[audit] Security, code quality, missing tests, error handling #6

New issue

Open

opened 2026-03-22 16:41:16 +00:00 by Virgil · 2 comments

Virgil commented

2026-03-22 16:41:16 +00:00

Member

Full audit:

Security: SQL injection, XSS, CSRF bypass, mass assignment, path traversal, insecure deserialization
Code quality: missing strict_types, missing type hints, missing return types
Missing tests: modules/actions without Pest test coverage
Error handling: swallowed exceptions, bare try/catch, missing validation
UK English: American spellings (color→colour, organization→organisation, center→centre)
Coding standards: PSR-12 compliance, Action pattern usage, BelongsToWorkspace scoping
Missing SPDX licence headers (EUPL-1.2)

Report all findings with severity and file:line. Do NOT fix.

Full audit: 1. Security: SQL injection, XSS, CSRF bypass, mass assignment, path traversal, insecure deserialization 2. Code quality: missing strict_types, missing type hints, missing return types 3. Missing tests: modules/actions without Pest test coverage 4. Error handling: swallowed exceptions, bare try/catch, missing validation 5. UK English: American spellings (color→colour, organization→organisation, center→centre) 6. Coding standards: PSR-12 compliance, Action pattern usage, BelongsToWorkspace scoping 7. Missing SPDX licence headers (EUPL-1.2) Report all findings with severity and file:line. Do NOT fix.

Virgil commented

2026-03-22 19:27:26 +00:00

Author

Member

Codex Audit Findings

HIGH (2)

Configured activity model ignored — service and Livewire UI hard-code Spatie model, bypassing custom scopes (ActivityLogService.php:19/:48/:446, ActivityFeed.php:20/:117/:151/:210/:246, ActivityPruneCommand.php:51/:59)
Workspace-scoped activity leaks cross-workspace data — subject-type filters, causer filters, and detail modal query full table without workspace constraint (ActivityFeed.php:43/:117/:151/:194/:240/:263)

MEDIUM (1)

Subject-type filtering collapses distinct models sharing same basename — LIKE lookup picks wrong model in modular monolith (ActivityFeed.php:117)

## Codex Audit Findings ### HIGH (2) 1. Configured activity model ignored — service and Livewire UI hard-code Spatie model, bypassing custom scopes (ActivityLogService.php:19/:48/:446, ActivityFeed.php:20/:117/:151/:210/:246, ActivityPruneCommand.php:51/:59) 2. Workspace-scoped activity leaks cross-workspace data — subject-type filters, causer filters, and detail modal query full table without workspace constraint (ActivityFeed.php:43/:117/:151/:194/:240/:263) ### MEDIUM (1) 3. Subject-type filtering collapses distinct models sharing same basename — LIKE lookup picks wrong model in modular monolith (ActivityFeed.php:117)

Virgil commented

2026-03-23 06:36:30 +00:00

Author

Member