# Security Analysis Report

Date: 2026-03-02
Repository: /Users/bedas/Developer/GitHub/dcm
Scope: backend FastAPI API and worker, frontend React app, Docker runtime configuration, and local `.env` posture.

## Executive Verdict

Current state is **not production ready**.

- Blocking code-level issues exist and should be fixed before production exposure.
- Additional user-dependent deployment risks are present in `.env` and runtime defaults. Per request, these are listed as MUST KNOW and not marked as blocking.

## Method and Coverage

Performed a read-only static review of:

- API auth, authorization, upload and file handling, routing, settings, and worker pipelines.
- Frontend auth token handling and preview rendering behavior.
- Docker and environment defaults affecting network and secret posture.
- Existing security-focused tests and basic frontend API tests.

## Blocking Security Issues (Code-Level)

### 1) High - No abuse controls on expensive authenticated endpoints

Impact:

- Any authenticated user can repeatedly trigger high-cost operations (upload processing, OCR, summarization, routing, indexing), causing queue saturation, infrastructure exhaustion, and external provider cost abuse.

Exploit path:

- Repeated `POST /api/v1/documents/upload`
- Repeated `POST /api/v1/documents/{document_id}/reprocess`

Evidence:

- Upload endpoint has size limits but no rate/volume quota checks: `backend/app/api/routes_documents.py:665-985`.
- Reprocess endpoint has no rate/cooldown checks: `backend/app/api/routes_documents.py:958-985`.
- A Redis rate limiter exists but is currently used for markdown export only: `backend/app/services/rate_limiter.py:16-42` and `backend/app/api/routes_documents.py:100-120`.

Remediation:

- Add per-user and per-IP rate limiting to upload and reprocess endpoints.
- Add per-user daily/rolling quotas (documents, bytes, reprocess calls).
- Add queue depth backpressure and reject or defer requests when saturated.
- Add alerting for anomalous request and job-enqueue rates.

### 2) Medium - API docs and schema are exposed by default

Impact:

- Unauthenticated endpoint discovery and contract reconnaissance are easier (`/docs`, `/redoc`, `/openapi.json`).

Exploit path:

- Remote probing of public API metadata when service is internet-reachable.

Evidence:

- FastAPI app is created with default docs behavior and no production gating: `backend/app/main.py:37`.

Remediation:

- Disable docs in production (`docs_url=None`, `redoc_url=None`, `openapi_url=None`) or
- Restrict these routes at reverse proxy / edge to trusted admin networks.

### 3) Medium - Bearer token stored in browser sessionStorage

Impact:

- Any successful XSS on the frontend origin can steal bearer tokens and replay them.

Exploit path:

- Malicious script execution on app origin reads `sessionStorage` and exfiltrates `Authorization` token.

Evidence:

- Token persisted in sessionStorage and injected into `Authorization` header: `frontend/src/lib/api.ts:39-42`, `frontend/src/lib/api.ts:61-67`, `frontend/src/lib/api.ts:84-95`, `frontend/src/lib/api.ts:103-112`.

Remediation:

- Prefer HttpOnly Secure SameSite cookies for session auth, plus CSRF protection.
- If bearer-in-JS remains, enforce strict CSP, remove inline script execution, and add strong dependency hygiene.

## MUST KNOW (User-Dependent, Non-Blocking Per Request)

### A) Current `.env` is development-oriented and exposed beyond localhost

Why this matters:

- Service currently binds to all interfaces and uses development settings, which is unsafe for direct internet exposure.

Evidence:

- `APP_ENV=development`: `.env:1`
- `HOST_BIND_IP=0.0.0.0`: `.env:2`
- `PUBLIC_BASE_URL=http://...`: `.env:33`
- Broad CORS for localhost and LAN host: `.env:34`

Action:

- Set production values (`APP_ENV=production`, HTTPS base URL, strict CORS, host binding behind hardened reverse proxy).

### B) Provider SSRF protections are disabled in active env

Why this matters:

- Allowing HTTP, private network targets, and empty allowlist can permit unsafe outbound model-provider endpoints.

Evidence:

- Active `.env`: `PROVIDER_BASE_URL_ALLOW_HTTP=true`, `PROVIDER_BASE_URL_ALLOW_PRIVATE_NETWORK=true`, `PROVIDER_BASE_URL_ALLOWLIST=[]` at `.env:29-31`.
- Compose defaults are permissive if env is not hardened: `docker-compose.yml:55-57`, `docker-compose.yml:100-102`.

Action:

- For production set: `ALLOW_HTTP=false`, `ALLOW_PRIVATE_NETWORK=false`, explicit host allowlist.

### C) Sensitive model and payload text logging is enabled in active env

Why this matters:

- Prompt/response and payload text may include confidential document content and credentials, increasing breach impact.

Evidence:

- Active `.env` enables both flags: `.env:22-23`.
- Code defaults are safer (`false`): `backend/app/core/config.py:60-61`.

Action:

- Disable in production unless explicitly required for short-term diagnostics.
- Apply strict retention and access controls if temporarily enabled.

### D) Redis transport/auth hardening depends on env mode and URL

Why this matters:

- Current env uses `redis://` with auto security/tls mode; this is not suitable for untrusted network paths.

Evidence:

- Active `.env`: `REDIS_URL=redis://...`, `REDIS_SECURITY_MODE=auto`, `REDIS_TLS_MODE=auto` at `.env:10-12`.
- Strict checks are triggered by production mode when auto is used: `backend/app/core/config.py:157-171`.

Action:

- In production use `rediss://`, `REDIS_SECURITY_MODE=strict`, `REDIS_TLS_MODE=required`.

### E) Frontend container runs a development server

Why this matters:

- Vite dev server is not intended as a hardened production serving layer.

Evidence:

- Frontend container command runs `npm run dev`: `frontend/Dockerfile:20`.
- `dev` script maps to Vite dev mode: `frontend/package.json:7`.

Action:

- Build static assets and serve behind a production-grade web server/reverse proxy.

### F) Login throttle IP identity depends on proxy topology

Why this matters:

- Throttle identity uses `request.client.host`; if a proxy masks client IPs, lockout behavior may be inaccurate.

Evidence:

- IP extraction uses transport client host directly: `backend/app/api/routes_auth.py:32-35`.

Action:

- Ensure trusted proxy configuration preserves real client IP semantics before internet deployment.

## Validation Commands and Outcomes

Preflight:

- `command -v git` -> passed (`/usr/bin/git`)
- `git rev-parse --is-inside-work-tree` -> passed (`true`)
- `git status --short` -> clean before work

Security-related backend tests:

- `PYTHONDONTWRITEBYTECODE=1 /Users/bedas/Developer/Python/global_venv/bin/python backend/tests/test_security_controls.py` -> passed (34 tests)
- `PYTHONDONTWRITEBYTECODE=1 /Users/bedas/Developer/Python/global_venv/bin/python backend/tests/test_upload_request_size_middleware.py` -> passed (3 tests)
- `PYTHONDONTWRITEBYTECODE=1 /Users/bedas/Developer/Python/global_venv/bin/python backend/tests/test_app_settings_provider_resilience.py` -> passed (6 tests)
- `PYTHONDONTWRITEBYTECODE=1 /Users/bedas/Developer/Python/global_venv/bin/python backend/tests/test_processing_log_retention_settings.py` -> passed (5 tests)

Frontend auth-client test:

- `npm run test` (in `frontend/`) -> passed

Note:

- `pytest` is not installed in `/Users/bedas/Developer/Python/global_venv/bin/python`, so direct module execution via `unittest` entrypoints was used for backend test files.

## Residual Risk and Coverage Limits

- No dynamic penetration test was run against a live deployed stack.
- No dependency CVE audit (`pip-audit`, `npm audit`) was run in this turn.
- Reverse proxy, firewall, TLS termination, and cloud/network policy were not reviewed.