17 lines
1.3 KiB
JSON
17 lines
1.3 KiB
JSON
{
|
|
"feature_id": "F-014",
|
|
"agent": "security",
|
|
"verdict": "APPROVED",
|
|
"summary": "Security approved. Public catalog pages use server-only API access, search/category inputs are bounded or slug-validated, backend SQL remains parameterized, and on-demand revalidation is protected by env secret, timing-safe comparison and strict local path allowlist.",
|
|
"evidence": [
|
|
"Checked /api/revalidate: REVALIDATE_SECRET required, x-revalidate-secret checked via timingSafeEqual, invalid/missing secret rejected, only /productos/<slug>, /categoria/<slug>, /marca/<slug>, /products/search paths allowed",
|
|
"Checked storefront API client remains server-only and uses public HTTP endpoints only",
|
|
"Checked search page bounds display/metadata query text and numeric pagination; backend route validates q/categorySlug/brandSlug with zod constraints",
|
|
"Checked backend categorySlug filter uses parameterized SQL values and no frontend backend-internal imports are needed",
|
|
"cd project/storefront && npm audit --audit-level=high --omit=dev: found 0 vulnerabilities",
|
|
"rg secret patterns: only intentional env/header names and redaction pattern code findings; no committed credentials",
|
|
"Post-hardening storefront lint/typecheck/build/lint, backend lint/typecheck/test and verify all passed in build evidence"
|
|
],
|
|
"timestamp": "2026-08-15T15:52:05Z"
|
|
}
|