fix(security): audit quick fixes — V2, V3, V13, V14, V15, V16

[NicolasRitouet]

Summary

Six quick security fixes from the AppSec audit, all low-risk and surgically scoped.

Changes

V2 — Stop logging token preview in auth middleware [Critical]

packages/backend/src/middleware/auth.ts

• Replaced tokenPreview (first 20 + last 10 chars of bearer tokens) with tokenType + tokenLength
• A 40-char GitHub PAT had 30/40 chars logged — enough for brute-force reconstruction
• Ref: OWASP Logging Cheat Sheet — "never log access tokens"

V3 — Require authentication on /v1/github/repo-ids [High]

packages/backend/src/api/v1/routes/github.routes.ts

• Added preHandler: [authenticateGitHub] to the route
• Previously unauthenticated: anyone could probe private repo existence by name

V13 — Remove secret name enumeration from error messages [Medium]

packages/backend/src/api/v1/routes/secrets.routes.ts

• Error response no longer lists all available secret names in the environment
• Users with read access could discover secret names without knowing them

V14 — Generic error in Stripe webhook response [Medium]

packages/backend/src/api/v1/routes/billing.routes.ts

• Changed error: error.message to error: "Processing failed" in webhook error response
• Internal error details (DB errors, service names) were being sent to Stripe's infrastructure

V15 — Disable sendDefaultPii in all Sentry configs [Medium]

packages/dashboard/instrumentation-client.ts, sentry.edge.config.ts, sentry.server.config.ts

• Set sendDefaultPii: false in all 3 Sentry configs (client, edge, server)
• Was automatically sending cookies (including session tokens), IPs, and headers to Sentry

V16 — Map auth callback errors to predefined messages [Medium]

packages/dashboard/app/auth/callback/page.tsx

• Error query parameter is now mapped to predefined safe messages instead of displayed verbatim
• Prevented social engineering via crafted URLs (e.g. phishing messages in error param)
• Analytics also normalized to only track known error codes

What's NOT in this PR

• V1 (crypto TLS/auth) — already merged in feat(crypto): add TLS + shared-secret auth to gRPC service #14
• V4-V12, V17-V23 — planned for follow-up sprints
• No refactoring, no feature changes, no dependency updates

Test plan

• Backend type-check passes
• 935 backend tests pass (2 skipped, pre-existing)
• Dashboard builds successfully
• CI green (test, build, Vercel)
• Verify /v1/github/repo-ids returns 401 without auth header
• Verify secret not-found error no longer lists available keys
• Verify Sentry events no longer contain cookies/IP

🤖 Generated with Claude Code

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
keyway-dashboard	Ready	Preview, Comment	Apr 9, 2026 9:38pm

[coderabbitai]

📝 Walkthrough

Walkthrough

API routes, middleware, and dashboard configs updated: GitHub auth added to /repo-ids; Stripe webhook error response made generic; secrets NotFound messages simplified; auth middleware logs tokenType/tokenLength instead of previews; OAuth callback maps known errors to friendly text; Sentry sendDefaultPii disabled.

Changes

Cohort / File(s)	Summary
Billing & GitHub & Secrets routes packages/backend/src/api/v1/routes/billing.routes.ts, packages/backend/src/api/v1/routes/github.routes.ts, packages/backend/src/api/v1/routes/secrets.routes.ts	Billing webhook now returns a constant "Processing failed" message for non-signature errors while preserving { received: true }. GitHub /repo-ids route now uses authenticateGitHub preHandler. Secrets /view route no longer includes computed "available secrets" text in NotFoundError messages.
Authentication middleware packages/backend/src/middleware/auth.ts	Removed logging of token content preview; logs now emit tokenType and tokenLength. JWT verification and GitHub-token fallback logs updated to include tokenType instead of token preview.
Dashboard OAuth callback packages/dashboard/app/auth/callback/page.tsx	Added errorMessages map; normalized tracking payload to known codes or 'unknown'; displayed error text comes from mapped messages with a generic fallback.
Sentry configuration (client, edge, server) packages/dashboard/instrumentation-client.ts, packages/dashboard/sentry.edge.config.ts, packages/dashboard/sentry.server.config.ts	Disabled sendDefaultPii (changed from true to false) across client, edge, and server Sentry initializations; no other config surface or exports changed.

Estimated code review effort

🎯 3 (Moderate) | ⏱️ ~22 minutes

Poem

🐇 I nibble bytes beneath the moon,

Tokens trimmed, errors tuned in tune,
Auth gates set and secrets pruned,
Sentry hushes footprint rune,
Hop—new code blooms by morning soon.

🚥 Pre-merge checks | ✅ 3

✅ Passed checks (3 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title references specific audit fix items (V2, V3, V13-V16) that directly correspond to the security changes implemented across the PR, clearly identifying the main purpose as addressing identified security vulnerabilities.
Docstring Coverage	✅ Passed	Docstring coverage is 80.00% which is sufficient. The required threshold is 80.00%.
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch security/audit-quick-fixes

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[coderabbitai]

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against the current code and only fix it if needed.

Inline comments:
In `@packages/dashboard/app/auth/callback/page.tsx`:
- Around line 23-25: The code currently sends the raw, user-controlled
errorParam to analytics; update the error handling in the auth callback to
normalize errorParam against the allowed set (keys of errorMessages or an
explicit knownErrors list), map any unrecognized or empty value to
'unknown_error', use that normalized value when calling
trackEvent(AnalyticsEvents.AUTH_CALLBACK_ERROR, ...), and continue to use
setError(errorMessages[normalized] || 'An unexpected error occurred...') so the
UI still shows a friendly message while telemetry only receives the normalized
code.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro

Run ID: badb50cc-b4f0-4199-b9a7-285e1ed24588

📥 Commits

Reviewing files that changed from the base of the PR and between 608c2c3 and 9b4341b.

📒 Files selected for processing (8)

• packages/backend/src/api/v1/routes/billing.routes.ts
• packages/backend/src/api/v1/routes/github.routes.ts
• packages/backend/src/api/v1/routes/secrets.routes.ts
• packages/backend/src/middleware/auth.ts
• packages/dashboard/app/auth/callback/page.tsx
• packages/dashboard/instrumentation-client.ts
• packages/dashboard/sentry.edge.config.ts
• packages/dashboard/sentry.server.config.ts