Skip to content

M3-14 Initial Security Hardening Pass

Milestone: M3 — Issuing Functionality SOW Reference: NFR3 Requirement Clarity: ✅ Clear Dev Status: 🟡 Partially prototyped — the two concrete auth defects are now fixed (2026-08-14, see Task 32); rate limiting, security headers, and dependency scan still open.

Overview

A first hardening pass on the issuing/admin surface built so far — rate limiting, security headers, dependency/secrets review — ahead of the deeper hardening milestone at M9.

Backend Tasks

  • Add rate limiting on public-facing endpoints (claim page, etc.)
  • Add standard security headers (CSP, HSTS, etc.)
  • ~~Review for hardcoded secrets/credentials — the earlier codebase review found two concrete issues to fix as part of this: an unguarded UsersController (see M2-05) and a hardcoded admin-email auth bypass in auth.controller.ts~~ Fixed 2026-08-14 — UsersController was already guarded by the time this was re-checked. The admin@curo.com bypass was real and has been removed entirely, along with a second, more severe unauthenticated privilege-escalation path in POST /auth/sync found while fixing it (any request with the right org_id could silently create a Platform Admin — no auth at all on that endpoint). Full writeup: Task 32.
  • Dependency vulnerability scan

Frontend Tasks

  • N/A

Dependencies

  • M9 — this is the "early pass"; full hardening (DDoS/WAF/key rotation/GDPR) happens there.

Acceptance Criteria

Feeds into the overall "Security testing completed and remediation of Critical and High vulnerabilities completed" criterion in Appendix 3, assessed properly at M9/M10.

Existing Reference Material

  • docs/requirements/tasks/POC/15-security-encryption-audit.md (kept in place — maps v3.0 security requirements to current implementation per-entity; also referenced from M9)
  • docs/requirements/tasks/POC/16-existing-flow-audit.md (kept in place — flags the hardcoded Auth0 credentials issue directly)

Blockers & Risks

  • ~~The two concrete security defects (unguarded controller, hardcoded auth bypass) should be fixed here, not deferred to M9 — they're live risks now, not just compliance checklist items.~~ Resolved — see Task 32.
  • New, from the same pass: a compromised Auth0 Management API credential was found still sitting in .env.development (traced to a comment in auth.service.ts referencing a prior hardcode) — needs rotation in the Auth0 dashboard. Not yet done; tracked in Task 32.