth middleware is not applied, while unauthenticated routes can run Claude analysis and set Shopify products to draft. Add global auth before routes and separately verify Shopify webhook HMAC.
Forza: - `index.html:17-21` public root is a “3 theme mockups” chooser, not the winning production site; visitors land on internal design artifacts. Fix: make root serve `theme-3-costa-rica-modern/` or redirect permanently.
Forza: - `theme-3-costa-rica-modern/contact/index.html:115`, `theme-3-costa-rica-modern/index.html:555` lead forms call `preventDefault()` and never send data; real leads are silently lost or shown a mockup alert. Fix: wire to a form backend/mail handler with success/error states.
Forza: - `theme-3-costa-rica-modern/index.html:14`, `contact/index.html:13`, `about/index.html:15`, `services-legal/index.html:15` load Figma MCP capture JS in production pages; third-party design tooling can execute on every visitor session. Fix: remove from deploy or gate behind local/dev-only build.
Hormuzy: - `clone/index.html:43-46`: references `/assets/index-DNA8aLxR.js`, `/assets/three-s7MRw7i5.js`, `/assets/r3f-DrPHa5mf.js`, `/assets/index-Bjz6pQij.css`, none present in repo; local/static deploy renders empty `#root`. Fix by committing full build output or restoring source/build pipeline.
Hormuzy: - `clone/manifest.json:17`: references `/icon-512.png`, not present; PWA install/icon fetch breaks. Add the asset or remove the manifest entry.
Hormuzy: - Secrets/auth/SQL injection/prod credentials: none observed.
jill-website: - `.env:31` / `.env:32`: Google API keys are committed. Rotate them, restrict by domain/API, remove `.env` from git history, keep only `.env.example`.
jill-website: - `src/server.ts:23` / `src/server.ts:24` / `src/middleware/auth.ts:12` / `views/admin.ejs:416`: production auth falls back to hardcoded passwords and the admin UI embeds `admin:admin123`. Require env secrets at boot; remove client-side Basic Auth; use server sessions.
jill-website: - `src/routes/activities.ts:27` / `src/routes/activities.ts:144` / `src/routes/activities.ts:186` / `src/routes/activities.ts:304`: create/update/delete/bulk-import activity routes have no admin auth beyond site-wide Basic Auth. Mount mutating routes behind `requireAuth` or split public read vs admin write routers.
Ken: - `src/lib/auth.js:4`, `src/lib/auth.js:6`, `src/lib/db.js:4`: hardcoded JWT secret, admin password, and Postgres password in source; compromise of repo compromises app and DB. Move to env/secret manager, rotate all exposed secrets.
Ken: - `kalshi-dash/server.js:25`, `kalshi-dash/server.js:130`, `kalshi-dash/server.js:351`, `kalshi-dash/server.js:4875`: leaked Slack webhook, Gemini API key, and two DB URLs. Revoke/rotate immediately; load from env only.
Ken: - `src/app/api/markets/route.js:7`, `src/app/api/risk/route.js:7`, `src/app/api/trades/route.js:7`, `src/app/api/workers/route.js:5`: root API routes do not call `authenticateRequest`; client-side dashboard checks are bypassable. Add server-side auth middleware to every non-login route.
lawyer-directory-builder: - `.env:1`, `.env:9-14`: DB/admin/Stripe secrets are present in the project tree; compromise means admin takeover and live charges. Rotate secrets, remove `.env`, commit `.env.example`.
lawyer-directory-builder: - `src/server/index.ts:19`, `src/server/upgrade.ts:242-249`: global `express.json()` runs before Stripe `express.raw()`, so webhook signature verification will receive parsed JSON, not raw bytes. Mount `/webhooks/stripe` raw parser before JSON middleware.
lawyer-directory-builder: - `src/server/upgrade.ts:173-199`: Stripe `success_url`/`cancel_url` are built from `Host` / `x-forwarded-host`; hostile headers can create payment sessions redirecting to attacker-controlled domains. Use fixed `PUBLIC_BASE_URL`.
Letsbegin: - `.env.local:1`, `CLAUDE.md:5-6`, `CLAUDE.md:24-27`, `lib/gemini-image.ts:7`, `app/api/prd/generate/route.ts:8`: live API keys/passwords are in repo/docs. Rotate keys/passwords, purge history, require env vars with no fallbacks.
Letsbegin: - `middleware.ts:6-15`: `/api/ralph`, `/api/processes`, `/api/live`, `/api/url-info` are public by prefix. Remove these from `publicPaths`; require auth and CSRF for every mutating/admin route.
Letsbegin: - `lib/auth.ts:7-10`, `app/api/auth/login/route.ts:54-60`, `middleware.ts:68-80`: sessions are unsigned base64 JSON and cookies are `secure:false`; anyone can forge `{authenticated:true}`. Use signed/encrypted session cookies, `secure:true`, env-only secrets.
malden-house: - [signup.js](/Users/stevestudio2/Projects/malden-house/signup.js:217): email verification is hardcoded `verified: true`; anyone can “claim” any address/email locally. Fix with server-side account creation, signed email tokens, and address ownership rules.
malden-house: - [rental.js](/Users/stevestudio2/Projects/malden-house/rental.js:735): guest inquiries are saved to the visitor’s own `localStorage`, not the host’s inbox; production inquiries silently disappear. Fix with a backend endpoint/email delivery and explicit failure UI.
malden-house: - [network.js](/Users/stevestudio2/Projects/malden-house/network.js:33): public source exposes Tailscale IPs, public server IPs, hostnames, service names, and ports. Remove `network.html/js` from public builds or gate behind auth/VPN-only hosting.
Norma: - `.env.local:1`, `.env.local:3-5`, `.env.local:14`, `.env.local:21-22`, `CLAUDE.md:12-13`, `README.md:21`: live-looking DB/admin/cron/session/Gemini/Gmail secrets are committed/documented. Rotate all exposed credentials, remove secrets from repo/docs, purge history if shared.
Norma: - `middleware.ts:55-89` + `app/api/social/ai-image/route.ts:20`, `app/api/social/bulk-schedule/route.ts:66`, `app/api/social/bulk-schedule/route.ts:88`, `app/api/social/posts/approve/route.ts:10`, `app/api/social/posts/pending/route.ts:10`: middleware only checks token structure/expiry, while these routes do no `requireRole`; forged cookies can generate images, schedule/approve/read social posts. Add `requireRole` to every non-public route or crypto-verify in middleware.
Norma: - `app/api/pulse/petitions/route.ts:111-182`: unauthenticated public POST creates immediately active petitions with no rate limit, moderation, captcha, or abuse controls. Default to draft/moderation and add IP/user rate limiting.
professional-directory: - [agents/api-agent/server.js](/Users/stevestudio2/Projects/professional-directory/agents/api-agent/server.js:18), [agents/ingest-agent/server.js](/Users/stevestudio2/Projects/professional-directory/agents/ingest-agent/server.js:47): no auth on mutating/control endpoints; localhost CSRF or any proxy exposure can trigger imports, opt-outs, or CRM edits. Add shared auth middleware, Origin checks, and protect all `POST` routes.
professional-directory: - [agents/ingest-agent/server.js](/Users/stevestudio2/Projects/professional-directory/agents/ingest-agent/server.js:55), [agents/crawler-agent/server.js](/Users/stevestudio2/Projects/professional-directory/agents/crawler-agent/server.js:48): request body can override child-process env, including DB/source URLs. Remove arbitrary env merging; allowlist only safe knobs like `LIMIT`.
professional-directory: - [agents/api-agent/server.js](/Users/stevestudio2/Projects/professional-directory/agents/api-agent/server.js:166): API references `suggested_domain`, `domain_available`, `starred`, `contacted_at`, `is_chain`, `lead_score`; schema lacks them at [db/schema.sql](/Users/stevestudio2/Projects/professional-directory/db/schema.sql:63). Fresh deploy breaks org routes. Add a migration or remove those fields.
resize-it: - [server.py:21](/Users/stevestudio2/Projects/resize-it/server.py:21), [server.py:22](/Users/stevestudio2/Projects/resize-it/server.py:22), [.env:1](/Users/stevestudio2/Projects/resize-it/.env:1), [.env:2](/Users/stevestudio2/Projects/resize-it/.env:2): Spoonflower credentials are committed/hardcoded defaults. Rotate password, remove defaults, require env vars at startup.
resize-it: - [SKILL.md:89](/Users/stevestudio2/Projects/resize-it/SKILL.md:89): Gemini API key is embedded in docs/source. Revoke it, move to secret storage, scrub history if this was ever shared.
resize-it: - [server.py:270](/Users/stevestudio2/Projects/resize-it/server.py:270)-[274](/Users/stevestudio2/Projects/resize-it/server.py:274): Flask debug server binds `0.0.0.0` and advertises a public IP. Disable debug, bind localhost or put behind authenticated production WSGI.
secrets-manager: - `audit-2026-04-30.txt:1`: audit found `307` secret-looking leaks across projects/skills; current manager records the blast radius but does not remediate it. Rotate exposed keys, delete hardcoded copies, then rerun audit until clean.
secrets-manager: - `auto-ingest.sh:31` + `auto-ingest.sh:51`: import failures are swallowed with `|| true`, then the changed hash is committed; bad/partial ingests can be silently skipped forever. Only write state after a successful import; log and exit nonzero on failure.
secrets-manager: - `auto-ingest.sh:42-44`: every qualifying changed desktop file can background-launch `run-all-stages.sh`; no lock/idempotency guard. Add a lockfile or launchd `KeepAlive`/single-flight guard and record last fired input hash.
site-factory: - `.env:10`, `.env:13`, `sites/*/app/.env.local:5-7`: live Cloudflare/Stripe/webhook secrets are in the project tree. Rotate immediately, remove all real `.env*`, add `.gitignore`, move secrets to 1Password/Vercel/PM2 env.
site-factory: - `ecosystem.config.js:49`, `admin/server.js:43-46`: production PM2 enables `SF_ADMIN_DEV=1`, making every request auto-admin. Set default to `0`, bind admin to `127.0.0.1`, require real OAuth.
site-factory: - `admin/server.js:15`: production can boot with hardcoded `SESSION_SECRET`, enabling session forgery if dev bypass is later removed. Refuse boot in production unless `SESSION_SECRET` is set and strong.
stayclaim: - `.env.local:4`: real Google Maps browser key is in the workspace; if unrestricted, cost/abuse risk. Rotate it, remove `.env.local`, enforce HTTP referrer restrictions and quotas.
stayclaim: - `scripts/filmla-cpra-followup.sh:15-16`: hardcoded Basic Auth credential to a Gmail HTTP agent over plain HTTP tailnet URL; repo leak grants email search/send. Rotate credential; load from Keychain/env; require TLS or strict Tailscale ACL.
stayclaim: - `src/app/admin/layout.tsx:45-46`, `src/app/admin/data/page.tsx:167-192`: admin is explicitly unauthenticated and exposes claim/sponsored emails. Put real server-side auth in front of all `/admin/*`, plus nginx deny until ready.
the-ai-factory: - `server.js:67`, `server.js:95`, `server.js:31`: no auth plus `Access-Control-Allow-Origin: *`; any webpage Steve visits can POST to localhost and trigger builds/activation. Fix: require `ADMIN_TOKEN` Bearer auth on all mutating routes and restrict CORS to the viewer origin.
the-ai-factory: - `server.js:95`, `server.js:104`, `server.js:143`: activation copies LLM-generated files into `~/.claude` with only status gating, and `?force=true` bypasses approval. Fix: remove force from HTTP or require token + explicit local CLI confirmation; show/record a deterministic diff before copy.
the-ai-factory: - `src/stages/scaffold.js:16`, `src/stages/smoke_test.js:20`: generated subagents may receive `Bash`, `Write`, or `Edit`; smoke tests only check that tools exist, not whether they are safe. Fix: parse frontmatter and deny dangerous tools unless explicitly allowlisted by artifact type/request.
trademarks-copyright: - `package.json:18`, `src/middleware.ts:14`: Next `15.0.3` is vulnerable to middleware auth bypass; admin auth relies on middleware. Upgrade to `15.2.3+` or block `x-middleware-subrequest` at the edge. citeturn0search4
trademarks-copyright: - `src/app/api/drops/send/route.ts:15`, `src/app/api/drops/compose/route.ts:8`, `src/app/api/score/route.ts:9`, `src/app/api/brands/hunt/route.ts:12`: public mutation routes can send newsletters, compose drops, rescore DB, and run crawler/LLM jobs. Put all operational routes behind server-side auth, not only middleware path matching.
trademarks-copyright: - `src/app/api/drops/drop-items/[id]/route.ts:8`: public PATCH edits newsletter content/CTA URLs. Move under `/api/drops/admin/*` or enforce auth inside the handler.
VictoryStays: - [server.js](/Users/stevestudio2/Projects/VictoryStays/server.js:51): `express.static(__dirname)` publishes the whole repo, including `data/victorystays.db`, source, lockfiles, generated datasets, and future `data/claims.jsonl`. Fix: serve a dedicated `public/` dir and explicitly block `/data`, scripts, DB/WAL/SHM, logs.
VictoryStays: - [api-claim.js](/Users/stevestudio2/Projects/VictoryStays/api-claim.js:81): `GET /api/claim?admin=1` returns every claim, PII, and verification codes with no auth. Fix: require operator auth/session or remove public route.
VictoryStays: - [api-claim.js](/Users/stevestudio2/Projects/VictoryStays/api-claim.js:103): unauthenticated `PATCH /api/claim` can mark any claim verified/rejected; code check is optional. Fix: authenticate operator actions and require code for verification.
visual-factory: - `server.js:223`, `server.js:257`, `server.js:279`, `server.js:326`, `server.js:362`: no auth/CSRF on create, retry, delete, activate, IG post. Any local webpage/process reaching `127.0.0.1:9892` can trigger destructive POSTs. Fix with required admin token plus Origin/CSRF checks.
visual-factory: - `src/stages/compose.js:34-44`, `src/stages/render.js:13`: untrusted LLM HTML is written then opened as `file://` with JS/network enabled. Prompt injection can embed `file://`/remote URLs and leak local data via screenshots or callbacks. Fix by sanitizing, disabling JS, using request interception/CSP, and blocking all `file:`/external loads.
visual-factory: - `server.js:263-271`: retry accepts `running`, deletes rows/output, then enqueues another pipeline while the original continues. Failure mode: corrupted events/artifacts and competing writes to the same run dir. Fix by refusing running runs or implementing cancellation/locking.
wholivedthere: - `.env:2-5`, `scripts/deploy-direct.sh:21-22`, `scripts/deploy-pastdoor.sh:28-29`: committed Google/DPLA/GoDaddy API secrets; DNS/domain takeover and API billing exposure. Revoke/rotate now, remove defaults, keep only `.env.example`.
wholivedthere: - `scripts/deploy-direct.sh:60`: deploy path drops `pastdoor` database every run; one mistaken rerun destroys production data. Replace with migration/restore into temp DB plus explicit manual confirmation.
wholivedthere: - `mcp-la-records/src/arcgis.mjs:83-93`, `mcp-la-records/src/arcgis.mjs:110`: user input is interpolated into ArcGIS SQL-like `where`; quotes/wildcards can alter query semantics. Validate APN with strict regex, escape `%/_/'`, and reject unsupported address chars.
yolo-agent: - `server.js:17-18`, `ledger-app/src/lib/xfetch.ts:18`, `dashboard/task-ledger.html:279`: hardcoded `admin:DWSecure2024!` shipped in server and browser code. Anyone who sees the UI/source can control the agent. Fix: env-only secret, rotate password, remove client-side auth embedding.
yolo-agent: - `server.js:614-625` + `server.js:226-239`: `/api/run` accepts arbitrary prompt, auto-starts, and launches Claude with `Bash/Write/Edit` in `/Users/stevestudio2/Projects`. With leaked auth this is remote code execution over the whole projects tree. Fix: bind to VPN/localhost, remove dangerous tools by default, require manual approval for write/bash tasks.
yolo-agent: - `create-missing-collections.js:15`, `scripts/collection-descriptions.js:16`, `tasks/done/AG_dw-exclusive-page-update.md:9`, `tasks/done/14_shopify-image-audit.md:5`: live-looking Slack webhook, Gemini key, Shopify tokens, and Postgres credentials are committed in code/task artifacts. Fix: revoke/rotate all exposed secrets and purge/redact task archive.