3 Commits

Author	SHA1	Message	Date
Diego Rodrigues de Sa e Souza	5f0cf313a5	fix(security): redact public Firebase Web key from windsurf spec; doc SHA-256 cache-key rationale (#2894) ... Two security-scanning findings on release/v3.8.6: - Secret-scanning alert 7 (google_api_key): the windsurf login-fix design spec embedded the literal public Firebase Web API key on two lines. Firebase Web API keys are non-sensitive by design (they identify the project; access is gated by Firebase Security Rules + key restrictions), but the literal trips secret scanning. Redacted to a placeholder; the embedded default still goes through resolvePublicCred per rule #11. - Code-scanning alert 261 (js/insufficient-password-hash): tokenCacheKey() uses SHA-256 to derive an in-memory cache key from the session token, not for password-at-rest storage. Added a comment documenting why CWE-916 KDFs do not apply (false positive).	2026-05-29 08:42:58 -03:00
yuna amelia	dd10b4b94c	docs(plan): Phase 1 windsurf login hotfix implementation plan ... 10 tasks covering: - TDD assertions for flowType + 410 Gone responses - Provider switch to import_token - Route handler retiring authorize/start-callback-server/poll-callback - OAuthModal UI override - i18n sync - Verification + PR steps	2026-05-29 12:31:39 +08:00
yuna amelia	dbe7b62cbe	docs(oauth): add Windsurf login fix design (Phase 1 hotfix + Phase 2 Firebase OAuth) ... Two-phase plan to fix the broken Windsurf OAuth flow: - Phase 1: drop the dead app.devin.ai/editor/signin PKCE path, promote import-token from windsurf.com/show-auth-token as the primary path - Phase 2: port Firebase OAuth + RegisterUser flow from fendoushaonian/WindSurf-gRPC-API for full browser-based automation Spec only - no code changes yet.	2026-05-29 12:28:20 +08:00