FarmaFinder/docs/security/2026-07-22-security-audit-report.md

FarmaFinder Security Audit Report

Audit date: 2026-07-22 Scope: repository source, configuration, environment files present on disk, Docker Compose files, Git history, Node lockfiles, and Python dependency declarations. Status: Not ready for an unrestricted production deployment.

Executive summary

The most urgent risks are configuration and access-control issues, not evidence of a secret committed to Git:

1. Local ignored .env files contain credential-shaped production values. The values must be treated as exposed if they were ever copied to a server, shared, or used in a public environment. Rotate the Expo access token and VAPID private key immediately, and rotate any database, session, n8n, or webhook credentials that may have shared the same deployment.
2. Production Docker Compose has known-secret fallbacks such as change-me-in-production, change-me, and pip-secret. A deployment can therefore start with predictable credentials when variables are missing.
3. The parapharmacy API exposes product create, bulk upsert, update, delete, and scraper-trigger endpoints without authentication. This is a direct integrity and availability risk.
4. The backend silently falls back to a hard-coded session secret. A missing secret must fail closed in production.
5. The verified npm audit reports 79 advisories in the workspace, including 3 critical and 13 high. The most important direct production-adjacent findings include vulnerable OpenTelemetry packages, bcrypt/tar transitive issues, and the vulnerable ws/brace-expansion chains. The frontend test toolchain includes a critical Vitest advisory; it must not be exposed as a server in any environment.

Findings

F-01 — Secrets present in local environment files

Severity: Critical Evidence: apps/backend/.env and apps/parapharmacy-api/.env exist locally and are ignored by Git. The backend file contains a non-empty Expo access token and VAPID private key; it also contains database/session/ingest credential fields. Values are intentionally not reproduced here.

Impact: Push credentials, session signing, database access, or workflow ingestion may be compromised. A VAPID private key can impersonate the application for web push; an Expo token can send notifications through the project account.

Action: Rotate the Expo token and VAPID key now. Rotate all non-development credentials in those files. Review CI, deployment hosts, shell history, password managers, and logs for copies. Keep secrets in the deployment secret store only.

F-02 — Predictable production secret fallbacks

Severity: Critical Evidence: docker-compose.yml:12,34,41,89,137,141,147,176,178 uses defaults including change-me-in-production, change-me, and a derived PostgreSQL URL. apps/backend/server.js:83-85 falls back to farma-clic-secret-key-change-in-production. apps/pip-platform/src/infrastructure/config/settings.py:16,24,26 contains default database, broker, and JWT credentials. The PIP Compose files also default JWT_SECRET_KEY at apps/pip-platform/docker-compose.yml:13 and docker-compose.runtime.yml:13.

Impact: Missing environment injection can enable session forgery, JWT forgery, database access, or n8n takeover.

Action: Remove secret defaults. Add startup validation that rejects NODE_ENV=production/production deployments when required secrets are absent or match known placeholders. Use ${VAR:?VAR must be set} in Compose for required values.

F-03 — Unauthenticated parapharmacy write/delete/scrape APIs

Severity: Critical Evidence: apps/parapharmacy-api/src/routes/products.js:280-320,340-390 exposes bulk write, update, and delete routes without auth. apps/parapharmacy-api/src/routes/scraper.js:7-24 exposes a scraper trigger without auth. apps/parapharmacy-api/src/server.js:55-70 applies only global CORS, JSON parsing, logging, and rate limiting.

Impact: An unauthenticated caller can poison or delete the catalog, trigger expensive Puppeteer scraping, and cause resource exhaustion.

Action: Protect write/delete/scrape routes with a dedicated ingestion/admin API key or service-to-service authentication. Apply a strict body/item limit and a separate low-rate limiter to scraper execution. Return generic errors without echoing scraper exception messages.

F-04 — Hard-coded backend session secret fallback

Severity: High Evidence: apps/backend/server.js:83-85 uses a fixed fallback secret. The session cookie is HTTP-only and SameSite=Lax (:87-91), which is good, but secure is opt-in at COOKIE_SECURE=true.

Impact: Anyone who knows the repository can forge sessions when the deployment omits SESSION_SECRET; if COOKIE_SECURE is omitted in HTTPS production, cookies may be sent over an accidental HTTP path.

Action: Fail startup when production lacks a strong SESSION_SECRET; force secure cookies in production and set app.set('trust proxy', ...) only to the known proxy topology.

F-05 — Public infrastructure ports and unauthenticated observability/admin surfaces

Severity: High Evidence: docker-compose.yml:29-30,66-67,75-76,86-89,102-103,122-123,131-132 publishes backend, frontend, exporters, parapharmacy API, MongoDB, and n8n ports. Swagger is mounted at /api/docs in apps/parapharmacy-api/src/server.js:64-69 without an environment guard.

Impact: Databases, exporters, n8n, and internal APIs may be reachable from the host network or internet. Swagger reveals mutation endpoints and operational details.

Action: Bind internal services to the Docker network or loopback only. Publish only the reverse proxy/frontend. Restrict n8n and Swagger to an authenticated admin network or disable them in production.

F-06 — Verified npm dependency advisories

Severity: Critical/High/Moderate by package and exposure Evidence: npm audit --json completed with network access on 2026-07-22.

Lockfile / scope	Critical	High	Moderate	Low	Total
Workspace root	3	13	60	3	79
Backend	1	11	41	3	56
Frontend	1	3	18	0	22
Parapharmacy API	0	2	0	1	3
Scraper	0	1	0	0	1

Notable verified chains include:

• backend: @opentelemetry/auto-instrumentations-node high-severity Prometheus exporter crash advisory; bcrypt through @mapbox/node-pre-gyp/tar; vulnerable ws and uuid transitive chains;
• frontend: critical vitest advisory when its UI server is exposed, plus vulnerable Vite/esbuild/Rollup and Grafana Faro/OpenTelemetry chains;
• parapharmacy API: fast-uri, brace-expansion, and body-parser advisories;
• scraper: brace-expansion high-severity DoS advisory.

Action: Apply targeted non-breaking patches first where available, then upgrade major-version families in isolated branches with tests. Do not use npm audit fix --force blindly; the audit indicates major-version changes for several fixes.

F-07 — Dependency hygiene and likely-unused candidates

Severity: Medium (maintenance/security surface) Evidence: A static repository scan found direct dependencies with no source import/reference outside manifests/lockfiles:

• backend: barcode-detector, @opentelemetry/exporter-logs-otlp-grpc, @opentelemetry/sdk-logs, @opentelemetry/sdk-trace-base;
• frontend: @grafana/faro-web-sdk;
• mobile: expo-dev-client, expo-linking, react-native-screens, react-native-worklets (some may be required by Expo/native autolinking);
• parapharmacy API: jest, supertest (test tooling is declared but no tests were found in that package).

This scan is not proof of unused status because Expo, native autolinking, configuration, and instrumentation can consume packages indirectly. Confirm each candidate with package-manager dependency tracing and a clean build before removal. No package was removed during this audit.

F-08 — Build/runtime supply-chain hygiene

Severity: High Evidence: docker-compose.yml:22,57,73,84,95,120,129,169 uses mutable :latest image tags. apps/parapharmacy-api/Dockerfile uses npm install --omit=dev instead of npm ci; apps/backend/Dockerfile uses npm ci.

Impact: Rebuilds are not reproducible and can silently pull changed or compromised images/dependency resolutions.

Action: Pin images by version and digest, use lockfile-enforced npm ci for every Node image, and add image/dependency scanning to CI.

F-09 — Mobile/API keys and telemetry endpoints need restriction

Severity: Medium Evidence: apps/frontend-mobile/google-services.json:18 contains a Firebase API key. This type of key is normally public, but must be restricted by package/bundle identity and API scope in Google Cloud/Firebase. Mobile and frontend env examples point telemetry at public or host endpoints.

Action: Verify Firebase key restrictions, avoid treating public client configuration as a secret, and enforce collector authentication/rate limits so telemetry endpoints cannot be abused.

Positive controls observed

• Git status was clean before this audit.
• .gitignore excludes .env, dependency directories, build output, and Android signing material.
• Git history inspection found environment examples and placeholder values, but no tracked actual .env file or the local Expo/VAPID values.
• Backend uses parameterized SQL for the inspected user/session paths, bcrypt password hashing, HTTP-only cookies, admin middleware, and route-specific rate limiting.
• Production backend and frontend use container builds, and backend uses npm ci --omit=dev.

Verification and limitations

• Source/configuration and Git-history checks were read-only.
• Online npm audit was executed with network access on 2026-07-22; advisory counts are a point-in-time result and should be rerun in CI.
• No production host, running container, database, secret manager, cloud account, or external firewall was inspected.
• No Python lockfile exists for apps/pip-platform; the Python audit therefore covered declarations and defaults, not resolved CVEs. Add a lockfile and run pip-audit/uv audit in CI.
• The audit did not prove that every endpoint is unreachable externally; exposure depends on deployment networking.

Recommended deployment decision

Do not deploy the current configuration publicly until F-01 through F-05 are addressed. Dependency upgrades and supply-chain pinning should follow immediately. The implementation sequence is documented in the hotfix plan.