Opus finding
Error responses can leak shell output / file paths to unauthenticated callers
mediumsecurityhigh
- dashboard/app/api/auth/route.ts:111-114
- dashboard/app/api/secrets/route.ts:119-122
- dashboard/app/api/secrets/route.ts:140-143
`execFileSync` errors include `error.message` containing the full command line (and sometimes stderr). For the secrets POST this means the secret value — passed as argv `-b <value>` — appears in the error message if gh fails (e.g. invalid name slipped through, network error, repo not found), and is then returned in the HTTP response body. Combined with the missing auth above, this is a direct exfiltration path. Even without the argv issue, returning raw stderr from `gh` and the host's working directory is information disclosure.
Recommendation
Never echo `error.message` from child_process to the client. Log server-side and return a generic message (e.g. `{ error: 'Failed to set secret' }`). Pair this with the stdin-input fix above.