[audit] Security, API safety, missing tests, error handling #1

New issue

Open

opened 2026-03-22 16:41:30 +00:00 by Virgil · 1 comment

Virgil commented

2026-03-22 16:41:30 +00:00

Member

Full audit:

Security: API key exposure, OAuth token handling, webhook validation, input sanitisation
Rate limiting: proper backoff, quota tracking, retry logic
Missing tests: provider actions without Pest coverage
Error handling: swallowed API errors, missing HTTP status checks, timeout handling
UK English: American spellings in code/comments
Coding standards: strict_types, type hints, Action pattern, SPDX headers

Report all findings with severity and file:line. Do NOT fix.

Full audit: 1. Security: API key exposure, OAuth token handling, webhook validation, input sanitisation 2. Rate limiting: proper backoff, quota tracking, retry logic 3. Missing tests: provider actions without Pest coverage 4. Error handling: swallowed API errors, missing HTTP status checks, timeout handling 5. UK English: American spellings in code/comments 6. Coding standards: strict_types, type hints, Action pattern, SPDX headers Report all findings with severity and file:line. Do NOT fix.

Virgil commented

2026-03-22 19:41:55 +00:00

Author

Member

Codex Audit Findings

HIGH (2)

Purge urls() sends target in POST body but Bunny requires url query parameter — purges may fail (Purge.php:72)
bandwidth() returns cache_hit_rate as cached_bandwidth — callers get percentage where bytes expected (Stats.php:105)

MEDIUM (3)

stats() reads Error4xxCount/Error5xxCount but never requests loadErrors — error metrics always 0 (Stats.php:78)
urls() collapses 401/429 into generic error, drops rate_limited state and retry_after, keeps sending (Purge.php:74)
Missing backoff on rate-limited requests (Purge.php:70)

## Codex Audit Findings ### HIGH (2) 1. Purge urls() sends target in POST body but Bunny requires url query parameter — purges may fail (Purge.php:72) 2. bandwidth() returns cache_hit_rate as cached_bandwidth — callers get percentage where bytes expected (Stats.php:105) ### MEDIUM (3) 3. stats() reads Error4xxCount/Error5xxCount but never requests loadErrors — error metrics always 0 (Stats.php:78) 4. urls() collapses 401/429 into generic error, drops rate_limited state and retry_after, keeps sending (Purge.php:74) 5. Missing backoff on rate-limited requests (Purge.php:70)