[audit] Security, API safety, missing tests, error handling #1

New issue

Open

opened 2026-03-22 16:41:29 +00:00 by Virgil · 1 comment

Virgil commented

2026-03-22 16:41:29 +00:00

Member

Full audit:

Security: API key exposure, OAuth token handling, webhook validation, input sanitisation
Rate limiting: proper backoff, quota tracking, retry logic
Missing tests: provider actions without Pest coverage
Error handling: swallowed API errors, missing HTTP status checks, timeout handling
UK English: American spellings in code/comments
Coding standards: strict_types, type hints, Action pattern, SPDX headers

Report all findings with severity and file:line. Do NOT fix.

Full audit: 1. Security: API key exposure, OAuth token handling, webhook validation, input sanitisation 2. Rate limiting: proper backoff, quota tracking, retry logic 3. Missing tests: provider actions without Pest coverage 4. Error handling: swallowed API errors, missing HTTP status checks, timeout handling 5. UK English: American spellings in code/comments 6. Coding standards: strict_types, type hints, Action pattern, SPDX headers Report all findings with severity and file:line. Do NOT fix.

Virgil commented

2026-03-22 19:45:25 +00:00

Author

Member

Codex Audit Findings

HIGH (2)

Telegram methods throw instead of returning Response errors — accessToken() called before null guard (Post.php:46, Delete.php:43, Read.php:39/:65/:94, Chats.php:31/:73/:92)
Media url/path contract broken for local files across all providers — path treated as provider-ready URL instead of doing upload handling (Discord Post.php:57, Slack Post.php:61, Telegram Post.php:103)

## Codex Audit Findings ### HIGH (2) 1. Telegram methods throw instead of returning Response errors — accessToken() called before null guard (Post.php:46, Delete.php:43, Read.php:39/:65/:94, Chats.php:31/:73/:92) 2. Media url/path contract broken for local files across all providers — path treated as provider-ready URL instead of doing upload handling (Discord Post.php:57, Slack Post.php:61, Telegram Post.php:103)