fix(security): resolve CodeQL/Semgrep findings (XSS, cookie, log injection, nginx headers)

[LucasSantana-Dev]

Summary

Real security findings from CodeQL/Semgrep:

• XSS (packages/frontend/src/pages/ReactionRoles.tsx): validates image URLs via new URL() + protocol allowlist instead of a regex, closing a DOM-XSS sink.
• SameSite cookie (packages/backend/src/middleware/session.ts): session cookie changed from conditional sameSite: isProduction ? 'none' : 'lax' to unconditional 'lax' — this is a general webapp session cookie (not the OAuth state/CSRF cookie), doesn't need cross-site delivery, and lax still permits top-level navigation (e.g. an OAuth redirect back into the app), so no functional regression.
• Log injection (packages/shared/src/utils/general/log/service.ts): strips control characters (\x00-\x1f\x7f) from user-controlled values before they're interpolated into log output, preventing log forging via embedded newlines.
• Nginx header redefinition (nginx/frontend.conf, nginx/nginx.conf): added always to Cache-Control add_header directives so they apply across all response statuses.

Plus 8 dead-code cleanups (unused imports/vars/dead branches) flagged by CodeQL across bot/backend/shared spec and source files.

Test plan

• npm run type:check clean across all 4 packages (shared, bot, backend, frontend)
• packages/backend touched tests: 30/30 pass
• packages/bot touched tests: 82/82 pass
• packages/shared touched tests: 118/118 pass
• Frontend tsc --noEmit clean (no test suite touched here)

---

Summary by cubic

Fixes CodeQL/Semgrep findings: closes an XSS in image preview, restores cross-subdomain session cookies, hardens logs (sanitized output and safe JSON for circular data), and ensures nginx cache headers apply on all responses. Also removes unused code, fixes a lint issue, and clarifies a loop sentinel and SameSite cookie comments.

• Bug Fixes

  • XSS: validate image URLs with new URL() and allow http/https only in packages/frontend/src/pages/ReactionRoles.tsx.
  • Cookies: restore sameSite: isProduction ? 'none' : 'lax' (with secure: true in prod) for cross-subdomain fetch() in packages/backend/src/middleware/session.ts.
  • Logging: sanitize control chars in messages, errors, and data; guard JSON serialization (incl. circular data) in packages/shared/src/utils/general/log/service.ts.
  • Nginx: add always to add_header Cache-Control in nginx/frontend.conf.

• Refactors

  • Remove unused imports/vars/dead branches; satisfy prefer-const. Clarify the fixed loop sentinel in packages/bot/src/functions/moderation/batch/channelMoveExecutor.ts and expand SameSite rationale in packages/backend/src/middleware/session.ts.

^{Written for commit 5f7cbb5. Summary will update on new commits.}

Summary by CodeRabbit

• Bug Fixes
  • Improved cache-header consistency so app pages and static assets receive the expected caching behavior more reliably.
  • Standardized session cookie handling across environments for more predictable sign-in behavior.
  • Strengthened reaction role image preview validation to avoid showing previews for invalid URLs.
  • Improved batch message processing to exit cleanly when no messages are returned.
  • Added safer logging output to reduce the risk of malformed or injected log content.
• Tests
  • Updated/cleaned up integration and unit tests to better reflect intended failure and edge-case behavior.

[coderabbitai]

📝 Walkthrough

Walkthrough

This PR combines nginx cache-header updates, a session middleware comment, log-output sanitization, stricter ReactionRoles image URL validation, a rollback test for ReactionRolesService, and several test/code cleanup edits.

Changes

Assorted infra, security and cleanup changes

Layer / File(s)	Summary
Nginx cache-control header always flag nginx/frontend.conf	Adds always to Cache-Control headers for /assets/ and / locations.
Session cookie comment packages/backend/src/middleware/session.ts	Adds comments describing the sameSite: 'none' and secure: true requirement for cross-subdomain fetches.
Log sanitization for control characters packages/shared/src/utils/general/log/service.ts	Adds sanitizeForLogging and applies it to formatted log output and serialized structured data before printing.
Image URL protocol validation in ReactionRoles preview packages/frontend/src/pages/ReactionRoles.tsx	Replaces regex-based image URL gating with URL parsing and explicit http:/https: protocol checks.
ReactionRolesService rollback test update packages/shared/src/services/ReactionRolesService/index.spec.ts	Adds a rollback test for updateReactionRoleMessage that asserts $transaction is invoked twice after a Discord PATCH failure.
Test and code cleanup packages/backend/tests/integration/routes/authCallback.test.ts, packages/backend/tests/integration/routes/guilds.test.ts, packages/bot/src/functions/general/commands/remind.spec.ts, packages/bot/src/functions/moderation/batch/channelMoveExecutor.ts, packages/bot/src/services/musicRecommendation/feedbackService.spec.ts, packages/bot/tests/setup.ts, packages/shared/src/utils/result.spec.ts	Removes unused variables, defaulted destructuring, and extra Jest imports across tests and batch execution code.

Estimated code review effort: 3 (Moderate) | ~20 minutes

Possibly related PRs

• LucasSantana-Dev/Lucky#1510: Both PRs modify packages/shared/src/utils/general/log/service.ts and change LogService output handling.
• LucasSantana-Dev/Lucky#1640: Both PRs touch setupSessionMiddleware cookie handling in packages/backend/src/middleware/session.ts.
• LucasSantana-Dev/Lucky#1676: Both PRs cover updateReactionRoleMessage rollback behavior in packages/shared/src/services/ReactionRolesService/index.spec.ts.

Suggested reviewers: cubic-dev-ai

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title accurately summarizes the main security-focused changes across XSS, cookie, logging, and nginx headers.

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch fix/codeql-fixes-2

---

_{Comment @coderabbitai help to get the list of available commands.}

[github-actions]

	Warnings
⚠️	User-facing change without a CHANGELOG.md update. Add a line under ## [Unreleased] if this should appear in release notes. (Or apply the skip-changelog label if this PR does not affect end users.)
⚠️	Possible debug residue in packages/shared/src/utils/general/log/service.ts: 1 console.log/debug line(s) added. Use debugLog from @lucky/shared/utils for structured logging.

Generated by 🚫 dangerJS against 5f7cbb5

[github-actions]

Failed to generate code suggestions for PR

[coderabbitai]

Actionable comments posted: 1

🧹 Nitpick comments (1)

packages/frontend/src/pages/ReactionRoles.tsx (1)

623-630: 📐 Maintainability & Code Quality | 🔵 Trivial | 💤 Low value

Extract inline IIFE into a named helper.

The protocol allowlist fix correctly blocks non-http(s) schemes (e.g. javascript:), addressing the DOM XSS concern. Consider extracting the validation logic into a small helper function (or useMemo) instead of an inline IIFE inside JSX for readability.

♻️ Suggested refactor

+function isValidImageUrl(url: string): boolean {
+    try {
+        const parsed = new URL(url.trim())
+        return parsed.protocol === 'http:' || parsed.protocol === 'https:'
+    } catch {
+        return false
+    }
+}

                         {!imageFile &&
                             imageUrl.trim() &&
-                            (() => {
-                                try {
-                                    const url = new URL(imageUrl.trim())
-                                    return url.protocol === 'http:' || url.protocol === 'https:'
-                                } catch {
-                                    return false
-                                }
-                            })() && (
+                            isValidImageUrl(imageUrl) && (

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@packages/frontend/src/pages/ReactionRoles.tsx` around lines 623 - 630, The
inline IIFE in the JSX condition should be extracted into a named helper for
readability while keeping the same http/https allowlist behavior. Move the URL
parsing and protocol check logic from the JSX into a small function (or a
memoized helper) near the ReactionRoles component, then call that helper from
the render path instead of invoking an anonymous function inline. Preserve the
existing try/catch and validation semantics so the image URL check still blocks
non-http(s) schemes.

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@packages/shared/src/utils/general/log/service.ts`:
- Around line 122-124: `LogService` is calling `JSON.stringify` directly on
`effectiveParams.data`, which can throw on circular references and break the
logging path. Update the data logging branch in `service.ts` to match the
defensive pattern used by `serializeError`: wrap the serialization of
`effectiveParams.data` in a try/catch, fall back to a safe placeholder or
alternative representation on failure, and keep `console.log(color(...))` from
ever throwing.

---

Nitpick comments:
In `@packages/frontend/src/pages/ReactionRoles.tsx`:
- Around line 623-630: The inline IIFE in the JSX condition should be extracted
into a named helper for readability while keeping the same http/https allowlist
behavior. Move the URL parsing and protocol check logic from the JSX into a
small function (or a memoized helper) near the ReactionRoles component, then
call that helper from the render path instead of invoking an anonymous function
inline. Preserve the existing try/catch and validation semantics so the image
URL check still blocks non-http(s) schemes.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro

Run ID: 69ca9fd9-50e7-44b4-9d3a-df0d78d804b4

📥 Commits

Reviewing files that changed from the base of the PR and between ba20cd8 and f674808.

📒 Files selected for processing (12)

• nginx/frontend.conf
• packages/backend/src/middleware/session.ts
• packages/backend/tests/integration/routes/authCallback.test.ts
• packages/backend/tests/integration/routes/guilds.test.ts
• packages/bot/src/functions/general/commands/remind.spec.ts
• packages/bot/src/functions/moderation/batch/channelMoveExecutor.ts
• packages/bot/src/services/musicRecommendation/feedbackService.spec.ts
• packages/bot/tests/setup.ts
• packages/frontend/src/pages/ReactionRoles.tsx
• packages/shared/src/services/ReactionRolesService/index.spec.ts
• packages/shared/src/utils/general/log/service.ts
• packages/shared/src/utils/result.spec.ts

💤 Files with no reviewable changes (5)

• packages/bot/src/services/musicRecommendation/feedbackService.spec.ts
• packages/bot/src/functions/general/commands/remind.spec.ts
• packages/bot/src/functions/moderation/batch/channelMoveExecutor.ts
• packages/backend/tests/integration/routes/authCallback.test.ts
• packages/shared/src/services/ReactionRolesService/index.spec.ts

[github-actions]

Size Change: +88 B (+0.02%)

Total Size: 480 kB

📦 View Changed

Filename	Size	Change
packages/frontend/dist/assets/AddStyledRoleForm-B3X-Y38T.js	3.12 kB	+3.12 kB (new file)	🆕
packages/frontend/dist/assets/AddStyledRoleForm-Cvo9EDK0.js	0 B	-3.11 kB (removed)	🏆
packages/frontend/dist/assets/Admin-CLGIQ_h7.js	2.3 kB	+2.3 kB (new file)	🆕
packages/frontend/dist/assets/Admin-WXRdyUpF.js	0 B	-2.3 kB (removed)	🏆
packages/frontend/dist/assets/AdminSupport-BzjvrdE_.js	0 B	-1.6 kB (removed)	🏆
packages/frontend/dist/assets/AdminSupport-D4ud6rwI.js	1.6 kB	+1.6 kB (new file)	🆕
packages/frontend/dist/assets/AutoMessages-crja35-a.js	2.65 kB	+2.65 kB (new file)	🆕
packages/frontend/dist/assets/AutoMessages-thU1weAv.js	0 B	-2.65 kB (removed)	🏆
packages/frontend/dist/assets/AutoMod-Bw4UQ472.js	4.2 kB	+4.2 kB (new file)	🆕
packages/frontend/dist/assets/AutoMod-QZkKkrie.js	0 B	-4.19 kB (removed)	🏆
packages/frontend/dist/assets/badge-CcMMAkGp.js	503 B	+503 B (new file)	🆕
packages/frontend/dist/assets/badge-DV1RqcoN.js	0 B	-500 B (removed)	🏆
packages/frontend/dist/assets/BatchJobs-CmEMeG_-.js	0 B	-3.72 kB (removed)	🏆
packages/frontend/dist/assets/BatchJobs-sfN0yP0N.js	3.72 kB	+3.72 kB (new file)	🆕
packages/frontend/dist/assets/Card-B_NSwfc8.js	0 B	-506 B (removed)	🏆
packages/frontend/dist/assets/Card-CqVDWZMS.js	508 B	+508 B (new file)	🆕
packages/frontend/dist/assets/Changelog-BzEFdHir.js	42.8 kB	+42.8 kB (new file)	🆕
packages/frontend/dist/assets/Changelog-DJKSIhGk.js	0 B	-42.8 kB (removed)	🏆
packages/frontend/dist/assets/CommandsConfig-C0WjkyTS.js	0 B	-1.5 kB (removed)	🏆
packages/frontend/dist/assets/CommandsConfig-CXyelqxy.js	1.5 kB	+1.5 kB (new file)	🆕
packages/frontend/dist/assets/Config-BXUJj0rZ.js	0 B	-1.98 kB (removed)	🏆
packages/frontend/dist/assets/Config-P3jL0mKb.js	1.98 kB	+1.98 kB (new file)	🆕
packages/frontend/dist/assets/CustomCommands-CgpWS_ES.js	0 B	-2.12 kB (removed)	🏆
packages/frontend/dist/assets/CustomCommands-CYZ255fg.js	2.12 kB	+2.12 kB (new file)	🆕
packages/frontend/dist/assets/DashboardOverview-B7prXOVC.js	3.95 kB	+3.95 kB (new file)	🆕
packages/frontend/dist/assets/DashboardOverview-BNBUnuf0.js	0 B	-3.95 kB (removed)	🏆
packages/frontend/dist/assets/dialog-Cgtthqi5.js	0 B	-956 B (removed)	🏆
packages/frontend/dist/assets/dialog-CQgT6qXu.js	959 B	+959 B (new file)	🆕
packages/frontend/dist/assets/Docs-BRtiF4Yn.js	17.6 kB	+17.6 kB (new file)	🆕
packages/frontend/dist/assets/Docs-D2tyKQE4.js	0 B	-17.6 kB (removed)	🏆
packages/frontend/dist/assets/DocsShell-DutpNIX_.js	0 B	-1.42 kB (removed)	🏆
packages/frontend/dist/assets/DocsShell-m6aRetGv.js	1.42 kB	+1.42 kB (new file)	🆕
packages/frontend/dist/assets/EmbedBuilder-GqZiKL6Y.js	0 B	-3.28 kB (removed)	🏆
packages/frontend/dist/assets/EmbedBuilder-U153dBvV.js	3.28 kB	+3.28 kB (new file)	🆕
packages/frontend/dist/assets/Features-CG7s4NFb.js	754 B	+754 B (new file)	🆕
packages/frontend/dist/assets/Features-DUitTBnP.js	0 B	-754 B (removed)	🏆
packages/frontend/dist/assets/GuildAutomation-1aVNe2ld.js	0 B	-2.89 kB (removed)	🏆
packages/frontend/dist/assets/GuildAutomation-Dkt_ZCxg.js	2.88 kB	+2.88 kB (new file)	🆕
packages/frontend/dist/assets/index-DeJ8HvUq.js	0 B	-70.9 kB (removed)	🏆
packages/frontend/dist/assets/index-OMmOnJYF.js	70.9 kB	+70.9 kB (new file)	🆕
packages/frontend/dist/assets/input-7TSUlyhZ.js	465 B	+465 B (new file)	🆕
packages/frontend/dist/assets/input-B5dilh2J.js	0 B	-463 B (removed)	🏆
packages/frontend/dist/assets/label-C1Tjc7p7.js	0 B	-475 B (removed)	🏆
packages/frontend/dist/assets/label-CoGJvhOJ.js	478 B	+478 B (new file)	🆕
packages/frontend/dist/assets/Landing-BF777znS.js	0 B	-5.2 kB (removed)	🏆
packages/frontend/dist/assets/Landing-CiFrFX2Q.js	5.21 kB	+5.21 kB (new file)	🆕
packages/frontend/dist/assets/LastFm-B3PkDn89.js	0 B	-1.74 kB (removed)	🏆
packages/frontend/dist/assets/LastFm-Duicea4N.js	1.74 kB	+1.74 kB (new file)	🆕
packages/frontend/dist/assets/Levels-B7ZqMTNT.js	2.27 kB	+2.27 kB (new file)	🆕
packages/frontend/dist/assets/Levels-BvOESJ3G.js	0 B	-2.27 kB (removed)	🏆
packages/frontend/dist/assets/Login-DxLzDvC5.js	0 B	-2.5 kB (removed)	🏆
packages/frontend/dist/assets/Login-NrkpFmi5.js	2.5 kB	+2.5 kB (new file)	🆕
packages/frontend/dist/assets/Lyrics-BaJZqBCj.js	0 B	-1.34 kB (removed)	🏆
packages/frontend/dist/assets/Lyrics-qwwPz-sy.js	1.34 kB	+1.34 kB (new file)	🆕
packages/frontend/dist/assets/Moderation-B7iGGsFf.js	3.78 kB	+3.78 kB (new file)	🆕
packages/frontend/dist/assets/Moderation-m10H4_X_.js	0 B	-3.77 kB (removed)	🏆
packages/frontend/dist/assets/Music-BlAIAlb6.js	5.97 kB	+5.97 kB (new file)	🆕
packages/frontend/dist/assets/Music-CPNzCuwt.js	0 B	-5.97 kB (removed)	🏆
packages/frontend/dist/assets/MusicConfig-D-zrp2Q0.js	1.65 kB	+1.65 kB (new file)	🆕
packages/frontend/dist/assets/MusicConfig-DbF24kKp.js	0 B	-1.65 kB (removed)	🏆
packages/frontend/dist/assets/PreferredArtists-Be73HRn-.js	3.72 kB	+3.72 kB (new file)	🆕
packages/frontend/dist/assets/PreferredArtists-n6jMPXxl.js	0 B	-3.72 kB (removed)	🏆
packages/frontend/dist/assets/PrivacyPolicy-D5f8BaFt.js	1.77 kB	+1.77 kB (new file)	🆕
packages/frontend/dist/assets/PrivacyPolicy-DkBeqiPB.js	0 B	-1.77 kB (removed)	🏆
packages/frontend/dist/assets/ReactionRoles-BS9qOnXI.js	7.05 kB	+7.05 kB (new file)	🆕
packages/frontend/dist/assets/ReactionRoles-CI8cX__z.js	0 B	-7.02 kB (removed)	🏆
packages/frontend/dist/assets/RoleGroups-h_4nRGOA.js	0 B	-2.24 kB (removed)	🏆
packages/frontend/dist/assets/RoleGroups-lzKdswdm.js	2.24 kB	+2.24 kB (new file)	🆕
packages/frontend/dist/assets/Roles-C1hN8tWV.js	3.34 kB	+3.34 kB (new file)	🆕
packages/frontend/dist/assets/Roles-Csbt1IfB.js	0 B	-3.34 kB (removed)	🏆
packages/frontend/dist/assets/SectionHeader-HF3rH0_t.js	0 B	-892 B (removed)	🏆
packages/frontend/dist/assets/SectionHeader-pLeG-j4O.js	894 B	+894 B (new file)	🆕
packages/frontend/dist/assets/select-DmancYuD.js	0 B	-1.23 kB (removed)	🏆
packages/frontend/dist/assets/select-DTQjzv5g.js	1.23 kB	+1.23 kB (new file)	🆕
packages/frontend/dist/assets/ServerLogs-D38uwVhC.js	0 B	-3.04 kB (removed)	🏆
packages/frontend/dist/assets/ServerLogs-DQtMI0xP.js	3.04 kB	+3.04 kB (new file)	🆕
packages/frontend/dist/assets/ServerSettings-_OjLqCo4.js	0 B	-3.99 kB (removed)	🏆
packages/frontend/dist/assets/ServerSettings-DHV7ji-N.js	3.99 kB	+3.99 kB (new file)	🆕
packages/frontend/dist/assets/ServersPage-DFlaXPd_.js	0 B	-3.04 kB (removed)	🏆
packages/frontend/dist/assets/ServersPage-Xoc6e_1C.js	3.04 kB	+3.04 kB (new file)	🆕
packages/frontend/dist/assets/Skeleton-CZ5Ve4j_.js	0 B	-236 B (removed)	🏆
packages/frontend/dist/assets/Skeleton-DsWvrzTD.js	234 B	+234 B (new file)	🆕
packages/frontend/dist/assets/Spotify-3CRABaZv.js	1.75 kB	+1.75 kB (new file)	🆕
packages/frontend/dist/assets/Spotify-C2J0_MlD.js	0 B	-1.75 kB (removed)	🏆
packages/frontend/dist/assets/Starboard-CaQqmIas.js	0 B	-1.82 kB (removed)	🏆
packages/frontend/dist/assets/Starboard-CG5NJESk.js	1.82 kB	+1.82 kB (new file)	🆕
packages/frontend/dist/assets/StatTile-Cjl25PQC.js	0 B	-639 B (removed)	🏆
packages/frontend/dist/assets/StatTile-DvA5EEjs.js	639 B	+639 B (new file)	🆕
packages/frontend/dist/assets/Support-Bt8-pfZj.js	1.55 kB	+1.55 kB (new file)	🆕
packages/frontend/dist/assets/Support-C9cKP9Xy.js	0 B	-1.56 kB (removed)	🏆
packages/frontend/dist/assets/switch-0D3a6pan.js	0 B	-541 B (removed)	🏆
packages/frontend/dist/assets/switch-B3oFxcb1.js	543 B	+543 B (new file)	🆕
packages/frontend/dist/assets/TermsOfService-Bn_y7gIZ.js	0 B	-1.6 kB (removed)	🏆
packages/frontend/dist/assets/TermsOfService-CfYuDiAf.js	1.59 kB	+1.59 kB (new file)	🆕
packages/frontend/dist/assets/TrackHistory-Cacsxx_k.js	0 B	-2.31 kB (removed)	🏆
packages/frontend/dist/assets/TrackHistory-CK48S6Vq.js	2.31 kB	+2.31 kB (new file)	🆕
packages/frontend/dist/assets/TwitchNotifications-BBIAVV44.js	2.44 kB	+2.44 kB (new file)	🆕
packages/frontend/dist/assets/TwitchNotifications-Dj5dgGBL.js	0 B	-2.44 kB (removed)	🏆
packages/frontend/dist/assets/useActiveHeading-_Axa0pet.js	1.35 kB	+1.35 kB (new file)	🆕
packages/frontend/dist/assets/useActiveHeading-Bl7Wq08u.js	0 B	-1.36 kB (removed)	🏆
packages/frontend/dist/assets/useFeatures-DA5syVZc.js	2.06 kB	+2.06 kB (new file)	🆕
packages/frontend/dist/assets/useFeatures-Dggbvner.js	0 B	-2.06 kB (removed)	🏆

ℹ️ View Unchanged

Filename	Size
packages/frontend/dist/assets/api-B1lHOZZ9.js	4.01 kB
packages/frontend/dist/assets/index-DY6JagVQ.css	17.6 kB
packages/frontend/dist/assets/legalNav-B6k3CWsW.js	274 B
packages/frontend/dist/assets/rolldown-runtime-Cyuzqnbw.js	471 B
packages/frontend/dist/assets/routeMeta-BZjtwMbs.js	595 B
packages/frontend/dist/assets/sentry-DhXOA89y.js	3.76 kB
packages/frontend/dist/assets/usePageMetadata-DTv-6eVb.js	327 B
packages/frontend/dist/assets/vendor-forms-C-bof8GF.js	25.9 kB
packages/frontend/dist/assets/vendor-radix-qkfmDH9H.js	39.9 kB
packages/frontend/dist/assets/vendor-react-B7C34xnu.js	55.7 kB
packages/frontend/dist/assets/vendor-state-Dw4-MN6C.js	24.2 kB
packages/frontend/dist/assets/vendor-ui-BBN61NBD.js	66.2 kB

_{compressed-size-action}

[cubic-dev-ai]

All reported issues were addressed across 12 files

<sub>Reply with feedback, questions, or to request a fix.

Re-trigger cubic</sub>

[cubic-dev-ai]

All reported issues were addressed across 1 file (changes from recent commits).

<sub>Reply with feedback, questions, or to request a fix.

Re-trigger cubic</sub>

[cubic-dev-ai]

0 issues found across 1 file (changes from recent commits).

<sub>Requires human review: Auto-approval blocked by 2 unresolved issues from previous reviews.

Re-trigger cubic</sub>

[cubic-dev-ai]

0 issues found across 1 file (changes from recent commits).

<sub>Requires human review: Auto-approval blocked by 2 unresolved issues from previous reviews.

Re-trigger cubic</sub>

[cubic-dev-ai]

All reported issues were addressed across 2 files (changes from recent commits).

<sub>Tip: Review your code locally with the cubic CLI to iterate faster.

Re-trigger cubic</sub>

[cubic-dev-ai]

0 issues found across 1 file (changes from recent commits).

<sub>Requires human review: PR contains security fixes to middleware, XSS, and log injection, plus nginx config changes. These are sensitive production changes requiring human review.

Re-trigger cubic</sub>

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud