GPT-5 finding
Unauthenticated endpoints allow setting and deleting GitHub repo secrets via gh CLI
criticalsecurityhigh
- dashboard/app/api/secrets/route.ts:96-105
- dashboard/app/api/secrets/route.ts:112-118
- dashboard/app/api/secrets/route.ts:124-133
- dashboard/app/api/secrets/route.ts:135-137
- dashboard/app/api/auth/route.ts:48-68
Both routes expose powerful actions over HTTP without any user authentication/authorization or CSRF protection. They only check local gh CLI auth, not the caller’s identity. An unauthenticated client can POST to set arbitrary repository secrets or DELETE them if the server is reachable, which is a severe privilege escalation and integrity risk.
Recommendation
Add robust authentication and authorization checks to all endpoints (e.g., session/token-based auth, role checks). If intended only for local dev, enforce localhost-only access or behind auth proxy. If cookie-based auth is used, add CSRF protection. Consider requiring an admin capability or signed requests before mutating GitHub secrets.