fix(main): address medium-severity security findings

[appleboy]

Summary

• Bound all 4 io.ReadAll(resp.Body) calls with io.LimitReader (1 MB cap) to prevent unbounded memory allocation from malicious/oversized responses
• Replace configInitialized bool with sync.Once to eliminate a theoretical data race on concurrent initConfig() calls
• Add a warning when client secret is passed via -client-secret CLI flag, as it may be visible in process listings (ps, /proc)

Test plan

• make test — all tests pass
• make lint — no issues

🤖 Generated with Claude Code

[codecov-commenter]

Codecov Report

❌ Patch coverage is 27.77778% with 13 lines in your changes missing coverage. Please review.

Files with missing lines	Patch %	Lines
main.go	27.77%	12 Missing and 1 partial ⚠️

📢 Thoughts on this report? Let us know!

[Copilot]

Pull request overview

This PR hardens the CLI against medium-severity security findings by bounding HTTP response reads, removing a theoretical config init data race, and adding user-facing guidance about insecure secret handling.

Changes:

• Cap all io.ReadAll(resp.Body) calls to 1 MiB via io.LimitReader to prevent unbounded memory allocation.
• Replace configInitialized with sync.Once to make initConfig() concurrency-safe.
• Warn when -client-secret is provided via CLI flags due to potential exposure via process listings.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

maxResponseSize is defined as 1<<20 (1,048,576 bytes), which is 1 MiB rather than 1 MB. Either adjust the comment to say 1 MiB, or use a decimal value (e.g. 1_000_000) if you intend an SI MB limit.

Suggested change

	maxResponseSize = 1 << 20 // 1 MB
	maxResponseSize = 1 << 20 // 1 MiB

[Copilot]

Using io.ReadAll(io.LimitReader(..., maxResponseSize)) will silently truncate oversized responses; the resulting error will likely be a JSON parse failure rather than a clear "response too large" signal. Consider reading maxResponseSize+1 bytes and returning an explicit error when the limit is exceeded.

Suggested change

	body, err := io.ReadAll(io.LimitReader(resp.Body, maxResponseSize))
	if err != nil {
	return nil, fmt.Errorf("failed to read response: %w", err)
	}
	body, err := io.ReadAll(io.LimitReader(resp.Body, maxResponseSize+1))
	if err != nil {
	return nil, fmt.Errorf("failed to read response: %w", err)
	}
	if int64(len(body)) > maxResponseSize {
	return nil, fmt.Errorf("response too large")
	}

[Copilot]

Using io.ReadAll(io.LimitReader(..., maxResponseSize)) will silently truncate oversized responses; the resulting error will likely be a JSON parse failure rather than a clear "response too large" signal. Consider reading maxResponseSize+1 bytes and returning an explicit error when the limit is exceeded.

Suggested change

	body, err := io.ReadAll(io.LimitReader(resp.Body, maxResponseSize))
	if err != nil {
	return nil, fmt.Errorf("failed to read response: %w", err)
	}
	body, err := io.ReadAll(io.LimitReader(resp.Body, maxResponseSize+1))
	if err != nil {
	return nil, fmt.Errorf("failed to read response: %w", err)
	}
	if int64(len(body)) > maxResponseSize {
	return nil, fmt.Errorf("response too large: limit %d bytes", maxResponseSize)
	}

[Copilot]

Using io.ReadAll(io.LimitReader(..., maxResponseSize)) will silently truncate oversized responses; the resulting error will likely be a JSON parse failure rather than a clear "response too large" signal. Consider reading maxResponseSize+1 bytes and returning an explicit error when the limit is exceeded.

[Copilot]

Using io.ReadAll(io.LimitReader(..., maxResponseSize)) will silently truncate oversized responses; the resulting error will likely be a JSON parse failure rather than a clear "response too large" signal. Consider reading maxResponseSize+1 bytes and returning an explicit error when the limit is exceeded.

[Copilot]

New security behavior (capping response reads) is introduced here, but there are currently no unit tests covering the oversized-response case. Consider adding httptest-based tests that return >maxResponseSize bodies and assert you get a deterministic "response too large"-style error (rather than a JSON parse error).

Suggested change

	body, err := io.ReadAll(io.LimitReader(resp.Body, maxResponseSize))
	if err != nil {
	return nil, fmt.Errorf("failed to read response: %w", err)
	}
	body, err := io.ReadAll(io.LimitReader(resp.Body, maxResponseSize+1))
	if err != nil {
	return nil, fmt.Errorf("failed to read response: %w", err)
	}
	if int64(len(body)) > maxResponseSize {
	return nil, fmt.Errorf("failed to read response: response body exceeds maximum allowed size of %d bytes", maxResponseSize)
	}

[Copilot]

A new warning is added when -client-secret is provided, but there are no tests validating that configWarnings includes this message when the flag is set. Consider factoring the warning decision into a small helper (or resetting flag.CommandLine in tests) so this behavior is covered and doesn’t regress.

Suggested change

	func doInitConfig() {
	flag.Parse()
	serverURL = getConfig(*flagServerURL, "SERVER_URL", "http://localhost:8080")
	clientID = getConfig(*flagClientID, "CLIENT_ID", "")
	clientSecret = getConfig(*flagClientSecret, "CLIENT_SECRET", "")
	if *flagClientSecret != "" {
	configWarnings = append(configWarnings,
	"Client secret passed via command-line flag. "+
	"This may be visible in process listings. "+
	"Consider using CLIENT_SECRET env var or .env file instead.")
	}
	// computeConfigWarningsFromFlags returns configuration warnings derived solely
	// from command-line flag values. This is separated from doInitConfig so that
	// the warning behavior can be unit tested without relying on global flag state.
	func computeConfigWarningsFromFlags(clientSecretFlag string) []string {
	var warnings []string
	if clientSecretFlag != "" {
	warnings = append(warnings,
	"Client secret passed via command-line flag. "+
	"This may be visible in process listings. "+
	"Consider using CLIENT_SECRET env var or .env file instead.")
	}
	return warnings
	}
	func doInitConfig() {
	flag.Parse()
	serverURL = getConfig(*flagServerURL, "SERVER_URL", "http://localhost:8080")
	clientID = getConfig(*flagClientID, "CLIENT_ID", "")
	clientSecret = getConfig(*flagClientSecret, "CLIENT_SECRET", "")
	configWarnings = append(configWarnings, computeConfigWarningsFromFlags(*flagClientSecret)...)