425fedd13e
- node-pg-migrate + pg: baseline migration (extensions, app_meta) with working down - src/infrastructure/db fail-fast pool and typed query helper - docker-compose: postgres:16-alpine + redis:7-alpine with one-command up - table naming convention <module>_<table> documented in README - integration tests (6) against real PostgreSQL; strict identifier validation for test DDL after security-gate hardening round - deps justified in spec/tech.md; all gates approved; verify.sh green
29 lines
1.7 KiB
JSON
29 lines
1.7 KiB
JSON
{
|
|
"feature_id": "F-002",
|
|
"agent": "security",
|
|
"verdict": "APPROVED",
|
|
"summary": "Security gate passed. Zero audit vulnerabilities with new deps (pg, node-pg-migrate), no secrets in code, .env gitignored, parameterized queries everywhere, and the one DDL interpolation point is now guarded by strict identifier validation with regression tests.",
|
|
"checks": {
|
|
"secrets": "PASS: no hardcoded secrets in src/scripts/migrations; dev compose credentials are explicitly documented as dev-only; .env confirmed gitignored (git check-ignore .env)",
|
|
"dependencies": "PASS: npm audit -> 0 vulnerabilities; pg/node-pg-migrate/@types/pg justified in spec/tech.md",
|
|
"sast_basic": "PASS: no eval/new Function; template-literal SQL limited to 2 DDL statements in test support, guarded by /^[a-zA-Z_][a-zA-Z0-9_]*$/ validation in dbNameFromUrl (rejection covered by db-test-support.test.ts)",
|
|
"input_validation": "PASS: pool helper uses $n parameterized queries exclusively for data access",
|
|
"exposure": "INFO accepted: compose binds 5432/6379 on host for local dev only; documented in README"
|
|
},
|
|
"findings": [
|
|
{
|
|
"severity": "low",
|
|
"note": "DDL identifier interpolation in test support",
|
|
"resolution": "MITIGATED this gate round: strict identifier validation added before any DDL use + unit tests rejecting bad\"name and semi;colon cases"
|
|
}
|
|
],
|
|
"evidence": [
|
|
"npm audit -> found 0 vulnerabilities",
|
|
"git check-ignore .env -> ignored",
|
|
"grep secret scan over src/scripts/migrations -> none",
|
|
"grep for template-literal queries -> only the 2 guarded DDL statements remain",
|
|
"npm test after hardening -> 11 passed | 6 skipped; test:integration -> 6 passed"
|
|
],
|
|
"timestamp": "2026-08-14T20:00:00Z"
|
|
}
|