Last audit: 2026-04-13 Scope: Full-stack (Express/TypeScript backend + React/Vite frontend), Docker deployment behind reverse proxy Approach: Black-box pentest + full-source code review — all discovered findings mitigated prior to release.

• JWT stored in HttpOnly cookie (not localStorage, not Bearer header)
• SameSite=Strict, Secure auto-detected via X-Forwarded-Proto
• Cookie max age: 7 days
• Bearer header fallback removed to prevent XSS extraction
• Force-change-password token delivered via separate HttpOnly cookie

• All API routes behind authenticate middleware
• Admin routes additionally behind requireAdmin middleware
• User isolation: all queries include WHERE userId = :userId
• Deactivated accounts cannot authenticate (checked on every request)

• Zod schemas on all auth endpoints (login, register, password reset)
• Zod schemas on flight creation, update, and query parameters
• Typed schemas on pending-update preview and apply endpoints
• Whitelisted event types on analytics endpoint
• Length-bounded invitation tokens (max 128 chars)
• Regex-validated route colors (/^#[0-9a-fA-F]{3,8}$/)
• Scheme-restricted profile picture URLs (http/https only)
• Body size limits: JSON max size via express.json({ limit }), payload checks in Zod

• API keys (AirLabs, Aviationstack, OpenSky) encrypted at rest via encryptApiKey()
• SMTP password encrypted at rest via encryptApiKey()
• JWT secret auto-generated on first boot, persisted to /app/data/secrets/jwt.secret (mode 0600, inside the data volume); explicit JWT_SECRET env overrides
• Encryption key (for AES-GCM of API keys / SMTP / WebDAV credentials) generated the same way at /app/data/secrets/encryption.key
• No hardcoded secrets in source code; .env file gitignored
• Docker deployment: no secrets in the compose env — the data volume alone carries the key material

• Backup download: path-containment check against BACKUP_BASE_DIR
• Backup restore: targetDatabaseUrl removed from API (server-side env only)
• Database dump: spawn() with argument arrays (no shell injection)
• Backup restore rate limited (3/hour)

• server_tokens off (no version disclosure)
• Security headers on all static responses (X-Content-Type-Options, X-Frame-Options, Referrer-Policy, Permissions-Policy)
• Dotfile access blocked (location ~ /\. { deny all; })
• API headers handled exclusively by Helmet (no duplication)
• Source map requests return 204 (no source code exposure)
• SPA fallback via try_files (no directory listing)

• Security events logged with Pino (structured JSON)
• Failed auth attempts: IP, user-agent, URL, reason
• Invalid tokens: logged with context
• Admin access denials: logged with userId
• No sensitive data in logs (passwords, tokens filtered)
• Log files in data/logs/ (app.log, error.log, http.log)

Detailed per-finding reports are kept internally to avoid providing an attack roadmap for already-mitigated issues. Verification commands below let anyone reproduce the current hardened state against their own deployment.

backend/package.json pins two transitive packages above what their parent asks for. They are listed here because an override with no stated reason is removed by the next person who tidies the file.

Both reach production through the Prisma CLI, which is a devDependency here and still ships: @prisma/client declares prisma as an optional peer, the image's entrypoint runs prisma migrate deploy at boot, and prisma.config.ts imports prisma/config. Removing the CLI from the image is therefore a restructuring, not a flag — which is why the advisories are answered with overrides instead.

npm audit --fix would answer them by DOWNGRADING to prisma@6, which is not an option: this schema is generated by the Prisma 7 prisma-client generator.

Drop these the day prisma depends on fixed versions itself. Measured 2026-09-20 against prisma 7.10.0: npm audit --omit=dev in backend/ went from 4 high to 0, prisma migrate deploy applied all 147 migrations inside the built image, and /health answered 200.

TARGET="http://localhost:3000"   # replace with your deployment URL

# Health check (no version leak)
curl -s $TARGET/health

# Security headers on static assets
curl -sI $TARGET/assets/js/index-*.js | grep -iE "x-frame|x-content|referrer|permissions"

# Security headers on API
curl -sI $TARGET/api/v1/flights | grep -iE "x-frame|x-content|csp|hsts|referrer"

# Dotfile access blocked
curl -sI $TARGET/.env          # should be 403 Forbidden
curl -sI $TARGET/.git/config   # should be 403 Forbidden

# Auth required on all endpoints
curl -s $TARGET/api/v1/flights                # 401
curl -s $TARGET/api/v1/admin/users            # 401
curl -s $TARGET/api/v1/settings               # 401

# JWT alg:none rejected
curl -s $TARGET/api/v1/flights \
  -H 'Cookie: auth_token=eyJhbGciOiJub25lIn0.eyJ1c2VySWQiOjF9.' # 401

# Bearer header rejected
curl -s $TARGET/api/v1/flights \
  -H 'Authorization: Bearer eyJhbGciOiJIUzI1NiJ9.eyJ1c2VySWQiOjF9.fake' # 401

# CORS: no cross-origin headers for foreign origins
curl -sI $TARGET/api/v1/flights -H 'Origin: https://evil.com' | grep -i access-control
# (should return nothing)

# Rate limiting active
curl -sI $TARGET/api/v1/flights | grep -i ratelimit

# HTTP methods blocked
curl -sI -X TRACE $TARGET/    # 405
curl -sI -X OPTIONS $TARGET/  # 405

# Registration disabled
curl -s -X POST $TARGET/api/v1/auth/register \
  -H 'Content-Type: application/json' \
  -d '{"username":"test","password":"Test1234!"}' # 403

# Setup already complete
curl -s $TARGET/api/v1/setup/status # setupComplete: true

# nginx version hidden
curl -sI $TARGET/ | grep -i server  # "Server: nginx" (no version)

# npm audit clean
cd backend && npm audit
cd frontend && npm audit

# Port scan against your own deployment
nmap -sV -p- --open <your-host>
# Expected for a default deploy: HTTP port of the container only

If you discover a security issue, please report it privately via GitHub Security Advisories. Include: affected endpoint, reproduction steps, and potential impact.

Do not open a public issue for security vulnerabilities.