Skip to content

v0.1.1 - Security Hardening & Test Suite

Choose a tag to compare

View all tags
@hsperus hsperus released this 06 Apr 16:25
· 14 commits to main since this release
v0.1.1
db4b36a

v0.1.1 - Security Hardening & Test Suite

Security

  • Remove hardcoded JWT secret fallback — JWT_SECRET env var now required
  • Mask sensitive fields (API keys, passwords, tokens) in GET /api/settings responses
  • Fix XSS vulnerability in email HTML generation
  • Fix CRLF header injection in email subject lines
  • Add security headers: X-Content-Type-Options, X-Frame-Options, X-XSS-Protection, Referrer-Policy, Permissions-Policy
  • Add rate limiting: 5 req/min on auth, 60 req/min on general API
  • Add JWT structure validation in middleware
  • Add webhook fetch timeout (10s) to prevent hanging requests
  • Add Zod input validation schemas for all API endpoints

Testing

  • 177 tests across 15 test files — all passing
  • Unit tests: auth, automation engine, AI engine, AI tools, security utilities, rate limiter, input validation
  • API route tests: auth, conversations, tickets, settings, health
  • Security tests: middleware (headers, rate limiting, auth bypass), injection prevention (XSS, CRLF, SQL), secrets masking, JWT security

Infrastructure

  • Structured logger (src/lib/logger.ts) replacing 79 console.log/error calls across 37 files
  • Vitest test framework with mocks, fixtures, and helpers
  • Test step added to CI pipeline
  • next.config.ts hardened: poweredByHeader: false, reactStrictMode: true

Full diff

v0.1.0...v0.1.1

Assets 2
Loading