[Security] MEDIUM: 8 issue(s) found in msp_c2 #29

New issue

Closed

opened 2026-05-14 23:23:15 +00:00 by Mark · 1 comment

Mark commented

2026-05-14 23:23:15 +00:00

Owner

Security Scan Results for `msp_c2`

Severity: MEDIUM
Findings: 8

1. docker_root_user

Details: Dockerfile does not set a non-root USER — container runs as root
File: frontend/Dockerfile.prod

2. docker_root_user

Details: Dockerfile does not set a non-root USER — container runs as root
File: frontend/Dockerfile

3. auth_flaw

Details: Potential security issue (cors_wildcard) in backend/.venv/lib/python3.12/site-packages/starlette/middleware/cors.py
File: backend/.venv/lib/python3.12/site-packages/starlette/middleware/cors.py
Pattern: cors_wildcard

4. auth_flaw

Details: Potential security issue (insecure_random) in frontend/dist/assets/index-a55ea8cd.js
File: frontend/dist/assets/index-a55ea8cd.js
Pattern: insecure_random

5. auth_flaw

Details: Potential security issue (insecure_random) in .venv/lib/python3.13/site-packages/basedpyright/dist/pyright.js
File: .venv/lib/python3.13/site-packages/basedpyright/dist/pyright.js
Pattern: insecure_random

6. auth_flaw

Details: Potential security issue (insecure_random) in .venv/lib/python3.13/site-packages/basedpyright/dist/pyright-langserver.js
File: .venv/lib/python3.13/site-packages/basedpyright/dist/pyright-langserver.js
Pattern: insecure_random

7. auth_flaw

Details: Potential security issue (cors_wildcard) in .venv/lib/python3.13/site-packages/blackd/middlewares.py
File: .venv/lib/python3.13/site-packages/blackd/middlewares.py
Pattern: cors_wildcard

8. auth_flaw

Details: Potential security issue (insecure_random) in .venv/lib/python3.13/site-packages/pyright/dist/dist/vendor.js
File: .venv/lib/python3.13/site-packages/pyright/dist/dist/vendor.js
Pattern: insecure_random

This issue was auto-generated by the security sweep cron job.

## Security Scan Results for `msp_c2` **Severity:** MEDIUM **Findings:** 8 ### 1. docker_root_user - **Details:** Dockerfile does not set a non-root USER — container runs as root - **File:** `frontend/Dockerfile.prod` ### 2. docker_root_user - **Details:** Dockerfile does not set a non-root USER — container runs as root - **File:** `frontend/Dockerfile` ### 3. auth_flaw - **Details:** Potential security issue (cors_wildcard) in backend/.venv/lib/python3.12/site-packages/starlette/middleware/cors.py - **File:** `backend/.venv/lib/python3.12/site-packages/starlette/middleware/cors.py` - **Pattern:** `cors_wildcard` ### 4. auth_flaw - **Details:** Potential security issue (insecure_random) in frontend/dist/assets/index-a55ea8cd.js - **File:** `frontend/dist/assets/index-a55ea8cd.js` - **Pattern:** `insecure_random` ### 5. auth_flaw - **Details:** Potential security issue (insecure_random) in .venv/lib/python3.13/site-packages/basedpyright/dist/pyright.js - **File:** `.venv/lib/python3.13/site-packages/basedpyright/dist/pyright.js` - **Pattern:** `insecure_random` ### 6. auth_flaw - **Details:** Potential security issue (insecure_random) in .venv/lib/python3.13/site-packages/basedpyright/dist/pyright-langserver.js - **File:** `.venv/lib/python3.13/site-packages/basedpyright/dist/pyright-langserver.js` - **Pattern:** `insecure_random` ### 7. auth_flaw - **Details:** Potential security issue (cors_wildcard) in .venv/lib/python3.13/site-packages/blackd/middlewares.py - **File:** `.venv/lib/python3.13/site-packages/blackd/middlewares.py` - **Pattern:** `cors_wildcard` ### 8. auth_flaw - **Details:** Potential security issue (insecure_random) in .venv/lib/python3.13/site-packages/pyright/dist/dist/vendor.js - **File:** `.venv/lib/python3.13/site-packages/pyright/dist/dist/vendor.js` - **Pattern:** `insecure_random` --- *This issue was auto-generated by the security sweep cron job.*

Mark added the

blocked:needs-decision

label

2026-05-15 11:16:20 +00:00

Mark commented

2026-05-15 13:37:04 +00:00

Author

Owner

Bug filed at #30 for the Docker root user issue (2 Dockerfiles). The CORS wildcard finding was in .venv/ (vendored code — false positive). Closing security issue.

Mark closed this issue

2026-05-15 13:37:04 +00:00