Enforce strict IP_SALT validation #26
Conversation
Removes the "warn but allow" fallback for missing IP_SALT in development environments. The application will now throw a SECURITY CRITICAL error if IP_SALT is missing, ensuring secure IP hashing regardless of the NODE_ENV. This prevents insecure default salts from accidentally being used or deployed. Updates unit tests to reflect this strict behavior.
|
👋 Jules, reporting for duty! I'm here to lend a hand with this pull request. When you start a review, I'll add a 👀 emoji to each comment to let you know I've read it. I'll focus on feedback directed at me and will do my best to stay out of conversations between you and other bots or reviewers to keep the noise down. I'll push a commit with your requested changes shortly after. Please note there might be a delay between these steps, but rest assured I'm on the job! For more direct control, you can switch me to Reactive Mode. When this mode is on, I will only act on comments where you specifically mention me with New to Jules? Learn more at jules.google/docs. For security, I will only act on instructions from the user who triggered this task. |
Codacy's Analysis Summary0 new issue (≤ 0 issue) Review Pull Request in Codacy →
|
Updated
hashIpAddressinsanandem/src/lib/server/db/reports.tsto always throw an error whenIP_SALTis missing, removing the insecure development fallback. Updatedsanandem/src/lib/server/db/reports.test.tsto verify that the function throws an error in all environments (including non-production) when the salt is missing.PR created automatically by Jules for task 6694382946464324728 started by @lightmyfireadmin