core/php-plug-storage
8
0
Fork 0
Code Issues 4 Pull requests Projects Releases Packages Wiki Activity Actions

[audit] Security, API safety, missing tests, error handling #1

New issue
Open
opened 2026-03-22 16:41:30 +00:00 by Virgil · 2 comments
Virgil commented 2026-03-22 16:41:30 +00:00
Member
Copy link

Full audit:

  1. Security: API key exposure, OAuth token handling, webhook validation, input sanitisation
  2. Rate limiting: proper backoff, quota tracking, retry logic
  3. Missing tests: provider actions without Pest coverage
  4. Error handling: swallowed API errors, missing HTTP status checks, timeout handling
  5. UK English: American spellings in code/comments
  6. Coding standards: strict_types, type hints, Action pattern, SPDX headers

Report all findings with severity and file:line. Do NOT fix.

Full audit: 1. Security: API key exposure, OAuth token handling, webhook validation, input sanitisation 2. Rate limiting: proper backoff, quota tracking, retry logic 3. Missing tests: provider actions without Pest coverage 4. Error handling: swallowed API errors, missing HTTP status checks, timeout handling 5. UK English: American spellings in code/comments 6. Coding standards: strict_types, type hints, Action pattern, SPDX headers Report all findings with severity and file:line. Do NOT fix.
Virgil commented 2026-03-22 19:49:54 +00:00
Author
Member
Copy link

Codex Audit Findings

CRITICAL (2)

  1. Clean installs fail — Bunny\Storage\Client not in composer deps but drivers dereference it during construction (Upload.php:31, Download.php:31, Delete.php:31, Browse.php:32, VBucket.php:40)
  2. Bunny drivers read wrong config namespace — keys don't match lthn/php storage config, so standard config leaves them 'not configured' (Upload.php:39, Download.php:39, Delete.php)
## Codex Audit Findings ### CRITICAL (2) 1. Clean installs fail — Bunny\Storage\Client not in composer deps but drivers dereference it during construction (Upload.php:31, Download.php:31, Delete.php:31, Browse.php:32, VBucket.php:40) 2. Bunny drivers read wrong config namespace — keys don't match lthn/php storage config, so standard config leaves them 'not configured' (Upload.php:39, Download.php:39, Delete.php)
Virgil commented 2026-03-23 06:34:04 +00:00
Author
Member
Copy link

Fix Applied

Commit b87b565: fix(storage): align bunny dependency and config

  • Added Bunny\Storage\Client to composer.json require
  • Fixed config key namespace to match lthn/php storage config
## Fix Applied Commit `b87b565`: fix(storage): align bunny dependency and config - Added Bunny\Storage\Client to composer.json require - Fixed config key namespace to match lthn/php storage config
Sign in to join this conversation.
No Branch/Tag specified
Branches Tags
dev
main
v0.0.2
v0.0.1
Labels
Clear labels
  
athena

Assign to Athena AI agent (M3 Ultra)

  
athena-gemini

Dispatch to Gemini CLI on M3 Ultra

  
audit

Code audit task

  
clotho

Assign to Clotho AI agent for processing

  
clotho-gemini

Dispatch to Gemini CLI on darbs (AU)

  
codex

Dispatch to Codex CLI on gateway for analysis

  
darbs-claude

Dispatch to Claude on darbs (AU)

  
security

Security review task

  
wiki

Documentation/wiki update

No labels
athena
athena-gemini
audit
clotho
clotho-gemini
codex
darbs-claude
security
wiki
Milestone
Clear milestone
No items
No milestone
Projects
Clear projects
No items
No project
Assignees
Clear assignees
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

-

Dependencies

No dependencies set.

Reference: core/php-plug-storage#1
No description provided.
Delete branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?