Merge pull request #51 from stenwire/main

deploy

Author: stenwire

.github/workflows/deploy.yml

@@ -29,6 +29,7 @@ env:
     -e GOOGLE_CLIENT_SECRET="${{ secrets.GOOGLE_CLIENT_SECRET }}"
     -e GOOGLE_REDIRECT_URI="${{ secrets.GOOGLE_REDIRECT_URI }}"
     -e FRONTEND_REDIRECT_URI="${{ secrets.FRONTEND_REDIRECT_URI }}"
+    -e JWT_SECRET="${{ secrets.JWT_SECRET }}"
 
   FRONTEND_ENV: >-
     -e NODE_ENV="production"

Makefile

@@ -22,6 +22,10 @@ start:
 start-d:
 	docker-compose up -d
 
+# Run tests for backend
+backend-test:
+	docker-compose exec backend uv run pytest . -v
+
 # Stop all services
 stop:
 	docker-compose down
@@ -102,4 +106,4 @@ db-truncate:
 
 # Show running containers
 ps:
-	docker-compose ps
+	docker-compose ps

backend/alembic/env.py

@@ -26,12 +26,12 @@
 
 if all([POSTGRES_USER, POSTGRES_PASSWORD, POSTGRES_DB]):
     database_url = f"postgresql://{POSTGRES_USER}:{POSTGRES_PASSWORD}@{POSTGRES_HOST}:{POSTGRES_PORT}/{POSTGRES_DB}"
-    config.set_main_option("sqlalchemy.url", database_url)
+    config.set_main_option("sqlalchemy.url", database_url.replace("%", "%%"))
 else:
     # Fallback: if individual vars are missing, try the full DATABASE_URL (e.g., from Heroku, Render, Railway)
     fallback_url = os.getenv("DATABASE_URL")
     if fallback_url:
-        config.set_main_option("sqlalchemy.url", fallback_url)
+        config.set_main_option("sqlalchemy.url", fallback_url.replace("%", "%%"))
 
 # Logging setup
 if config.config_file_name is not None:

security_incident_report.md

@@ -0,0 +1,48 @@
+# Security Incident Report
+**Date:** January 31, 2026
+**Project:** TaimakoAI
+**Severity:** Critical
+**Status:** Resolved (Monitoring Required)
+
+## Executive Summary
+On January 31, 2026, during routine maintenance, a **Critical Remote Code Execution (RCE)** vulnerability was detected in the frontend application. The vulnerability allowed unauthorized actors to execute system commands on the server. The attack vector was identified as a known security flaw in **Next.js 16.0.3**. Immediate remediation was performed by patching the software and restricting network configurations.
+
+## 1. Incident Details
+- **Component:** `taimako_frontend` (Next.js Application)
+- **Vulnerability Type:** Remote Code Execution (RCE) via Deserialization (CVE-2025-55182 / CVE-2025-66478)
+- **Affected Version:** Next.js `16.0.3`
+- **Detected:** January 31, 2026, 17:21 PM (local time) based on 502 Bad Gateway investigation.
+
+## 2. Root Cause Analysis
+The application was running an outdated version of Next.js (`16.0.3`) which contained a critical vulnerability in the React Server Components (RSC) payload handling.
+- **Mechanism:** Attackers sent maliciously crafted HTTP requests that the server deserialized, resulting in arbitrary shell command execution.
+- **Exploitation:** Logs confirmed active exploitation where attackers ran commands to list directories and print environment variables.
+
+## 3. Detection & Evidence
+The incident was discovered while investigating `502 Bad Gateway` errors. Review of the Docker logs (`docker logs taimako_frontend`) revealed:
+- **Abnormal Error Dumps**: `NEXT_REDIRECT` errors containing output of system commands.
+- **Command Execution**:
+    - `ls -la /var/www/.env*` (Attempting to locate secret files)
+    - `id`, `uname` (System reconnaissance)
+    - `base64` verification logic.
+- **Environment Leak**: Error stack traces displayed the contents of environment variables, including configuration keys.
+
+## 4. Resolution & Mitigation
+The following corrective actions were taken immediately:
+1.  **Software Patch**: Upgraded `next` dependency from `16.0.3` to `^16.0.7` (Current installed: `16.1.6`).
+2.  **Configuration Hardening**:
+    - Refactored Backend configuration to enforce **Strict CORS** policies in production.
+    - Centralized middleware management.
+3.  **Secret Rotation (Required User Action)**:
+    - Initiated rotation protocol for `POSTGRES_PASSWORD`, `JWT_SECRET`, and `GOOGLE_CLIENT_SECRET`.
+
+## 5. Impact Assessment
+- **Data Confidentiality**: **High Risk**. Environment variables were exposed in logs. Secrets must be assumed compromised.
+- **Data Integrity**: **Medium Risk**. Attackers had shell access, but no evidence of database deletion was found in the limited log window.
+- **Availability**: **High Impact**. The attack caused the frontend service to crash repeatedly (502 errors).
+
+## 6. Recommendations & Next Steps
+1.  **Immediate**: Complete the rotation of all production secrets (Database, JWT, API Keys).
+2.  **Deployment**: Re-deploy all services with the patched Docker images.
+3.  **Monitoring**: Monitor logs for the next 48 hours for any "NEXT_REDIRECT" anomalies or suspicious IP activity.
+4.  **Process**: Implement a dependency scanning tool (e.g., Dependabot or Snyk) to catch upstream vulnerabilities earlier.