MineGeo/docs/security-review-2026-10-11.md

Security and bug review — 11 October 2026

Fixes

• Contributor tokens previously inherited the account's staff privileges and could issue other tokens or approve device pairing. Staff operations, token management, and pairing approval now require a verified account session and reject Authorization credentials. Upload and contribution token authentication remains supported.
• Multiplayer room creation was limited by a replaceable browser cookie. It now also has a durable account limit of 20 attempts per hour, preventing cookie resets from bypassing the limit.
• Oversized streamed JSON requests now stop reading and return HTTP 413 instead of HTTP 400. The existing two-MiB byte limit remains in place.
• Workflow's transitive devalue and nanoid dependencies are pinned to patched 5.9.4 and 5.1.16 releases through scoped npm overrides. Workflow remains at 5.2.0. The production dependency audit initially reported 14 affected packages through these dependency chains.

Verification and remaining scope

Regression tests cover rejected device credentials, verified session requirements, cookie rotation against the account limit, independent account limits, streamed request cancellation, the byte-limit boundary, UTF-8 JSON, and malformed JSON. Run npm test, npm run typecheck -- --incremental false, npm run build, and npm audit --omit=dev to reproduce the checks.

Final results: 123 tests passed; TypeScript and the production build passed; npm reported zero known production dependency vulnerabilities. Production deployment dpl_ArAsMvBHhSqVQSsy5G1yzZaXyvUL reached READY. Eleven safe HTTP checks confirmed token rejection for staff/credential endpoints, signed-out access rejection, oversized-body HTTP 413, malformed-JSON HTTP 400, and working health/docs pages. No production test records were created.

The live Supabase review found no public-schema application functions executable by anon or authenticated. Its RLS-enabled tables without policies are intentionally restricted to server access; adding permissive policies would weaken that restriction.

Supabase also flags disabled leaked-password protection. This setting requires Pro or above, so no billing or plan change was made. See Supabase password security.

This was a focused application and production-dependency review, not a complete penetration test or a guarantee that every bug has been found.

Patched upstream releases: devalue, nanoid.