mirror of https://github.com/diegosouzapw/OmniRoute.git synced 2026-08-02 05:12:11 +03:00

Files

diegosouzapw 1cbbc33f20 feat(security): FASE-01 to FASE-06 security hardening

FASE-01 — Security Hardening:
- Remove hardcoded JWT_SECRET and API_KEY_SECRET fallbacks (fail-fast)
- Create secretsValidator.js with enforceSecrets() at startup
- Create inputSanitizer.js (prompt injection + PII detection)
- Integrate sanitizer in chat.js handler pipeline
- Add structured logging to silent catch blocks in proxy.js
- Remove .passthrough() from Zod updateSettingsSchema
- Remove insecure npm fs dependency
- Update .env.example with generation commands

FASE-02 — CI/CD & Tests:
- Create ci.yml workflow (lint, build, test, coverage, e2e)
- Fix test scripts (test now runs actual tests)
- Add test:unit, test:security, test:coverage (c8), test:all
- Add security rules to ESLint (no-eval, no-implied-eval, no-new-func)

FASE-03 — Architecture:
- Create settingsCache.js (eliminate self-fetch anti-pattern)
- Create domain/types.js and domain/responses.js

FASE-04 — Observability:
- Create correlationId.js (AsyncLocalStorage tracing)
- Create circuitBreaker.js (full state machine + registry)
- Create requestTimeout.js (per-provider timeouts)

FASE-05 — Code Quality:
- Create structuredLogger.js (JSON/human-readable logging)

FASE-06 — Documentation:
- Update SECURITY.md with hardening practices
- Create CONTRIBUTING.md with dev setup and PR checklist

Tests: 52/52 pass (23 security + 15 observability + 14 integration)

2026-02-14 18:21:47 -03:00

1.8 KiB

Raw Blame History

Security Policy

Reporting Vulnerabilities

If you discover a security vulnerability in OmniRoute, please report it responsibly:

DO NOT open a public GitHub issue
Email: security@omniroute.dev (or use GitHub Security Advisories)
Include: description, reproduction steps, and potential impact

Response Timeline

Stage	Target
Acknowledgment	48 hours
Triage & Assessment	5 business days
Patch Release	14 business days (critical)

Supported Versions

Version	Support Status
0.2.x	✅ Active
< 0.2.0	❌ Unsupported

Security Best Practices

Required Environment Variables

All secrets must be set before starting the server. The server will fail fast if they are missing or weak.

# Generate strong secrets:
JWT_SECRET=$(openssl rand -base64 48)
API_KEY_SECRET=$(openssl rand -hex 32)
STORAGE_ENCRYPTION_KEY=$(openssl rand -hex 32)

Input Protection

OmniRoute includes built-in protection against:

Prompt injection — Detects system override, role hijack, delimiter injection, and DAN/jailbreak patterns
PII leakage — Optional detection and redaction of emails, CPF/CNPJ, credit cards, and phone numbers

Configure in .env:

INPUT_SANITIZER_ENABLED=true
INPUT_SANITIZER_MODE=block    # warn | block | redact
PII_REDACTION_ENABLED=true

Docker Security

Use non-root user in production
Mount secrets as read-only volumes
Never copy .env files into Docker images
Use .dockerignore to exclude sensitive files

Dependencies

Run npm audit regularly
Keep dependencies updated
The project uses husky + lint-staged for pre-commit checks

1.8 KiB Raw Blame History