Repository navigation
Conversation
T6 — architecture-overview.md: - Sandbox: honest "new Function() with limited scope" wording; note T3 as planned - Rate limiter: note in-memory/per-instance limitation; note T4 as planned - SSRF: reference lib/security/ssrf.ts and provenance-aware exemption - Contributing: replace shipped items (SSRF, testing) with actual open items (T3, T4) - Dev setup: remove "(when available)" from pnpm test comment T7 — next.config.mjs: - Remove typescript.ignoreBuildErrors — tsc --noEmit passes clean (0 errors)
…19) T6 — architecture-overview.md: - Sandbox: honest "new Function() with limited scope" wording; note T3 as planned - Rate limiter: note in-memory/per-instance limitation; note T4 as planned - SSRF: reference lib/security/ssrf.ts and provenance-aware exemption - Contributing: replace shipped items (SSRF, testing) with actual open items (T3, T4) - Dev setup: remove "(when available)" from pnpm test comment T7 — next.config.mjs: - Remove typescript.ignoreBuildErrors — tsc --noEmit passes clean (0 errors)
Adds UpstashRateLimitStore implementing the existing RateLimitStore interface using a Redis sorted-set sliding window (ZADD + ZREMRANGEBYSCORE + ZRANGE pipeline). The execute-workflow route now picks the store via createUpstashStore(): uses Upstash when UPSTASH_REDIS_REST_URL and UPSTASH_REDIS_REST_TOKEN are set, falls back to MemoryRateLimitStore otherwise (CI, local dev without Redis). No changes to RateLimiter or existing rate-limit tests — only the store changes. 7 new tests covering pipeline commands, timestamp parsing, NaN filtering, null zrange handling, and RateLimiter integration. deps: @upstash/redis (REST client, no native binaries)
Adds Tutorial 04 covering the Redis sorted-set sliding-window adapter (UpstashRateLimitStore). Explains why in-memory limiting fails in serverless (per-instance counters), the ZADD/ZREMRANGEBYSCORE/ZRANGE pipeline, graceful env-var fallback, and the mock-in-tests pattern. Includes attack trees for multi-instance bypass and residual IP-rotation gap, plus 5 hands-on labs. Updates tutorial series index and implementation status to reflect T4 shipped and Tutorial 04 draft-complete.
makeMockRedis now returns { redis, calls } so tests access the calls
array directly instead of casting redis.pipeline() to a type that
doesn't overlap with Upstash's Pipeline<[]>.
Code (2 commits): - UpstashRateLimitStore — Redis sorted-set sliding window, 4-command pipeline, createUpstashStore() env-var factory - Route wired to pick Redis when env vars present, fall back to in-memory - jest.config.js updated to transform @upstash/redis (ESM) - Route test mocks the store module to stay hermetic - 7 new tests, 536 total passing Tutorial 04 — full 8-section doc covering: why in-memory fails in serverless, the sorted-set algorithm, multi-instance attack trees, interface-first design payoff, graceful-fallback trade-off, and 5 hands-on labs including the "break the uniqueness invariant" exercise.
Publishes "The Bug That Made My Encryption Instantly Useless" — a security case study of the getEncryptionKey() ephemeral-key bug: generateKey() was called on every invocation, producing a fresh key each time, making every ciphertext immediately unrecoverable. Covers the bug mechanism, why AES-GCM fails silently on key mismatch, the generate-once/cache/persist fix, the round-trip test that catches it, and the honest XSS limitation of a client-held key. - lib/blog/blog-data.ts: add metadata (slug, SEO, category: Security) - components/blog/articles/encryption-bug-aes-gcm-ephemeral-key.tsx: full article - components/blog/blog-content.tsx: register EncryptionBugContent in contentMap
- 05-implementation-status.md: mark T6/T7 ✅ Done (PR #19), T4 durable rate limiter ✅ shipped (PR #20); update test count 503→536, suites 25→27; advance branch baseline to 71c7d34 - README.md: add AI Security Tutorials row in Documentation section linking to docs/AI-Security/ and topflow.dev/blog (SEO cross-link) - docs/AI-Security/osv-scanner/README.md: replace Blocker column with Published column containing topflow.dev/blog URLs for tutorials 01/02/04/05; fix stale "03 and 04 blocked" note → only 03 blocked
…torial cross-links - preventing-ssrf-attacks-ai-workflows: rewrote with real ssrf.ts code, provenance-aware exemption explanation, DNS-rebinding honest limitation, GitHub link, Tutorial 01 cross-link; fixed inaccurate "allowlist" claim to reflect actual blocklist implementation - five-layers-of-security-owasp-top-10: A03 now mentions AES-256-GCM at rest with XSS limitation; rate limiting updated to reference UpstashRateLimitStore/pluggable store interface; A10 adds provenance-aware exemption; GitHub links and Tutorial 01/02/04 cross-links added - ciso-to-fullstack-developer: fix "10 node types" → "12"; add GitHub + topflow.dev/blog CTA - gdpr-compliance-by-design: add GitHub link to conclusion CTA - open-source-security-transparency: add GitHub link to conclusion - why-i-built-topflow-without-a-database: add GitHub link referencing encryption.ts
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
This branch was successfully deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
authentication-tag failure, the three-tier fix (memory cache → localStorage persist → importKey), round-trip test pattern, and the honest XSS limitation of client-held keys
"allowlist" claim
provenance-aware exemption; inline GitHub links to ssrf.ts, encryption.ts, rate-limit.ts; Tutorial 01/02/04 cross-links
why-i-built-topflow-without-a-database; fixed "10 node types" → "12"
Test plan