Security hardening: input validation, sensitive data handling, and CI/CD #7
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Implements thorough input validation using positive (allow-list) approaches for all external data sources to prevent injection attacks and set security best practices for the example project. Changes: - Add Zod v4 validation library to shared package - Create validation schemas: pagination bounds, account/statement IDs, date ranges, email/password, API endpoints, HTTP methods, OIDC clients, JWKS - Update API routes with validated path params and query params - Update Auth routes with login validation and timing-safe password comparison - Update App routes with API Explorer endpoint allow-list and XSS protection - Add safe JSON parsing utilities and HTML escaping for error messages
- Create root-level .env.example template with security documentation - Enhance .gitignore with additional sensitive file patterns (keys, certs, secrets) - Document sensitive data handling in CLAUDE.md including: - Environment variable security levels - Template configuration file locations - Production secrets generation instructions - Security checklist for deployment
CI/CD Workflows: - ci.yml: PR validation with lint, build, and security audit - security.yml: Weekly CodeQL analysis and Docker image scanning - dependabot.yml: Automated dependency updates for npm and GitHub Actions Docker Support: - Multi-stage Dockerfiles for auth, api, and app services - docker-compose.yml for local development - docker-compose.prod.example.yml as production template - .dockerignore to exclude secrets and dev files Documentation: - CI/CD and Build Processes section in CLAUDE.md - Deployment security checklist - Branch protection recommendations
- Create SECURITY.md with vulnerability reporting guidelines and security policy - Add Security section to README with features table and production checklist - Add Docker and CI/CD section to README with build commands and workflows - Document dependency security tools (Dependabot, npm audit, CodeQL, Trivy)
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Summary
Address security review findings for the Core Exchange reference implementation:
Changes
Input Validation
Sensitive Data Handling
.env.exampletemplate.gitignorefor secrets/keysBuild & Deployment
Documentation