Remove GitHub access tokens from userData to prevent Firestore storage (Issue #275)

[anshul23102]

Summary

Removes GitHub OAuth access tokens from userData objects to prevent accidental storage in Firestore database, violating secret management principles.

Problem

GitHub OAuth tokens included in userData object could potentially be stored in Firestore if code changes occur. This violates security principles:

• Tokens should never be persisted to databases
• Increases attack surface from database breaches
• Violates OWASP and PCI-DSS guidelines
• Makes token rotation impossible
• No audit trail for token access

Solution

Removed githubAccessToken from userData object:

• Tokens kept in memory only during session
• userData object no longer contains credentials
• Added security comments explaining token handling
• Ensures tokens never reach Firestore

Changes

• Modified src/lib/firebase.js signInWithGitHub function
• Removed githubAccessToken from userData construction
• Added security documentation comments

Security Benefits

Prevents Credential Exposure:

• Tokens never included in stored user objects
• Memory-only approach prevents database leaks
• No risk of credential exposure from backups

Reduces Attack Surface:

• Database breach cannot expose tokens
• Tokens cannot be recovered from backups
• Limits damage from potential Firestore access

Testing Strategy

• Verify login still works with token in memory
• Check userData doesn't contain token
• Verify API calls still use token properly
• Test token is cleared on logout
• Verify no credentials in Firestore

Files Modified

• Modified: src/lib/firebase.js (removed token from userData)

Fixes #275

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
ranker-hub	Ready	Preview, Comment	Jun 4, 2026 10:55am

[anshul23102]

Please add relevant labels:

• type/security
• severity/high
• area/secrets
• nsoc
• gssoc26

These help with tracking and prioritization. Thank you!

[anshul23102]

Suggested Labels

For maintainer review and categorization:

• security (Security vulnerability fix)
• backend (Firestore database)
• level:advanced (Advanced complexity)

Removes GitHub access tokens from Firestore to prevent token exposure and storage violations.