[audit] Security, code quality, missing tests, error handling #1

New issue

Open

opened 2026-03-22 16:41:39 +00:00 by Virgil · 1 comment

Virgil commented

2026-03-22 16:41:39 +00:00

Member

Full audit:

Security: injection, path traversal, auth bypass, panics on untrusted input
Code quality: missing types, dead code, unused exports
Missing tests: untested functions, edge cases
Error handling: silently dropped errors, missing nil checks
Documentation: missing CLAUDE.md, CODEX.md, usage examples
Licence: SPDX headers (EUPL-1.2)

Report all findings with severity and file:line. Do NOT fix.

Full audit: 1. Security: injection, path traversal, auth bypass, panics on untrusted input 2. Code quality: missing types, dead code, unused exports 3. Missing tests: untested functions, edge cases 4. Error handling: silently dropped errors, missing nil checks 5. Documentation: missing CLAUDE.md, CODEX.md, usage examples 6. Licence: SPDX headers (EUPL-1.2) Report all findings with severity and file:line. Do NOT fix.

Virgil commented

2026-03-22 19:29:22 +00:00

Author

Member

Codex Audit Findings

HIGH (2)

Go response cache leaks authenticated responses — keyed only by URI, replays all headers/body to any caller (cache.go:80, options.go:235)
PHP namespace drift breaks autoloading — package autoloads Core\ but services/commands still declare Mod, container resolution fails at runtime (composer.json:11, ApiKeyService.php:5, ApiUsageService.php:5, TrackApiUsage.php:11, CleanupExpiredGracePeriods.php:5, Boot.php:143)

## Codex Audit Findings ### HIGH (2) 1. Go response cache leaks authenticated responses — keyed only by URI, replays all headers/body to any caller (cache.go:80, options.go:235) 2. PHP namespace drift breaks autoloading — package autoloads Core\ but services/commands still declare Mod\, container resolution fails at runtime (composer.json:11, ApiKeyService.php:5, ApiUsageService.php:5, TrackApiUsage.php:11, CleanupExpiredGracePeriods.php:5, Boot.php:143)