41f144d7bd
- request_id generated or sanitized-propagated on every request (x-request-id)
- structured JSON logging (pino), one correlated line per request, injectable logger
- error envelope v2 { error: { statusCode, code, message, details? }, requestId }
- 5xx messages always generic; stack traces stay in server logs only
- explicit parseJson (zod) input validation hook at the API layer
- README HTTP contract section; deps justified in spec/tech.md
- all gates approved; verify.sh green
28 lines
1.5 KiB
JSON
28 lines
1.5 KiB
JSON
{
|
|
"feature_id": "F-003",
|
|
"agent": "security",
|
|
"verdict": "APPROVED",
|
|
"summary": "Security gate passed. Header propagation sanitized against injection, no stack/internal leakage, log injection neutralized by JSON serialization, zero audit vulnerabilities with pino+zod.",
|
|
"checks": {
|
|
"dependencies": "PASS: npm audit -> 0 vulnerabilities; pino/zod justified in spec/tech.md",
|
|
"header_injection": "PASS: incoming x-request-id accepted only under ^[A-Za-z0-9._-]{1,128}$; newline and 129-char payloads replaced by UUID (regression tests present)",
|
|
"response_leakage": "PASS: 5xx path forces generic 'Internal Server Error'; body assertions confirm absence of thrown message and stack; 4xx exposes only safe messages/codes",
|
|
"log_injection": "PASS: requestId is pre-sanitized; url/method serialized via pino JSON encoding which escapes control characters",
|
|
"dangerous_patterns": "PASS: no eval / new Function / child_process in src"
|
|
},
|
|
"findings": [
|
|
{
|
|
"severity": "info",
|
|
"note": "Fastify 4xx codes exposed in envelope (e.g. FST_ERR_CTP_INVALID_JSON_BODY) are public framework codes; no internal state disclosed."
|
|
}
|
|
],
|
|
"evidence": [
|
|
"npm audit -> found 0 vulnerabilities",
|
|
"grep eval|new Function over src -> none",
|
|
"grep x-request-id non-test usages -> only constant + sanitized generator path",
|
|
"5xx generic guard verified at build-app.ts lines 68/75",
|
|
"test 'internal errors never leak message or stack to the client' passes"
|
|
],
|
|
"timestamp": "2026-08-14T20:14:00Z"
|
|
}
|