mirror of
https://github.com/snapotter-hq/SnapOtter.git
synced 2026-08-03 07:46:42 +02:00
SnapOtter
4e64ee2779
Auth: login rate limit 30/min (was 500), global rate limit 1000/min (was unlimited), password/username max lengths on all Zod schemas, session invalidation on role change, API key legacy scan bounded to 100 keys. SVG: hardened regex sanitizer with CDATA stripping, XML entity decoding, set/animate/iframe/embed blocking, comprehensive data: URI blocking, use element external href blocking. 11 attack payload fixtures added. SSRF: fixed DNS rebinding TOCTOU by pinning resolved IPs via custom HTTP/HTTPS agents. Added 6to4 and NAT64 to blocked IPv6 ranges. Docker: capability dropping (cap_drop ALL + minimal cap_add), resource limits (4g/8g mem, 512/1024 pids), healthcheck timeout, password removed from startup banner, default password warning comments. Network: CSP and HSTS applied in all environments (not just production), stack traces removed from all error responses, internal paths stripped from error details, per-route rate limits on uploads (60/min) and URL fetches (200/hour). Files: exclusive temp file creation (O_EXCL), disk space circuit breaker, per-user storage quotas, settings payload 64KB size guard. Python sidecar: script name allowlist in dispatcher, minimal environment for subprocess spawns. Dependencies: fixed 6 production CVEs (drizzle-orm, fastify, fast-uri, @fastify/static, next, archiver/lodash). Pinned all GitHub Actions to SHA hashes. 114 security tests added. Full OWASP Top 10 penetration test matrix verified against production Docker container (30/30 pass after hardening).
73 lines
2.4 KiB
JSON
73 lines
2.4 KiB
JSON
{
|
|
"name": "snapotter",
|
|
"version": "1.16.0",
|
|
"private": true,
|
|
"packageManager": "pnpm@9.15.4",
|
|
"scripts": {
|
|
"dev": "turbo dev",
|
|
"docs:dev": "pnpm --filter @snapotter/docs docs:dev",
|
|
"build": "turbo build",
|
|
"lint": "turbo lint",
|
|
"lint:fix": "biome check --write .",
|
|
"clean": "turbo clean",
|
|
"typecheck": "turbo typecheck",
|
|
"test": "vitest run",
|
|
"test:watch": "vitest",
|
|
"test:unit": "vitest run --config vitest.config.ts tests/unit",
|
|
"test:integration": "vitest run --config vitest.config.ts tests/integration",
|
|
"test:coverage": "vitest run --coverage",
|
|
"test:ci": "vitest run --coverage --reporter=verbose",
|
|
"test:all": "vitest run --coverage && playwright test",
|
|
"test:e2e": "playwright test",
|
|
"test:e2e:ui": "playwright test --ui",
|
|
"test:e2e:landing": "playwright test --config playwright.landing.config.ts",
|
|
"test:e2e:docs": "playwright test --config playwright.docs.config.ts",
|
|
"test:e2e:analytics": "playwright test --config playwright.analytics-local.config.ts",
|
|
"test:docker": "docker compose -f docker/docker-compose.test.yml up --build --abort-on-container-exit",
|
|
"version:sync": "./scripts/sync-version.sh",
|
|
"release": "semantic-release",
|
|
"release:dry": "semantic-release --dry-run",
|
|
"prepare": "husky"
|
|
},
|
|
"lint-staged": {
|
|
"*.{ts,tsx,js,jsx,json}": [
|
|
"biome check --write --no-errors-on-unmatched"
|
|
]
|
|
},
|
|
"devDependencies": {
|
|
"@biomejs/biome": "^2.4.8",
|
|
"@playwright/test": "^1.58.2",
|
|
"@semantic-release/changelog": "^6.0.3",
|
|
"@semantic-release/commit-analyzer": "^13.0.1",
|
|
"@semantic-release/exec": "^7.1.0",
|
|
"@semantic-release/git": "^10.0.1",
|
|
"@semantic-release/github": "^12.0.6",
|
|
"@semantic-release/npm": "^13.1.5",
|
|
"@semantic-release/release-notes-generator": "^14.1.0",
|
|
"@testing-library/jest-dom": "^6.9.1",
|
|
"@testing-library/react": "^16.3.2",
|
|
"@testing-library/user-event": "^14.6.1",
|
|
"@types/adm-zip": "^0.5.8",
|
|
"@vitest/coverage-v8": "^3.2.4",
|
|
"adm-zip": "^0.5.17",
|
|
"husky": "^9.1.7",
|
|
"jsdom": "^29.0.1",
|
|
"lint-staged": "^16.4.0",
|
|
"semantic-release": "^25.0.3",
|
|
"turbo": "^2.4.0",
|
|
"typescript": "^5.7.0",
|
|
"vitest": "^3.0.0"
|
|
},
|
|
"license": "AGPL-3.0",
|
|
"pnpm": {
|
|
"overrides": {
|
|
"fast-uri": ">=3.1.2"
|
|
}
|
|
},
|
|
"dependencies": {
|
|
"@dnd-kit/core": "^6.3.1",
|
|
"@dnd-kit/sortable": "^10.0.0",
|
|
"@dnd-kit/utilities": "^3.2.2"
|
|
}
|
|
}
|