Security hardening: reference backend, marketing site, bench VM#37
Merged
Conversation
The @pcbjam/backend-example server had a 1 GiB body limit, no per-owner/per-lib quotas, bound to 0.0.0.0, and reflected any origin with credentials when CORS_ORIGIN is *. Bound the write surface (5 MiB body cap, per-owner lib and per-lib item quotas), bind 127.0.0.1 by default (opt in via HOST), and force credentials off for a wildcard CORS origin. Refactor main() into an exported buildApp() and add web/backend/test/security.test.ts (inject-based). Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
…aitlist - gerber-demo/boot.js honors the base/cdn/tag script-source overrides only on a loopback hostname, so a shipped page ignores them. - /api/waitlist gains a best-effort per-IP/per-address rate limit and masks the submitter address in the no-key log line. Adds vitest to the site: test/boot-overrides.test.ts (happy-dom) and test/waitlist.test.ts. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
The wasm-opt bench VM cloud-init seed carried a committed console/SSH password and enabled SSH password auth. setup-vm.sh already requires and injects an SSH pubkey, so lock the password (lock_passwd: true) and disable SSH password auth (ssh_pwauth: false). Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Security hardening pass
Three focused hardening changes, each with tests:
web/backend): bound the write surface — a 5 MiB body cap (413 over it), per-owner library and per-lib item quotas (400/429), bind to127.0.0.1by default (opt into off-box viaHOST), and force CORS credentials off when the origin is a wildcard.main()is refactored into an exportedbuildApp()so it can be driven via Fastifyapp.inject(); addsweb/backend/test/security.test.ts.site): thegerber-demoboot script now honors the?base=/?cdn=/?tag=script-source overrides only on a loopback hostname (a shipped page ignores them), and/api/waitlistgains a best-effort per-IP/per-address rate limit plus address masking in the no-key log line. Adds vitest to the site (test/boot-overrides.test.tsunder happy-dom,test/waitlist.test.ts).scripts/bench): the cloud-init seed now uses SSH key auth only — the committed console/SSH password and password auth are removed (lock_passwd: true,ssh_pwauth: false);setup-vm.shalready injects the operator's pubkey.All new tests pass locally (backend via
pnpm --filter @pcbjam/backend-example test, site vianpm test).🤖 Generated with Claude Code