Security & scan findings

Summary counts

Findings reviewed

8

Fixed

5

Hardened

1

Accepted by design

2

Findings and fixes

• Unsafe file uploads

  warningFixed

  Uploads now pass a strict allowlist (images, PDFs, plain text only), per-type size caps and a magic-byte check that rejects executables, archives and files renamed to look like documents.

• Admin entrance discoverability

  infoHardened

  The admin editor renders a 404 until the JARVIS owner quiz is cleared, and the quiz now rate-limits wrong answers with a temporary lockout.

• Unverified admin accounts

  warningFixed

  Admin editing requires a confirmed email address on top of the admin role, checked again on the server for every save.

• No trail for founder knowledge edits

  warningFixed

  Every founder/ownership knowledge change is recorded server-side with the editor's email, previous and new text, IP address, browser and timestamp. The log is append-only and readable by admins only.

• Shared PDF access

  warningAccepted by design

  Shared PDFs live in a private bucket. Links are validated server-side (token, expiry, optional password) and served through short-lived signed URLs, so no public read policy exists by design.

• Role lookup runs with elevated rights

  infoAccepted by design

  The role checker is a locked-down helper that only returns yes/no. This is the required pattern for non-recursive access rules and is intentionally callable by signed-in users.

• Public viewer HTTP headers

  infoFixed

  The public PDF viewer sends a content security policy, frame protection, HSTS and no-sniff headers, verified not to break rendering.

• Abuse of PDF generation and OCR

  warningFixed

  PDF generation, OCR and share creation are rate limited per user and per IP address.