fix(security): address pentest findings#2347
Closed
jeanduplessis wants to merge 9 commits intomainfrom
Closed
Conversation
![kilo-code-bot[bot]](https://avatars.githubusercontent.com/in/2193792?s=60&v=4){kind=small}
Contributor
Code Review SummaryStatus: 1 Issue Found | Recommendation: Address before merge Overview
Fix these issues in Kilo Cloud Issue Details (click to expand)WARNING
Other Observations (not in diff)None. Files Reviewed (30 files)
Reviewed by gpt-5.4-2026-03-05 · 1,908,661 tokens |
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
| @@ -0,0 +1,9 @@ | |||
| export function buildGoogleTagManagerScript(gtmId: string): string { | |||
| const encodedGtmId = JSON.stringify(gtmId); | |||
| return `(function(w,d,s,l,i){w[l]=w[l]||[];w[l].push({'gtm.start':new Date().getTime(),event:'gtm.js'});var f=d.getElementsByTagName(s)[0],j=d.createElement(s),dl=l!='dataLayer'?'&l='+l:'';j.async=true;j.src='https://www.googletagmanager.com/gtm.js?id='+i+dl;f.parentNode.insertBefore(j,f);})(window,document,'script','dataLayer',${encodedGtmId});`; | |||
|
|
||
| export function buildImpactUttScript(impactUttId: string): string { | ||
| const encodedScriptUrl = JSON.stringify(`https://utt.impactcdn.com/${impactUttId}.js`); | ||
| return `(function(a,b,c,d,e,f,g){e.ire_o=c;e[c]=e[c]||function(){(e[c].a=e[c].a||[]).push(arguments)};f=d.createElement(b);g=d.getElementsByTagName(b)[0];f.async=1;f.src=a;g.parentNode.insertBefore(f,g);})(${encodedScriptUrl},'script','ire',document,window);`; |
jeanduplessis
force-pushed
the
pentest-fixes
branch
from
5462d31 to
be7dad5
Compare
This was referenced Apr 13, 2026
Contributor
Author
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Code-related pentest findings [private access to Kilo team members only] are now addressed without broad product rewrites. Each fix focuses on closing the reported behavior while preserving existing auth, analytics, payments, and device-token flows.
M2: Web session revocation after logout
Related commits:
a8b5a06ab,be7dad5fkilocode_users.web_session_version, stores that version in the NextAuth JWT/session at sign-in, and rejects requests ingetUserFromAuthwhen the session version no longer matches the database row.POST /api/auth/revoke-web-sessionand call it from normal sign-out, auto sign-out, and dev account nuke flows before client-side sign-out.web_session_versionis not a secret. It is a revocation counter inside a signed/encrypted NextAuth JWT. Knowing the next number does not help unless an attacker can mint a valid NextAuth token.api_token_pepperon logout. That would have fixed stale web sessions, but it would also revoke CLI/device/API tokens unexpectedly. A separate web-only version keeps logout scoped to browser sessions.M2: Route-level admin API authorization
Related commit:
a8b5a06abgetUserFromAuth({ adminOnly: true })checks to the credit category admin API endpoints.getUserFromAuthandadminProcedureenforcesctx.user.is_admin./admin/api/**file to visibly call direct admin auth, the tRPC-backed enrichment route can be tightened separately for consistency.M3: Global Content Security Policy
Related commits:
6f1a18ca,be809b65,8041b017proxy.ts. GTM/Impact bootstrap code is served from same-origin script routes instead of inline root-layout scripts, so the root layout no longer callsheaders()and does not force site-wide dynamic rendering just for CSP.CSP_ADDITIONAL_SCRIPT_SRC,CSP_ADDITIONAL_CONNECT_SRC,CSP_ADDITIONAL_IMG_SRC,CSP_ADDITIONAL_STYLE_SRC,CSP_ADDITIONAL_FONT_SRC,CSP_ADDITIONAL_FRAME_SRC,CSP_ADDITIONAL_WORKER_SRC,CSP_ADDITIONAL_MEDIA_SRC) so production-only third-party sources can be added without code changes.style-src 'unsafe-inline'because Next/runtime styles commonly require it. This is safer than breaking rendering and can be tightened later with more focused style nonce/hash work. Env extensions reject values containing;to avoid directive injection.report-uri/report-to, then enforced after reviewing real production violation reports.L1: Missing security headers
Related commit:
abb0e5e0X-Powered-Byexposure.Cross-Origin-Embedder-Policy-Report-Onlyinstead of enforced COEP. Enforced COEP can break third-party scripts/assets unless every provider sends compatible CORS/CORP headers.L2: Email exposure guardrails
Related commits:
72dce744,6a0ce82eCONTRIBUTOR_CHAMPION_TEAM_EMAILS, removed raw email/name from GTM dataLayer events, and added a production-source email literal guardrail test with explicit role-alias allowlist.hi@kilo.aiandsales@kilocode.ai; removing them would change product contact behavior rather than close accidental exposure.I1 CAA DNS and Wayback removal are operational follow-ups outside repo code.
Verification
.plans/pentest-findings.mdfor code-related M2, M3, L1, and L2 scope. I1 CAA and Wayback removal remain operational follow-ups outside repo code./api/userreturning401after revocation with stale cookie, re-login after revocation, and stale admin route rejection for/admin/api/credit-categories.Visual Changes
N/A
Reviewer Notes
Code Reviewer Notes
kilocode_users.web_session_versioncolumn and stores the version in the NextAuth JWT/session at sign-in.getUserFromAuthrejects stale web sessions when the session version no longer matches the database row.POST /api/auth/revoke-web-sessionbefore client-sidesignOut; the endpoint is intentionally idempotent and only increments web session state.adminProcedure.apps/web/src/lib/security-headers.tsand applied fromproxy.ts; GTM/Impact bootstraps are served through same-origin external script routes to avoidheaders()in the root layout.Cross-Origin-Embedder-Policy-Report-Onlyfor compatibility with Stripe/Stytch/Impact/GTM/PostHog/Turnstile resources.CONTRIBUTOR_CHAMPION_TEAM_EMAILS; approved public aliases remain explicit in the guardrail test.