security: comprehensive frontend + backend + environment audit

CRITICAL fixes:
- Remove hardcoded Hardhat test private key fallback from quiz/claim
  and thesis/[id] routes (was: 0xac0974...ff80 as getEnv default)
- Now requires ARC_SETTLER_PRIVATE_KEY env var to be set

HIGH fixes:
- Add .env patterns to frontend/.gitignore (.env, .env.local,
  .env*.local, *.pem, *.key, credentials.json, service-account.json)
- Add webhook idempotency to Stripe webhook handler (checks existing
  status before processing to prevent double-activation on retries)

MEDIUM fixes:
- Add Stripe domains to CSP (js.stripe.com, crypto.stripe.com,
  api.stripe.com) for Crypto Onramp widget
- Add security headers: X-Frame-Options DENY, X-Content-Type-Options
  nosniff, Referrer-Policy, Permissions-Policy, HSTS

New files:
- SECURITY.md: Vulnerability reporting policy and security measures

Audit findings documented:
- 26 moderate npm vulnerabilities (all in @reown/appkit transitive deps)
- No real secrets in git history
- No NEXT_PUBLIC_ prefixed secrets
- All server-only env vars properly scoped to API routes

Author: chindris-mihai-alexandru

SECURITY.md

@@ -0,0 +1,78 @@
+# Security Policy
+
+## Reporting a Vulnerability
+
+If you discover a security vulnerability in Rosetta Alpha, please report it responsibly.
+
+**Do NOT open a public GitHub issue for security vulnerabilities.**
+
+Instead, please contact us via:
+
+- **Email:** security@rosetta-alpha.app (preferred)
+- **Discord:** DM @mihai on the project Discord
+
+### What to include
+
+- Description of the vulnerability
+- Steps to reproduce
+- Potential impact
+- Suggested fix (if any)
+
+### Response timeline
+
+- **Acknowledgment:** Within 24 hours
+- **Initial assessment:** Within 72 hours
+- **Resolution:** Depends on severity, typically within 7 days for critical issues
+
+## Scope
+
+The following are in scope for security reports:
+
+- Smart contracts (`contracts/src/`)
+- Frontend application (`frontend/src/`)
+- Backend API (`api/`)
+- Webhook handlers
+- Authentication and authorization
+- Payment processing (Stripe, x402)
+- Wallet integration
+
+## Out of Scope
+
+- Third-party services (Stripe, WalletConnect, Circle, Pinata)
+- Denial of service attacks
+- Social engineering
+- Issues requiring physical access to user devices
+
+## Security Measures
+
+### Smart Contracts
+
+- OpenZeppelin base contracts (Ownable, ReentrancyGuard, SafeERC20)
+- Foundry invariant fuzzing (15 tests, 256 runs each)
+- Slither static analysis
+- Manual security audit documented in `contracts/SECURITY_AUDIT.md`
+
+### Frontend
+
+- Content Security Policy (CSP) headers
+- CSRF protection via Next.js Origin check
+- Environment variable validation
+- Webhook signature verification (HMAC-SHA256, ECDSA)
+- Rate limiting on API routes
+
+### Backend
+
+- Input validation via Pydantic models
+- CORS configuration
+- Error handling without stack trace exposure
+
+### Payments
+
+- Stripe webhook signature verification
+- x402 payment verification with EIP-3009
+- Session key spending limits and expiry
+- No hardcoded private keys in source code
+
+## Acknowledgments
+
+We thank the security research community for helping improve Rosetta Alpha's security.

frontend/.gitignore

@@ -14,3 +14,12 @@ tests/screenshots/
 *.db
 tsconfig.tsbuildinfo
 revert_awc.py
+
+# Environment & secrets — NEVER commit these
+.env
+.env.local
+.env*.local
+*.pem
+*.key
+credentials.json
+service-account.json

frontend/next.config.mjs

@@ -12,6 +12,9 @@ const WC_FRAME_SRC = [
   'https://verify.walletconnect.org',
   'https://secure.walletconnect.com',
   'https://secure.walletconnect.org',
+  // Stripe Crypto Onramp iframe
+  'https://js.stripe.com',
+  'https://crypto.stripe.com',
 ].join(' ')
 
 const WC_CONNECT_SRC = [
@@ -44,21 +47,44 @@ const WC_CONNECT_SRC = [
   'https://keys.coinbase.com',
   'https://api.developer.coinbase.com',
   'https://wallet.coinbase.com',
+  // Stripe Crypto Onramp API
+  'https://api.stripe.com',
+  'https://crypto.stripe.com',
 ].join(' ')
 
 const securityHeaders = [
   {
     key: 'Content-Security-Policy',
     value: [
       `default-src 'self'`,
-      `script-src 'self' 'unsafe-inline' 'unsafe-eval'`,
+      `script-src 'self' 'unsafe-inline' 'unsafe-eval' https://js.stripe.com https://crypto-js.stripe.com`,
       `style-src 'self' 'unsafe-inline' https://fonts.googleapis.com`,
       `font-src 'self' https://fonts.gstatic.com https://fonts.reown.com`,
-      `img-src * 'self' data: blob:`,
+      `img-src * 'self' data: blob: https://*.stripe.com`,
       `connect-src 'self' ${WC_CONNECT_SRC}`,
       `frame-src 'self' ${WC_FRAME_SRC}`,
     ].join('; '),
   },
+  {
+    key: 'X-Frame-Options',
+    value: 'DENY',
+  },
+  {
+    key: 'X-Content-Type-Options',
+    value: 'nosniff',
+  },
+  {
+    key: 'Referrer-Policy',
+    value: 'strict-origin-when-cross-origin',
+  },
+  {
+    key: 'Permissions-Policy',
+    value: 'camera=(), microphone=(), geolocation=()',
+  },
+  {
+    key: 'Strict-Transport-Security',
+    value: 'max-age=63072000; includeSubDomains; preload',
+  },
   /**
    * Required for Base Smart Wallet / Coinbase passkey popups.
    * Must be a separate header — NOT a CSP directive.

frontend/src/app/api/crypto/onramp/webhook/route.ts

@@ -130,6 +130,20 @@ export async function POST(req: Request) {
   const metadata = session.metadata as Record<string, string> | undefined
   const transactionDetails = session.transaction_details as Record<string, unknown> | undefined
 
+  // Idempotency: skip if we already processed this exact status for this session
+  // Stripe retries webhooks for up to 72 hours — we must not double-process
+  const eventId = event.id as string | undefined
+  if (eventId) {
+    const existing = await prisma.onrampPurchase.findUnique({
+      where: { stripeSessionId: sessionId ?? '' },
+      select: { status: true },
+    }).catch(() => null)
+    if (existing?.status === status) {
+      console.log(`[webhook] Duplicate event ${eventId} for session ${sessionId} — skipping`)
+      return NextResponse.json({ success: true, received: true, duplicate: true }, { headers: NO_STORE_HEADERS })
+    }
+  }
+
   console.log(`[webhook] onramp_session.updated — id=${sessionId} status=${status}`)
 
   // Update the purchase record

frontend/src/app/api/quiz/claim/route.ts

@@ -53,7 +53,7 @@ export const POST = withX402(
     treasuryAddress: getEnv(process.env.ROSETTA_TREASURY_ADDRESS, '0x000000000000000000000000000000000000dEaD'),
     arcRpcUrl: process.env.NEXT_PUBLIC_ARC_RPC_URL!,
     usdcAddress: getEnv(process.env.NEXT_PUBLIC_USDC_ARC_ADDRESS, '0x3600000000000000000000000000000000000000'),
-    settlerPrivateKey: getEnv(process.env.ARC_SETTLER_PRIVATE_KEY, '0xac0974bec39a17e36ba4a6b4d238ff944bacb478cbed5efcae784d7bf4f2ff80'),
+    settlerPrivateKey: process.env.ARC_SETTLER_PRIVATE_KEY!,
   },
   async (req: Request) => {
     try {

frontend/src/app/api/thesis/[id]/route.ts

@@ -49,7 +49,7 @@ export const GET = withX402(
     treasuryAddress: getEnv(process.env.ROSETTA_TREASURY_ADDRESS, '0x000000000000000000000000000000000000dEaD'),
     arcRpcUrl: process.env.NEXT_PUBLIC_ARC_RPC_URL!,
     usdcAddress: getEnv(process.env.NEXT_PUBLIC_USDC_ARC_ADDRESS, '0x3600000000000000000000000000000000000000'),
-    settlerPrivateKey: getEnv(process.env.ARC_SETTLER_PRIVATE_KEY, '0xac0974bec39a17e36ba4a6b4d238ff944bacb478cbed5efcae784d7bf4f2ff80'),
+    settlerPrivateKey: process.env.ARC_SETTLER_PRIVATE_KEY!,
     // Thesis unlock is a demo read-gate: verify x402 proof, then unlock.
     // Quiz claims still perform on-chain settlement.
     settleOnChain: false,