0.4.2: three things an audit found

Three things found by auditing the board rather than by using it. No API is removed and nothing a caller depends on changes shape.

SECRET was read by no code

Not by sessions, magic links, device codes or webauthn challenges. All four are 256-bit random values stored as a SHA-256 hash in Postgres: there is no HMAC and nothing to key.

Two places said otherwise. The README called PUBLIC_URL and SECRET "the two variables that matter", and the boot log warned:

SECRET is unset, so one was generated. Sessions will not survive a restart.

That is false. Sessions are database rows and survive a restart whatever SECRET is set to. Anyone who read either one learned something untrue about their own deployment.

SECRET is gone from the config, the README, .env.example and the compose file. If you have it set, nothing happens: it was already being ignored.

The search box threw away your tag filter

A GET form submits its own fields and nothing else, and tags are set by clicking a badge rather than by a control. So on /?tags=javascript, searching or touching any dropdown silently dropped the tag. salaryMin and an employer filter had the same problem. All three are carried through now.

The published API document was missing a third of the API

34 routes served, 22 documented. The 13 missing included all of /candidates, POST /jobs/import, PATCH /jobs/{slug}, POST /auth/magic-link, and POST /orgs, which you have to call before you can post a job at all.

This board's whole pitch is that a person reads the page and an agent reads the JSON. An agent reading the index could not have found that candidates exist, that a job can be imported from a URL, or how to create the employer a listing needs.

There was already a test that every documented path resolves, so nothing in the document was a lie. Nothing checked the other direction, so anything added after the document was written never appeared in it. Both directions are checked now, and the new one reads the routes out of the router rather than a list kept beside it.

119 tests against a real Postgres.