Repository navigation
fix: apply audit "this week" items (data safety, auth gating, CI gates) - #39
Merged
Merged
Conversation
Backend - toggleBookmark no longer deletes tracked applications that have status progress or notes; JobCard shows a "manage in dashboard" hint instead - Status transitions: rejected/accepted can be undone, saved -> interviewing allowed; dashboard dropdown only offers legal transitions and disables items while a mutation is in flight - jobNotificationDeliveries.by_userId index; deleteAccount uses it - deleteOldJobs uses by_status index, bounded batches with self-reschedule, deletes delivery rows for removed jobs, deletes expired outdated jobs before marking new ones - User notification emails are skipped when NEXT_PUBLIC_SITE_URL is unset instead of sending broken unsubscribe links - Resend testMode defaults to true unless RESEND_TEST_MODE is explicitly false - Re-subscribing keeps the existing unsubscribeToken Frontend - Post Job opens the auth modal for anonymous users instead of the form Config / CI - Security headers: HSTS, X-Frame-Options, X-Content-Type-Options, Referrer-Policy, Permissions-Policy, CSP frame-ancestors 'none' - Replace the never-failing `bun pm scan` with `bun run audit:deps` (bun audit at high+, three unpatched transitive advisories ignored) - bun audit fix: 61 advisories resolved incl. Clerk middleware bypass (@clerk/nextjs 6.37.1 -> 6.39.3) - Collapse pr-checks.yml into ci.yml: one quality job, build, security, dependency review; drop fake Node matrix, Supabase secrets, comment jobs; add bun cache; bump checkout v5, setup-bun v2, codecov v5, dependency-review v4
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
![greptile-apps[bot]](https://avatars.githubusercontent.com/in/867647?s=60&v=4){kind=small}
There was a problem hiding this comment.
Your trial has ended. Reactivate Greptile to resume code reviews.
This branch was successfully deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Items 7-15 from the "this week" list in the 2026-09-12 repo audit.
Backend
savedwith no notes; otherwise it returnstracked: trueand the list card shows a "Manage in dashboard" hint.rejectedandacceptedcan be undone,saved -> interviewingis allowed. The dashboard dropdown only renders legal transitions and disables items during a mutation.jobNotificationDeliveries.by_userIdindex, used bydeleteAccount(was a full table scan).deleteOldJobscron uses theby_statusindex, runs in bounded batches of 100 with self-reschedule, deletes delivery rows for removed jobs, and deletes expired outdated jobs before marking new ones.NEXT_PUBLIC_SITE_URLinstead of emitting "NEXT_PUBLIC_SITE_URL is not configured." as the unsubscribe link.testModedefaults to true unlessRESEND_TEST_MODEis explicitlyfalse.unsubscribeToken, so links already in inboxes stay valid.Frontend
Config / CI
X-Frame-Options: DENY,X-Content-Type-Options,Referrer-Policy,Permissions-Policy, CSPframe-ancestors 'none'. A full CSP is deferred until the Clerk/Convex/Vercel allowlist is tested.bun pm scan || echo(never failed, no scanner configured) replaced withbun run audit:deps=bun audit --audit-level=highignoring three transitive advisories with no patched release in range (image-size via fumadocs-core, js-cookie via @clerk/shared).bun audit fix: 61 advisories resolved, including the critical Clerk middleware route-protection bypass (@clerk/nextjs6.37.1 -> 6.39.3). Lockfile only.pr-checks.ymlfolded intoci.yml: quality (lint, tsc, tests, codecov), build, security audit, dependency review withoutcontinue-on-error. Dropped the fake Node 18/20 matrix, Supabase secrets,developbranch, and PR comment jobs. Added bun package cache. Actions bumped to checkout v5, setup-bun v2, codecov v5, dependency-review v4.Prod config
Prod Convex had no
RESEND_TEST_MODE. With the new safe default that would have put prod email into test mode, soRESEND_TEST_MODE=falsewas set on prod on 2026-09-13 before merge. Verified withconvex env get --prod.Verification
bun run lintcleanbunx tsc --noEmitcleanbun run test:ci96/96 passing (3 new tests), coverage above thresholdsbun run buildgreenbun run audit:depsno vulnerabilities at high+