Security findings register
This register contains every finding recorded by the current internal web application and API
assessments. Available means the corrective control and its evidence are present. Partially available means a control exists but does not cover the complete finding. Not available means
the corrective control or its verification evidence is absent. Every finding remains open until
the closure test listed in its remediation section passes.
The Web Application VAPT report defines the web assessment scope. The API security assessment report defines the API assessment scope. This page provides the detailed technical finding and resolution record requested by the applicable-item remediation register.
Web application findings
WAV-001 · Vulnerable production componentsNot availableCritical
Identified condition: The production dependency graph contains unresolved Critical, High, Medium, and Low security advisories. A Critical advisory affects a directly selected component, and another Critical advisory is transitive. Reachability testing has not established that the affected runtime paths are unreachable.
Security effect: The release includes components associated with code-execution, data exposure, denial-of-service, content-injection, or integrity risks. The exact effect depends on whether the vulnerable component executes in an attacker-reachable path.
Remediation instruments: Snyk Open Source for dependency identity, fix version, exploit maturity, and retest; the package manager for supported upgrades and dependency-tree inspection; CycloneDX or SPDX tooling for the software bill of materials; GitHub dependency review as an additional pull-request control.
Resolution sequence: Upgrade direct vulnerable components first, recalculate transitive resolution, remove unused packages, rebuild the production artifact, exercise affected workflows, retest with Snyk, and record every remaining exception with owner, compensating control, and expiry.
Closure test: The deployed dependency graph contains no unaccepted Critical or High advisory, the build and affected workflows pass, and the retained scan identifies the exact corrected release.
WAV-002 · Rich-content sanitisation boundaryNot availableHigh
Identified condition: Configurable announcement and document content reaches HTML rendering without one mandatory allowlist sanitisation boundary immediately before browser insertion. Privileged content authorship reduces exposure but does not remove stored cross-site scripting.
Security effect: Compromised or malicious stored content executes with the permissions of the viewing user's browser session and can read visible data, alter rendered information, or initiate actions available to that session.
Remediation instruments: DOMPurify with an explicit allowlist at the final browser render boundary; server-side sanitisation for stored rich content; structured rich-text schemas where raw HTML is unnecessary; OWASP ZAP or Burp Suite for authorised stored and DOM injection verification.
Resolution sequence: Inventory every HTML sink, centralise rendering through the sanitiser, reject event handlers, scriptable URLs, active embeds, and unsafe styling, sanitise existing stored content, and add positive formatting plus negative payload tests.
Closure test: Every identified sink uses the common sanitiser and the test corpus renders approved formatting while blocking script, event-handler, URL-scheme, SVG, CSS, and DOM mutation payloads.
WAV-003 · Privileged backend operation boundaryPartially availableHigh
Identified condition: Row-level security protects ordinary data access. The current managed security advisory also identifies exposed privilege-defining database operations callable by ordinary signed-in roles. A complete operation-by-operation grant and actor-validation review is not available.
Security effect: One operation with an incomplete identity, tenant, role, ownership, property, or transition check can perform work outside the caller's authorised scope.
Remediation instruments: Supabase Security Advisor for exposed privileged operations; database catalogue queries for execution grants and security mode; pgTAP or an equivalent database test harness for negative tenant, role, ownership, and direct-operation tests.
Resolution sequence: Classify each privileged operation, remove inherited execution, grant only the intended role, set a stable object-resolution context, validate the signed-in actor and every scope input inside the transaction, and move internal-only operations outside the exposed API surface.
Closure test: The grant inventory matches the approved operation catalogue and negative tests deny anonymous, peer-tenant, lower-role, foreign-object, and caller-supplied-scope escalation cases.
WAV-004 · Authentication and telemetry privacy hardeningPartially availableMedium
Identified condition: Password authentication, signed sessions, and application-profile checks are present. Leaked-password protection is disabled. MFA is not enforced. Production diagnostic telemetry accepts default personal context and sampled session replay; account-level masking, retention, access, consent, and deletion evidence is not available.
Security effect: A known-compromised password remains eligible, privileged access uses one factor, and diagnostic collection can retain more user or session context than the documented support purpose requires.
Remediation instruments: Supabase Auth leaked-password protection and MFA with authenticator assurance-level enforcement; monitoring-provider privacy controls for data scrubbing, field masks, replay sampling, retention, and role-based access; privacy review for purpose and lawful basis.
Resolution sequence: Enable leaked-password rejection, enrol privileged users in MFA, enforce the higher assurance level on privileged operations, minimise telemetry defaults, mask sensitive fields, restrict replay, approve retention, and review monitoring access.
Closure test: Known leaked passwords are rejected, privileged sessions without the approved second factor are denied, masked test values do not appear in telemetry, and retention plus access evidence matches the approved configuration.
WAV-005 · Wildcard browser-origin policyPartially availableMedium
Identified condition: Endpoint authentication and callback-verification patterns are present. Multiple trusted endpoints also return a wildcard browser-origin policy, including endpoints that do not require access from arbitrary browser origins.
Security effect: A browser on an unapproved origin can reach the cross-origin request boundary. Any weakness in endpoint authentication, credential handling, or response minimisation then has a larger attack surface.
Remediation instruments: An endpoint-classification register; explicit cross-origin allowlists for browser endpoints; no browser-origin headers on internal or provider-callback endpoints; OWASP ZAP or contract tests for preflight, allowed-origin, denied-origin, credential, and error behavior.
Resolution sequence: Classify every endpoint, centralise the policy by endpoint class, remove wildcards, restrict methods and headers, separate callback behavior, and return the same restrictive policy on error responses.
Closure test: Approved application origins succeed, arbitrary origins fail, callbacks remain operational without browser cross-origin access, and credentials are never paired with a wildcard.
WAV-006 · Payment data sent through an external image URLNot availableMedium
Identified condition: The browser sends an encoded payment payload to an external QR-image service in the request URL. HTTPS encrypts transport but the complete URL remains visible to browser, network, monitoring, and provider logging layers.
Security effect: Payment identifiers and transaction context leave the primary application boundary and can remain in logs or history controlled by additional parties.
Remediation instruments: A local QR generation library for browser-side image creation, or a controlled server-side QR renderer with request-body transport; data-flow review; processor and retention review for any retained external service.
Resolution sequence: Replace the URL-based provider request, minimise the QR payload, remove sensitive query values, clear historical integration references, and validate the generated QR against the payment workflow.
Closure test: Browser network inspection shows no payment payload sent to an external image origin and functional tests confirm the locally or privately generated QR remains valid.
WAV-007 · Public web-security header evidenceNot availableMedium
Identified condition: The application release does not contain a verified host-response policy. Cloudflare can provide the controls, but active Content Security Policy, anti-framing, strict transport, content-type, referrer, and permissions headers have not been captured from the deployed response.
Security effect: The current evidence cannot confirm browser-enforced protection against content injection, framing, MIME confusion, excessive browser capability, and referrer disclosure.
Remediation instruments: Cloudflare response-header transform rules or deployment headers; browser network inspection; Mozilla Observatory and OWASP ZAP passive checks; CSP reporting for controlled policy tuning.
Resolution sequence: Capture the current response, define the application policy, deploy CSP in report-only mode, resolve legitimate violations, enforce the final policy, and retain header evidence for both document and application routes.
Closure test: Independent response capture shows the approved headers on every public route and negative framing, mixed-content, script-source, and MIME-handling tests produce the intended denial.
WAV-008 · External runtime asset dependencyPartially availableLow
Identified condition: Primary application delivery uses Cloudflare. Selected browser features still load code or imagery from additional content-delivery services without one retained inventory of version pinning, integrity, retention, and availability treatment.
Security effect: An external service outage interrupts the dependent feature; request metadata leaves the primary host; externally altered content reaches the browser where integrity protection is absent.
Remediation instruments: Self-hosted immutable assets, subresource integrity for retained static resources, Content Security Policy source restrictions, synthetic availability checks, and the supplier register.
Resolution sequence: Inventory runtime origins, self-host required code and images, pin retained resources, add integrity metadata where supported, restrict allowed origins, and record provider purpose plus exit behavior.
Closure test: The production browser trace contains only approved origins, every retained static resource is pinned and policy-restricted, and loss of a non-critical provider produces the documented degraded state.
API findings
API-001 · Over-broad execution surface for privileged database operationsPartially availableHigh
Identified condition: Ordinary data requests use signed sessions and row-level security. The managed security advisory identifies privileged operations exposed to signed-in roles, while a complete least-privilege grant decision and negative authorization test set is absent.
Security effect: An incomplete actor, tenant, role, object, property, or workflow-state check can turn one operation into a function-level authorization bypass.
Remediation instruments: Supabase Security Advisor, database grant and function catalogue review, RLS Tester for policy paths, and pgTAP or equivalent API-driven negative authorization tests.
Resolution sequence: Revoke default execution, approve the minimal caller role, validate server- derived identity and scope inside the operation, remove caller-controlled authorization decisions, and isolate internal operations from the generated API.
Closure test: Direct invocation by every unapproved role fails and the approved caller succeeds only for its own tenant, permitted object, permitted fields, and valid transition.
API-002 · Shared credential scope for elevated servicesPartially availableHigh
Identified condition: Trusted execution keeps elevated credentials outside the browser. Scheduled and service-to-service operations use long-lived shared credentials without consistent evidence of per-operation identity, sender binding, rotation, replay protection, and server-side business-scope restriction.
Security effect: Theft or unintended reuse of one credential grants a broader operational or data scope than a single integration action requires.
Remediation instruments: Separate provider credentials per operation; managed secret storage and rotation; HMAC or asymmetric request signing with timestamp and nonce; source restrictions where supported; anomaly alerts by source, tenant, operation, volume, and destination.
Resolution sequence: Split shared identities, constrain provider permissions, bind the sender, reject stale or replayed requests, derive scope from server-owned configuration, rotate prior credentials, and log credential identity without logging the secret.
Closure test: An expired, replayed, wrong-source, wrong-operation, or cross-scope request fails; credential rotation invalidates the previous value; the approved operation remains functional.
API-003 · Pre-authentication account-context discoveryPartially availableMedium
Identified condition: Managed authentication rate controls exist. The application pre-check returns distinguishable invalid-context and invalid-association results, and no verified application- level attempt counter, progressive delay, challenge, or account-specific abuse control covers that pre-authentication step.
Security effect: Automated requests can enumerate valid context, support credential attacks, and consume backend resources before password verification.
Remediation instruments: Uniform application errors, Cloudflare rate-limiting rules, Turnstile or an equivalent challenge, application attempt counters, security alerts, and an authorised abuse-test script that uses synthetic accounts.
Resolution sequence: Collapse observable failures into one response, normalise response timing, rate-limit by source and account context, add progressive delay and challenge thresholds, retain safe correlation evidence, and avoid logging submitted secrets.
Closure test: Unknown context, unknown identity, and incorrect password return equivalent public behavior; threshold tests activate delay or challenge; legitimate recovery remains available.
API-004 · Wildcard cross-origin access on trusted endpointsPartially availableMedium
Identified condition: Authentication and callback signature controls exist. The browser-origin policy still permits arbitrary origins on multiple trusted endpoints.
Security effect: An unapproved website reaches the browser request surface and gains access to any response that another endpoint defect exposes.
Remediation instruments: Central endpoint classification, explicit origin configuration, contract tests for CORS headers and preflight behavior, and OWASP ZAP passive or active checks in an authorised environment.
Resolution sequence: Apply browser allowlists only to browser endpoints, omit CORS on callbacks and internal operations, restrict methods and headers, and apply the same result to error paths.
Closure test: Approved origins pass, arbitrary origins receive no readable response, and callback plus scheduled operations continue without browser-origin access.
API-005 · Internal error detail in public API responsesNot availableMedium
Identified condition: Several trusted handlers return raw database, runtime, or provider error text to callers. One shared public error contract and one protected diagnostic mapping are not available.
Security effect: Callers receive implementation, constraint, provider, operational, personal, or transaction context that is unnecessary for recovery and useful for attack refinement.
Remediation instruments: A typed public error catalogue, central exception mapping, protected Sentry diagnostics with correlation identifiers, structured logging with redaction, and API contract tests.
Resolution sequence: Define stable public codes, convert internal exceptions at the trust boundary, remove raw provider bodies, redact sensitive fields, retain full diagnostics only in restricted monitoring, and map client recovery behavior to the public code.
Closure test: A fault-injection corpus returns only approved codes and generic messages while the protected diagnostic event retains the correlation data required for investigation.
API-006 · API inventory, contract, and retirement evidenceNot availableMedium
Identified condition: Active interfaces include generated data access, database operations, serverless functions, realtime channels, object storage, and provider callbacks. No single approved catalogue records every interface's owner, environment, authentication, authorization, data class, consumer, version, monitoring, and retirement state.
Security effect: Uncatalogued or obsolete interfaces escape consistent review, testing, monitoring, change control, and retirement.
Remediation instruments: OpenAPI for HTTP contracts; AsyncAPI or an equivalent event contract for asynchronous interfaces; an API catalogue; automated reconciliation against the active managed- service inventory; ownership and retirement fields in the change process.
Resolution sequence: Build the active inventory, assign owners and data classes, document the security contract, identify consumers, version externally consumed behavior, mark retirement dates, and fail reconciliation when an active interface lacks an approved record.
Closure test: Automated reconciliation returns no unowned active interface and every catalogue entry has a tested authentication, authorization, error, rate, logging, version, and retirement definition.
API-007 · Mutable serverless runtime dependency selectionNot availableMedium
Identified condition: Selected serverless libraries resolve through broad release lines rather than an immutable deployed version. A consolidated vulnerability scan, integrity record, and software bill of materials for the serverless graph is absent.
Security effect: A rebuild can resolve different upstream code without an intentional application change, reducing reproducibility and introducing unreviewed behavior or vulnerabilities.
Remediation instruments: Immutable dependency versions, the runtime's supported lock or vendor mechanism, Snyk or another compatible scanner for the serverless graph, CycloneDX or SPDX inventory, and release-note review.
Resolution sequence: Resolve and pin every runtime dependency, retain the resolved graph, scan it, review direct and transitive licenses plus advisories, rebuild in a clean environment, and update only through reviewed pull requests.
Closure test: Two clean builds resolve the same dependency graph and artifact behavior, the retained scan matches the deployed release, and no unaccepted Critical or High advisory remains.
Closure governance
The finding owner records the implementation release, validation method, result, reviewer, and date.
An internal retest changes a finding from open to internally verified. Checklist item 9 remains Not available until implemented corrections exist and a closure register records them. Checklist item 10
remains Deferred until an authorised independent assessor retests the corrected scope.