Skip to content

Security: bnelabs/Autonoma

Security

docs/SECURITY.md

Security Notes

NPM Security Vulnerabilities

Current Status (as of audit)

The project has some npm security vulnerabilities in development dependencies. These have been assessed and documented below.

Frontend Vulnerabilities

1. esbuild (Moderate Severity)

  • Package: esbuild <=0.24.2
  • Issue: Development server can receive requests from any website
  • Advisory: GHSA-67mh-4wv8-2f99
  • Impact: Development only - not a production concern
  • Mitigation:
    • This only affects the Vite development server
    • Production builds are not affected
    • Development server should only run on trusted networks
    • Fix requires upgrading to Vite 7.x (breaking changes)
  • Recommendation: Monitor for Vite 7.x compatibility and upgrade when stable

2. glob (High Severity)

  • Package: glob 10.3.7 - 11.0.3 (transitive dependency)
  • Issue: Command injection via -c/--cmd flag
  • Advisory: GHSA-5j98-mcp5-4vw2
  • Impact: Very low - only affects CLI usage with specific flags
  • Mitigation:
    • This is a transitive dependency of tailwindcss via sucrase
    • The vulnerability requires specific CLI usage patterns not present in our codebase
    • We don't use glob CLI directly
  • Recommendation: Wait for tailwindcss to update its dependencies

Backend Vulnerabilities

No critical vulnerabilities in backend dependencies.

Deprecated Packages

Several packages show deprecation warnings but don't have security implications:

Both Frontend and Backend

  • rimraf < v4 - Consider updating when convenient
  • glob < v9 - Being addressed via other package updates
  • inflight - Memory leak issue, consider alternatives when updating dependencies

Frontend Only

  • eslint 8.x - No longer supported
    • Recommendation: Upgrade to eslint 9.x (may require config changes)
  • @humanwhocodes packages - Replaced by @eslint equivalents
    • Will be resolved when upgrading eslint

Security Best Practices Implemented

  1. ✅ JWT Authentication: Proper JWT token verification implemented
  2. ✅ API Key Encryption: LLM API keys encrypted with AES-256-GCM
  3. ✅ CORS Configuration: Properly configured CORS with specific origin
  4. ✅ Environment Variables: Sensitive data in environment variables
  5. ✅ Token Expiration: JWT tokens expire after 7 days

Recommended Security Improvements

High Priority

  1. Input Validation: Add request validation middleware (Joi/Zod)
  2. Rate Limiting: Implement rate limiting on API endpoints
  3. HTTPS: Enforce HTTPS in production
  4. Helmet.js: Add security headers middleware

Medium Priority

  1. SQL Injection: Already mitigated by Prisma ORM, but audit raw queries
  2. XSS Protection: Sanitize user inputs before rendering
  3. CSRF Protection: Implement CSRF tokens for state-changing operations
  4. Logging: Ensure sensitive data is not logged

Production Checklist

  • Change JWT_SECRET to a strong random value
  • Change ENCRYPTION_KEY to a secure 32-byte random key
  • Set up proper secrets management (AWS Secrets Manager, HashiCorp Vault, etc.)
  • Enable HTTPS/TLS
  • Set up Web Application Firewall (WAF)
  • Implement rate limiting
  • Set up monitoring and alerting
  • Regular dependency updates and security audits
  • Enable database encryption at rest
  • Implement audit logging for sensitive operations

Vulnerability Response Process

  1. Monitor: Regularly run npm audit on both frontend and backend
  2. Assess: Evaluate the severity and impact of each vulnerability
  3. Prioritize: Address based on:
    • Severity level
    • Production vs development impact
    • Ease of fix
    • Breaking changes required
  4. Test: Thoroughly test after applying fixes
  5. Document: Update this file with decisions and status

Contact

For security concerns or to report vulnerabilities, please contact the development team.

Last Updated: 2025-11-18 Next Review: Check weekly for new vulnerabilities

There aren’t any published security advisories