| name | security-review |
| description | Review code changes for security vulnerabilities specific to this project |
Review all unstaged changes (git diff) for security issues. Check each area below and report findings as a numbered list with PASS/WARN/FAIL per item.
Authentication & Authorization
- Endpoint protection: Every endpoint in
endpoints/*.py (except /api/app/config) must call ForceAuthentication(token) or ForceAuthentication(token, "admin") before any business logic. Check that no new endpoints skip authentication.
- Admin role enforcement: All endpoints under
/api/admin/ must use ForceAuthentication(token, "admin"). Check that no admin endpoint uses plain ForceAuthentication(token) without the role parameter.
- User data isolation: Endpoints returning user-specific data must filter by the authenticated user's ID. Check that users cannot access other users' reservations or data by manipulating IDs.
- Token handling: Login tokens are generated via
CreateLoginToken(). Check that tokens are not logged, exposed in responses beyond login, or stored insecurely.
Input Validation
- Pydantic validation: POST request bodies use Pydantic models with appropriate type constraints. Check for overly permissive types (e.g.,
Dict[str, Any] without further validation in the response handler).
- Query parameter validation: GET endpoint parameters have type annotations and are validated before use. Check for missing bounds on numeric parameters (IDs, durations, page sizes).
- String sanitization: User-supplied strings (descriptions, names, emails) are length-limited and stripped of dangerous characters before database storage or HTML rendering.
Database Security
- ORM-only queries: All database access uses SQLAlchemy ORM methods (
session.query(), session.add(), filter()). Check for any raw SQL via session.execute(text(...)) or string concatenation in queries.
- Session scope: Database sessions are properly scoped with
with Session() as session:. Check that sessions are not leaked or left open.
Docker & Infrastructure Security
- Container isolation: Container operations in
docker/containers.py validate parameters before passing to python_on_whales. Check that user input does not flow unsanitized into container names, mount paths, or command strings.
- Port exposure: Container port assignments come from the managed port range (default 2000-3000). Check that no code opens arbitrary ports or bypasses the port management system in
docker/ports.py.
- Mount path validation: Role-based mounts in
docker/mounts.py use template variables ({email}, {userid}). Check that user input cannot inject path traversal sequences (../) into mount paths.
Information Disclosure
- Error messages: Error responses use generic messages. Check that stack traces, internal paths, database details, or configuration values are not leaked to the client.
- Sensitive data in responses: Check that password hashes, salts, login tokens (beyond the owner's own token), and internal IDs are not included in API responses.
Present results as a checklist. For any WARN or FAIL items, show the specific file, line number, and a concrete description of the vulnerability with a suggested fix.
Do NOT report style issues, naming conventions, or non-security concerns. Stay focused on security only.
