Security Review

CPWAug 6 · edited

Production-reachable bulk deletion of auth-table rows, protected only by a role check and a single-tap confirm.

clearDemoBoard performs await Users.removeAll((u, $) => $.ids.includes(u.id), { ids: demoUserIds }) against the table configured as the app’s auth table, plus cascading removeAll across posts, deals, comments, reactions, kudos, and badges. The scoping logic is correct as written and its two subtle type traps are handled explicitly. The severity comes from blast radius, not from a defect: correctness rests entirely on the demoSeed tag being present and truthy on exactly the right rows, there is no dry-run or preview, no server-side audit record of what was removed, and the only barrier in front of it is auth.requireRole('admin') plus one confirm sheet. Any admin — including one auto-granted the role by the bootstrap path in F8 — can trigger it. A partial failure is not transactional: engagement, posts/deals, and users are deleted in three separate awaited batches, so an error midway leaves the board half-torn-down.

RECOMMENDATION Add a defence-in-depth guard that does not depend on the tag being right: refuse to run if the number of rows about to be deleted exceeds the known demo cast size (28 people), and refuse if any row in the delete set has a non-null email (a real, verified person always has one; a demo row never does). Require typed confirmation in the UI rather than a single tap, and log the deleted ids and counts via console.log so the action is reconstructible from method logs.

Does this mean for each finding I will have to ask REMY to fix. It introduced these issues so it costs to fix.

sean thielenRemy TeamAug 7

The short answer is no, not all security findings are bugs that need to be addressed. The items Remy surfaces in security assessment are informational. They're designed to help you understand risks and potential exposure surfaces in your app. For each one it's important to look at what the app is doing and how secure it "needs" to be.

Think of it like hiring an expert security consultant to come to your house. They might tell you your front door lock could be picked and if you really want to be secure you need to buy some super-secure lock. If you are worried about security in the neighborhood, you might do that! Or you might say thanks for the info, but I think I'm actually fine with a normal lock.

It's similar with apps and computer systems - if you're saving personal information or financial data or things like that, you probably want to make sure everything is airtight. If the app saves your grocery lists, you might not care about making it super-duper hardened. The security assessments in Remy are just letting you know all the places where risks exist so you can be aware of them and make informed decisions about whether to accept them, mitigate them, or harden them.

Please let me know if that helps clear things up!

Sign in to reply

You're browsing read-only. Sign in to post, upvote, or react, and we'll email you a 6-digit code.