[audit] Security, API safety, missing tests, error handling #1

New issue

Open

opened 2026-03-22 16:41:28 +00:00 by Virgil · 2 comments

Virgil commented

2026-03-22 16:41:28 +00:00

Member

Full audit:

Security: API key exposure, OAuth token handling, webhook validation, input sanitisation
Rate limiting: proper backoff, quota tracking, retry logic
Missing tests: provider actions without Pest coverage
Error handling: swallowed API errors, missing HTTP status checks, timeout handling
UK English: American spellings in code/comments
Coding standards: strict_types, type hints, Action pattern, SPDX headers

Report all findings with severity and file:line. Do NOT fix.

Full audit: 1. Security: API key exposure, OAuth token handling, webhook validation, input sanitisation 2. Rate limiting: proper backoff, quota tracking, retry logic 3. Missing tests: provider actions without Pest coverage 4. Error handling: swallowed API errors, missing HTTP status checks, timeout handling 5. UK English: American spellings in code/comments 6. Coding standards: strict_types, type hints, Action pattern, SPDX headers Report all findings with severity and file:line. Do NOT fix.

Virgil commented

2026-03-22 19:54:58 +00:00

Author

Member

Codex Audit Findings

HIGH (2)

Farcaster sends api_key header but Neynar requires x-api-key — entire provider fails auth (Auth.php:74/:99/:117, Delete.php:54, Post.php:97, Read.php:53/:97/:129/:157/:184)
Lemmy login returns jwt but accessToken() reads access_token — withToken() sends empty bearer, all authenticated operations fail (Auth.php:83, Post.php:75, Delete.php:43/:64, Comment.php:62/:116, Communities.php:169, Read.php:208)

## Codex Audit Findings ### HIGH (2) 1. Farcaster sends api_key header but Neynar requires x-api-key — entire provider fails auth (Auth.php:74/:99/:117, Delete.php:54, Post.php:97, Read.php:53/:97/:129/:157/:184) 2. Lemmy login returns jwt but accessToken() reads access_token — withToken() sends empty bearer, all authenticated operations fail (Auth.php:83, Post.php:75, Delete.php:43/:64, Comment.php:62/:116, Communities.php:169, Read.php:208)

Virgil commented

2026-03-23 12:07:14 +00:00

Author

Member

API Contract Extraction + Bonus Findings

Threads Provider

Auth (OAuth 2.0 code→short→long-lived), Post (container+publish), Read (get/me/list/replies/insights), Delete

Confirmed Issues

HIGH: Lemmy auth returns jwt but consumers read access_token — empty bearer on writes
HIGH: Nostr crypto fallbacks are placeholder implementations (derivePublicKey, toBech32)

Full provider tables in agent log.

## API Contract Extraction + Bonus Findings ### Threads Provider Auth (OAuth 2.0 code→short→long-lived), Post (container+publish), Read (get/me/list/replies/insights), Delete ### Confirmed Issues - HIGH: Lemmy auth returns jwt but consumers read access_token — empty bearer on writes - HIGH: Nostr crypto fallbacks are placeholder implementations (derivePublicKey, toBech32) Full provider tables in agent log.