fix: remove 'or True' bypass in AuthorizationMiddleware

[Joshua-Medvinsky]

Problem

The AuthorizationMiddleware contains or True in the signature verification condition, making it always truthy. Combined with the base AppTypeInterface.verify_request_signature() which returns True unconditionally, all POST requests to /api/apps/*/run bypass signature verification. An unauthenticated attacker can invoke any app's run endpoint directly.

Fix

Remove or True from the condition in authorization_middleware.py line 30. This restores the intended behavior: only requests with valid Discord or Slack signatures proceed to verification; other requests pass through without triggering the verification block.

Test Plan

• Existing test suite passes
• Requests without Discord/Slack signatures to /api/apps/*/run are no longer forced into the signature verification block
• Discord and Slack webhook requests with valid signatures still work correctly

Security Note

Severity: Critical — This allows unauthenticated invocation of any LLMStack app endpoint, potentially exposing LLM API keys, user data, and app outputs.

[vercel]

Someone is attempting to deploy a commit to the LLMStack Team on Vercel.

A member of the Team first needs to authorize it.

[failsafesecurity]

Hi maintainers 👋

This vulnerability was found by FailSafe — a top agentic cybersecurity company specializing in automated deep security analysis of AI/ML and agentic codebases.

We're reporting these initial findings as a social good contribution to help secure the open-source AI ecosystem. If you'd like us to perform a deeper, more comprehensive security scan of your project, we'd love to hear from you — reach out at joshua@getfailsafe.com.

Thanks for maintaining this project! 🙏

[failsafesecurity]

Hi! Friendly follow-up on this security fix. Happy to adjust the approach if you have concerns about backwards compatibility, tests, or scope. If you'd prefer a different disclosure channel such as private vulnerability reporting or a security contact, I can resubmit there.