[audit] Security, API safety, missing tests, error handling #1

New issue

Open

opened 2026-03-22 16:41:31 +00:00 by Virgil · 1 comment

Virgil commented

2026-03-22 16:41:31 +00:00

Member

Full audit:

Security: API key exposure, OAuth token handling, webhook validation, input sanitisation
Rate limiting: proper backoff, quota tracking, retry logic
Missing tests: provider actions without Pest coverage
Error handling: swallowed API errors, missing HTTP status checks, timeout handling
UK English: American spellings in code/comments
Coding standards: strict_types, type hints, Action pattern, SPDX headers

Report all findings with severity and file:line. Do NOT fix.

Full audit: 1. Security: API key exposure, OAuth token handling, webhook validation, input sanitisation 2. Rate limiting: proper backoff, quota tracking, retry logic 3. Missing tests: provider actions without Pest coverage 4. Error handling: swallowed API errors, missing HTTP status checks, timeout handling 5. UK English: American spellings in code/comments 6. Coding standards: strict_types, type hints, Action pattern, SPDX headers Report all findings with severity and file:line. Do NOT fix.

Virgil commented

2026-03-22 19:46:48 +00:00

Author

Member

Codex Audit Findings

HIGH (2)

Tagged releases not installable — requires dev-only lthn/php with no stable path (composer.json:8/:15)
Download tracking never retries on API failure — job discards Response, 4xx/5xx/429 treated as success (TriggerDownload.php:37, Download.php:43)

MEDIUM (1)

Attribution payload insufficient for Unsplash compliance — no referral-ready URLs (Photo.php:67/:76)

## Codex Audit Findings ### HIGH (2) 1. Tagged releases not installable — requires dev-only lthn/php with no stable path (composer.json:8/:15) 2. Download tracking never retries on API failure — job discards Response, 4xx/5xx/429 treated as success (TriggerDownload.php:37, Download.php:43) ### MEDIUM (1) 3. Attribution payload insufficient for Unsplash compliance — no referral-ready URLs (Photo.php:67/:76)