[audit] Security, code quality, missing tests, error handling #25

New issue

Open

opened 2026-03-22 16:41:17 +00:00 by Virgil · 2 comments

Virgil commented

2026-03-22 16:41:17 +00:00

Member

Full audit:

Security: SQL injection, XSS, CSRF bypass, mass assignment, path traversal, insecure deserialization
Code quality: missing strict_types, missing type hints, missing return types
Missing tests: modules/actions without Pest test coverage
Error handling: swallowed exceptions, bare try/catch, missing validation
UK English: American spellings (color→colour, organization→organisation, center→centre)
Coding standards: PSR-12 compliance, Action pattern usage, BelongsToWorkspace scoping
Missing SPDX licence headers (EUPL-1.2)

Report all findings with severity and file:line. Do NOT fix.

Full audit: 1. Security: SQL injection, XSS, CSRF bypass, mass assignment, path traversal, insecure deserialization 2. Code quality: missing strict_types, missing type hints, missing return types 3. Missing tests: modules/actions without Pest test coverage 4. Error handling: swallowed exceptions, bare try/catch, missing validation 5. UK English: American spellings (color→colour, organization→organisation, center→centre) 6. Coding standards: PSR-12 compliance, Action pattern usage, BelongsToWorkspace scoping 7. Missing SPDX licence headers (EUPL-1.2) Report all findings with severity and file:line. Do NOT fix.

Virgil commented

2026-03-22 19:43:15 +00:00

Author

Member

Codex Audit Findings

CRITICAL (1)

Core\Mod\Hub namespace not in composer.json autoload — Hub backend classes (Boot.php, TeapotController, HoneypotHit, Service) not resolvable in normal install. Tests also broken (TeapotTest.php:14, MetadataValidationTest.php:12)

HIGH (1)

Hub migration issues (details in log)

## Codex Audit Findings ### CRITICAL (1) 1. Core\Mod\Hub namespace not in composer.json autoload — Hub backend classes (Boot.php, TeapotController, HoneypotHit, Service) not resolvable in normal install. Tests also broken (TeapotTest.php:14, MetadataValidationTest.php:12) ### HIGH (1) 2. Hub migration issues (details in log)

Virgil commented

2026-03-23 12:06:54 +00:00

Author

Member

Convention Drift Scan

strict_types: NEEDS WORK

Multiple files missing declare(strict_types=1) — Form components, Hub modals

Type Hints: NEEDS WORK

Missing return types on Livewire component methods, Form components

BelongsToWorkspace: (checked, see log)

UK English Violations

color used in domain/schema names instead of colour — Service model, migrations, seeders, managers (6 locations)
initializes/Initialize in Boot.php and tests

Action Pattern: (see full log for details)

Read-only scan, no fixes applied.

## Convention Drift Scan ### strict_types: NEEDS WORK Multiple files missing declare(strict_types=1) — Form components, Hub modals ### Type Hints: NEEDS WORK Missing return types on Livewire component methods, Form components ### BelongsToWorkspace: (checked, see log) ### UK English Violations - `color` used in domain/schema names instead of `colour` — Service model, migrations, seeders, managers (6 locations) - `initializes`/`Initialize` in Boot.php and tests ### Action Pattern: (see full log for details) Read-only scan, no fixes applied.