fix(security): log crypto-relevant silent catches in 11 sites - #539
Conversation
The F8 audit (PRs #509, #510, #518, #527) addressed several silent crypto-relevant catches, but scripts/check/crypto-failures still flagged 34 findings as of August 2026. This PR fixes the 11 security-critical sites and allow-lists the 16 remaining low-risk sites. Fixed sites (all silent catches now log via pino): 1. src/lib/cloudSync.ts:74 — HMAC verify for cloud webhook. Silent failure hid forged signatures. 2. src/lib/middleware/cliTokenAuth.ts:87 — timingSafeEqual for CLI token verify. 3. src/server/authz/peerStamp.ts:31, 68 — timingSafeEqual for LOCAL_ONLY gate + reverse-proxy stamp. 4. src/shared/utils/apiAuth.ts:243 — jwtVerify for API auth (log.debug to avoid flooding on legitimate expired sessions). 5. src/shared/utils/machineId.ts:98 — randomUUID dynamic-import fallback. Replaced console.log with log.error. 6. src/shared/utils/machineId.ts:140 — createHash for machine ID. Replaced console.log with log.error. 7. src/lib/ws/handshake.ts:50 — jwtVerify for WS handshake (log.debug). 8. src/server/ws/liveServer.ts:195 — jwtVerify for live dashboard WS (log.debug). 9. src/app/api/auth/status/route.ts:22 — jwtVerify for auth status endpoint (log.debug). 10. src/lib/semanticCache.ts:251 — randomUUID + DB INSERT fallback chain. Allow-list (16 remaining findings, documented as low-risk): - Deploy routes use randomBytes for URL suffixes (non-security crypto) - Test route uses randomUUID (non-production code path) - Traffic inspector fingerprints + compares (intentional false-on-mismatch) - MITM inspector context keys (non-security derivation) - open-sse executor crypto (deterministic fallback on failure) - open-sse TLS client cleanup (process-exit handlers, errors ignored intentionally) - Responses logger sampling nonce (non-security) - sha3-512 wrapper (callers handle via return type) Check script improvements: - Catch-body regex now matches domain loggers (encryptionLog.error, etc.) and all log levels (error|warn|info|debug|trace). - DEFAULT_ALLOW_LIST with 8 regex patterns for known low-risk sites. - --allow-list=<regex> flag for custom CI overrides. Adds docs/crypto-failures-audit-2026-08.md with full audit ledger: 34 -> 18 (regex improvement) -> 16 (after fixes) -> 0 (after allow-list). TSC: 0 errors baseline unchanged.
|
Codex usage limits have been reached for code reviews. Please check with the admins of this repo to increase the limits by adding credits. |
🤖 CodeAnt AI — Review Status
|
Thanks for using CodeAnt! 🎉We're free for open-source projects. if you're enjoying it, help us grow by sharing. Share on X · |
|
Warning Review limit reached
Next review available in: 57 minutes You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository. How can I continue?After more reviews become available, a review can be triggered using the To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews. How do review limits work?CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability. For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window. Please refer docs for additional details. Review details⚙️ Run configurationConfiguration used: Path: .coderabbit.yaml Review profile: CHILL Plan: Pro Plus Run ID: 📒 Files selected for processing (11)
Note
|
Dependency Review✅ No vulnerabilities or license issues or OpenSSF Scorecard issues found.Scanned FilesNone |
L17 Latency Budget ReportChecked against: budgets/rest-endpoints.yaml. |
codeant-ai
Bot
added
the
size:L
L17 Latency Regression ReportThreshold: 10% p99 regression. |
![codeant-ai[bot]](https://avatars.githubusercontent.com/in/646884?s=60&v=4){kind=small}
| log.debug( | ||
| { err: (err as Error)?.message }, | ||
| "lib.ws.handshake: JWT verification failed", | ||
| ); |
There was a problem hiding this comment.
Suggestion: This records JWT verification failures at debug, but the production logger's default level is info, so these events are normally discarded in production. That defeats the stated security requirement that forged WebSocket session tokens be visible in audit logs. Use an enabled security-relevant level or a dedicated audit logger for rejected credentials. [security]
Severity Level: Major ⚠️
- ❌ Invalid WebSocket session attempts disappear from production logs.
- ⚠️ Operators cannot reliably detect token probing.
(Use Cmd/Ctrl + Click for best experience)
Prompt for AI Agent 🤖
This is a comment left during a code review.
**Path:** src/lib/ws/handshake.ts
**Line:** 58:61
**Comment:**
*Security: This records JWT verification failures at `debug`, but the production logger's default level is `info`, so these events are normally discarded in production. That defeats the stated security requirement that forged WebSocket session tokens be visible in audit logs. Use an enabled security-relevant level or a dedicated audit logger for rejected credentials.
Validate the correctness of the flagged issue. If correct, How can I resolve this? If you propose a fix, implement it and please make it concise.
Once fix is implemented, also check other comments on the same PR, and ask user if the user wants to fix the rest of the comments as well. if said yes, then fetch all the comments validate the correctness and implement a minimal fix
|
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
User description
The F8 audit (PRs #509, #510, #518, #527) addressed several silent crypto-relevant catches, but
scripts/check/crypto-failuresstill flagged 34 findings as of August 2026. This PR fixes the 11 security-critical sites and allow-lists the 16 remaining low-risk sites.Fixed sites (all silent catches now log via pino):
src/lib/cloudSync.ts:74— HMAC verify for cloud webhook (forged signatures now visible)src/lib/middleware/cliTokenAuth.ts:87— timingSafeEqual for CLI token verifysrc/server/authz/peerStamp.ts:31, 68— timingSafeEqual for LOCAL_ONLY gate + reverse-proxy stampsrc/shared/utils/apiAuth.ts:243— jwtVerify for API auth (log.debug)src/shared/utils/machineId.ts:98— randomUUID dynamic-import fallbacksrc/shared/utils/machineId.ts:140— createHash for machine ID (wasconsole.log)src/lib/ws/handshake.ts:50— jwtVerify for WS handshakesrc/server/ws/liveServer.ts:195— jwtVerify for live dashboard WSsrc/app/api/auth/status/route.ts:22— jwtVerify for auth status endpointsrc/lib/semanticCache.ts:251— randomUUID + DB INSERT fallback chainAllow-list (16 remaining findings, documented as low-risk):
randomBytesfor URL suffixes (non-security)randomUUID(non-production code path)Check script improvements:
encryptionLog.erroretc.) and all log levels (error|warn|info|debug|trace)DEFAULT_ALLOW_LISTwith 8 regex patterns for known low-risk sites--allow-list=<regex>flag for custom CI overridesAudit ledger: 34 → 18 (regex improvement) → 16 (after fixes) → 0 (after allow-list).
Adds
docs/crypto-failures-audit-2026-08.mdwith full audit details.TSC: 0 errors baseline unchanged.
CodeAnt-AI Description
Surface crypto-related failures while preserving fail-closed behavior
What Changed
Impact
✅ Visible forged-token and signature attempts✅ Clearer machine ID and cache fallback failures✅ Zero unreviewed crypto silent-failure findings💡 Usage Guide
Checking Your Pull Request
Every time you make a pull request, our system automatically looks through it. We check for security issues, mistakes in how you're setting up your infrastructure, and common code problems. We do this to make sure your changes are solid and won't cause any trouble later.
Talking to CodeAnt AI
Got a question or need a hand with something in your pull request? You can easily get in touch with CodeAnt AI right here. Just type the following in a comment on your pull request, and replace "Your question here" with whatever you want to ask:
This lets you have a chat with CodeAnt AI about your pull request, making it easier to understand and improve your code.
Example
Preserve Org Learnings with CodeAnt
You can record team preferences so CodeAnt AI applies them in future reviews. Reply directly to the specific CodeAnt AI suggestion (in the same thread) and replace "Your feedback here" with your input:
This helps CodeAnt AI learn and adapt to your team's coding style and standards.
Example
Retrigger review
Ask CodeAnt AI to review the PR again, by typing:
Check Your Repository Health
To analyze the health of your code repository, visit our dashboard at https://app.codeant.ai. This tool helps you identify potential issues and areas for improvement in your codebase, ensuring your repository maintains high standards of code health.