Skip to content

Security: 10 automated fixes from holistic-scanner (2 CRITICAL, 5 HIGH, 3 MEDIUM) - #1

Open
usualdork wants to merge 1 commit into
mainfrom
holistic-scanner/fixes-800346aedc-20260520100550
Open

Security: 10 automated fixes from holistic-scanner (2 CRITICAL, 5 HIGH, 3 MEDIUM)#1
usualdork wants to merge 1 commit into
mainfrom
holistic-scanner/fixes-800346aedc-20260520100550

Conversation

@usualdork

Copy link
Copy Markdown
Owner

Summary

This pull request was opened automatically by the holistic-scanner based on findings from a security scan. Please review the diff carefully before merging — automated fixes are best-effort and may require adjustments.

Findings addressed

Severity Count
CRITICAL 2
HIGH 5
MEDIUM 3
LOW 0

Per-finding detail

  • CRITICAL No Authentication or Authorization on Any API Endpoint [CWE-306] — src/app/api/agents/route.ts:1
  • MEDIUM Hardcoded Admin Identity in Audit Logs [CWE-778] — src/app/api/agents/route.ts:49
  • MEDIUM Missing CORS / Origin Validation on State-Changing Endpoints [CWE-352] — src/app/api/whatsapp/send/route.ts:1
  • CRITICAL WhatsApp QR Code Exposed via Unauthenticated /status Endpoint (Pairing Hijack) [CWE-306] — src/app/api/whatsapp/status/route.ts:1
  • HIGH Vulnerable Next.js Version (Multiple Critical/High CVEs) [CWE-1395] — package.json:47
  • HIGH Vulnerable mammoth (DOCX) Library Allows DoS / XXE-like Issues [CWE-1395] — package.json:46
  • HIGH Build Errors and Lint Errors Suppressed [CWE-1127] — next.config.ts:5
  • HIGH Missing Security Headers (CSP, HSTS, X-Frame-Options, etc.) [CWE-693] — next.config.ts:1
  • HIGH Path Traversal Possible via Knowledge File ID in DELETE Endpoint (Defense-in-Depth) [CWE-22] — src/app/api/knowledge/route.ts:19
  • MEDIUM Verbose Error Messages Leak Internal State [CWE-209] — src/app/api/agents/[id]/route.ts:1

Files changed

  • src/app/api/agents/route.ts (2 findings)
  • src/app/api/whatsapp/send/route.ts (1 finding)
  • src/app/api/whatsapp/status/route.ts (1 finding)
  • package.json (2 findings)
  • next.config.ts (2 findings)
  • src/app/api/knowledge/route.ts (1 finding)
  • src/app/api/agents/[id]/route.ts (1 finding)

Scan metadata

  • Scan ID: 800346ae-dc41-44e7-8d41-c2a87a700d75
  • Model: claude-opus-4-7
  • Cost: $0.97
  • Full report: /Users/manishtripathy/Documents/New project/benchmark_output/aiwhisper/report.md

Generated by holistic-scanner. Do not auto-merge; every patch must be reviewed by a human.

…3 MEDIUM)

scan_id: 800346ae-dc41-44e7-8d41-c2a87a700d75
files_changed: 7
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant