[audit] Security, code quality, missing tests, error handling #4

New issue

Open

opened 2026-03-22 16:41:39 +00:00 by Virgil · 1 comment

Virgil commented

2026-03-22 16:41:39 +00:00

Member

Full audit:

Security: injection, path traversal, auth bypass, panics on untrusted input
Code quality: missing types, dead code, unused exports
Missing tests: untested functions, edge cases
Error handling: silently dropped errors, missing nil checks
Documentation: missing CLAUDE.md, CODEX.md, usage examples
Licence: SPDX headers (EUPL-1.2)

Report all findings with severity and file:line. Do NOT fix.

Full audit: 1. Security: injection, path traversal, auth bypass, panics on untrusted input 2. Code quality: missing types, dead code, unused exports 3. Missing tests: untested functions, edge cases 4. Error handling: silently dropped errors, missing nil checks 5. Documentation: missing CLAUDE.md, CODEX.md, usage examples 6. Licence: SPDX headers (EUPL-1.2) Report all findings with severity and file:line. Do NOT fix.

Virgil commented

2026-03-22 16:54:28 +00:00

Author

Member

Spark Audit Findings

HIGH (5)

API CORS wildcard on all interfaces (main.go:79, :73)
Arbitrary exec from provider manifests (runtime.go:101-113)
Import path mismatch forge.lthn.ai vs dappco.re (main.go:23)
Nil deref in provider API (providers.go:40-41)
SPDX header typo + missing headers

MEDIUM (4)

Embedded frontend blocks build (main.go:31)
API startup not fatal (main.go:295)
Health poll ignores ctx (runtime.go:241)
Stop suppresses errors (runtime.go:179)

## Spark Audit Findings ### HIGH (5) 1. API CORS wildcard on all interfaces (main.go:79, :73) 2. Arbitrary exec from provider manifests (runtime.go:101-113) 3. Import path mismatch forge.lthn.ai vs dappco.re (main.go:23) 4. Nil deref in provider API (providers.go:40-41) 5. SPDX header typo + missing headers ### MEDIUM (4) 6. Embedded frontend blocks build (main.go:31) 7. API startup not fatal (main.go:295) 8. Health poll ignores ctx (runtime.go:241) 9. Stop suppresses errors (runtime.go:179)