Security and code quality fixes for PR #217 review comments

[Copilot]

Addresses actionable security vulnerabilities and code quality issues identified in PR #217 review. Implements production-hardening for authentication, webhooks, and test endpoints.

Security Fixes

Cron Authentication

• Single Bearer token method with constant-time comparison prevents timing attacks
• Removed dual-header bypass vulnerability (x-cron-secret OR authorization)

Webhook Signature Verification

• SSLCommerz MD5 hash validation (MD5(transaction_id + store_password))
• Returns 401 for invalid signatures before processing

PII Logging

• All sensitive logging gated behind NODE_ENV === 'development'
• Removed email/user data from production logs in signup and stores routes

Endpoint Protection

• Demo/test endpoints return 403 in production (/api/demo/create-store, /api/subscriptions/init-trial)
• Prevents database spam and subscription abuse

Credentials

• .env.example uses placeholders (no real credentials)
• Test scripts load from environment variables with validation
• Added security warnings to script headers

Code Quality

Unused Imports

• Removed: DialogTrigger, notifyGracePeriod, notifySubscriptionExpired, isValidTransition, Suspense
• Commented out unused SmsChannel class

Error Handling

// Before: All errors returned 500
catch (error) {
  return NextResponse.json({ errors: { _form: [error.message] } }, { status: 500 });
}

// After: Proper status codes
catch (error) {
  if (error instanceof z.ZodError) {
    return NextResponse.json({ errors: { _form: error.errors.map(e => e.message) } }, { status: 400 });
  }
  return NextResponse.json({ errors: { _form: [error.message] } }, { status: 500 });
}

TypeScript

• Fixed React.CSSProperties import (import type { CSSProperties } from 'react')
• Removed node-fetch dependency (use built-in Node.js 18+ fetch)

Configuration

• Webhook gateway default: 'sslcommerz' (only registered gateway)

Documentation

Added PR_217_REVIEW_FIXES_SUMMARY.md

• Complete fix descriptions with code examples
• Remaining architectural issues with recommendations:
  • Middleware subscription enforcement (route protection)
  • Store creation race condition (transaction refactoring needed)
  • x-store-id header trust (session-based validation needed)
• Deployment checklists and security validation steps

Notes

x-store-id Security Warning
Added documentation to src/lib/subscription/middleware.ts clarifying that x-store-id header should only be used for internal/admin routes. User-facing routes must derive storeId from authenticated session.

Validation

• Zero lint errors
• All logging conditional on development environment
• Production endpoints properly gated

---

💬 We'd love your input! Share your thoughts on Copilot coding agent in our 2 minute survey.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
stormcomui	Ready	Preview, Comment	Feb 16, 2026 1:07pm

[Copilot]

Copilot wasn't able to review any files in this pull request.