[contursofran]

Summary

• keep the GitHub OAuth token on the server instead of returning it to browser code
• require authentication for repository procedures
• verify repository ownership before task, feature, and issue reads or writes
• stop production Prisma query logging
• update compatible dependencies and the CI dependency installation
• add Dependabot configuration and a security policy

Audit findings fixed

1. The auth endpoint returned the GitHub OAuth access token to the browser. The token has repo scope.
2. Task, feature, and issue procedures accepted record IDs without checking repository ownership.
3. Repository procedures did not consistently require an authenticated user.
4. Production enabled Prisma query logging.
5. Direct and compatible transitive dependencies contained known critical and high-severity vulnerabilities.

Dependency result

Before the changes, pnpm audit --prod reported 3 critical, 17 high, 25 moderate, and 6 low findings.

After the changes, it reports 0 critical, 5 high, 13 moderate, and 3 low findings.

The remaining high findings are in Next.js 12 and its PostCSS dependency. Removing them requires a separate major Next.js migration. This PR does not hide that remaining risk.

Verification

• pnpm run typecheck
• pnpm run lint (passes with 12 existing warnings)
• pnpm exec next build
• git diff --check
• full Git history scan for common secret files, private keys, GitHub tokens, and database URLs; no matching secret was found

Review note

The application still requests GitHub OAuth repo scope because it reads private repositories. This PR keeps that token server-side. A future GitHub App or fine-grained token design can reduce the permission scope further.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
github-dashboard	Ready	Preview	Aug 29, 2026 5:28pm