Skip to content

SECURITY-CHECKLIST.md

Latest commit

 

History

History
148 lines (114 loc) · 4.37 KB

SECURITY-CHECKLIST.md

File metadata and controls

148 lines (114 loc) · 4.37 KB
Raw

Security Changes

Type of Security Change

  • SAST rule update
  • Dependency vulnerability fix
  • Exemption addition/renewal
  • Security workflow modification
  • Container image update
  • Other: IP rate limiting integration & auth route hardening

Vulnerability Details (if applicable)

CVE/Advisory ID:

  • CVE-ID: N/A
  • GHSA-ID: N/A

Affected Package:

  • Name: N/A
  • Version: N/A
  • Severity: [ ] Critical [ ] High [ ] Medium [ ] Low

Fix Applied:

  • Package version bump
  • Code change to mitigate
  • Configuration update
  • Exemption granted (see below)

Exemption Request (if applicable)

Exemption ID: EXEMPT-N/A

Justification:

N/A

Mitigation Applied:

N/A

Expiry Date: N/A

Review Plan:

N/A

Testing

  • Ran npm audit locally - output attached or no new vulnerabilities
  • Security workflow passes on this branch
  • Test suite passes: npm test
  • Build succeeds: npm run build

Security Impact Analysis

Affected Components:

  • Authentication/Authorization
  • Payment processing
  • Data encryption
  • API endpoints
  • Dependencies
  • Container images
  • CI/CD pipeline
  • Other: _______________

Risk Assessment:

Mitigates brute-force wallet authentication attacks and challenge generation abuse on /api/auth/wallet via IP-based token-bucket rate limiting (20 req/min for challenge GET, 5 req/min for login POST). Ensures double-submit CSRF protection, request deadline enforcement via withTimeout, and structured JSON audit logging with request_id correlation propagation for SIEM monitoring.

Documentation Updates

  • Updated README.md (if workflow changed)
  • Updated SECURITY-CI-SETUP.md (if process changed)
  • Updated security-exemptions.json (if applicable)
  • Added security notes to code comments

Checklist

  • No secrets or keys committed
  • No PII or sensitive data in logs
  • All security scans pass (or exemptions documented)
  • Branch protection requirements met
  • Code review from security team (for critical changes)

Additional Notes

  • Centralized wallet auth rate limiting in src/middleware/rateLimit.ts via walletAuthRateLimit.
  • Rate limit headers (Retry-After, x-request-id) and strong SHA-256 ETags (If-None-Match, Cache-Control: no-store) enforced.

Test Output

PASS src/middleware/rateLimit.test.ts
  streamsRateLimit
    GET requests
      ✓ allows request when under rate limit (1 ms)
      ✓ rejects request when rate limit exceeded
      ✓ returns 429 response with Retry-After header
      ✓ uses read limit for GET /api/streams
    POST requests
      ✓ allows request when under write rate limit
      ✓ rejects POST when write rate limit exceeded
    identity extraction
      ✓ identifies by API key when X-API-Key is present
      ✓ identifies by wallet JWT when present
      ✓ falls back to IP when no auth headers
    error response format
      ✓ includes rate_limit_exceeded error code in 429 response
      ✓ includes request_id in 429 response
    per-user isolation
      ✓ tracks different API keys separately
  applyRateLimit
    ✓ returns null when request is within rate limit
    ✓ returns 429 response when request exceeds rate limit
  walletAuthRateLimit
    ✓ allows challenge GET request when under IP limit
    ✓ rejects login POST request when exceeding IP rate limit

PASS app/api/auth/wallet/route.test.ts (27 tests passed)
PASS app/api/auth/wallet/route.timeout.test.ts (12 tests passed)
PASS tests/integration/auth/wallet.test.ts (2 tests passed)

Test Suites: 4 passed, 4 total
Tests:       54 passed, 54 total
Snapshots:   0 total
Time:        4.509 s

Audit Output

52 vulnerabilities (4 low, 15 moderate, 33 high)

To address issues that do not require attention, run:
  npm audit fix

To address all issues (including breaking changes), run:
  npm audit fix --force

CI Run Link

Workflow Run: Pending PR merge on branch feat/rate-limit-on/api/auth/wallet

Security Review Required: @security-team Compliance Impact: No