[Security] MEDIUM: 7 issue(s) found in node_hub #49

New issue

Closed

opened 2026-05-14 23:23:32 +00:00 by Mark · 1 comment

Mark commented

2026-05-14 23:23:32 +00:00

Owner

Security Scan Results for `node_hub`

Severity: MEDIUM
Findings: 7

1. docker_root_user

Details: Dockerfile does not set a non-root USER — container runs as root
File: frontend/Dockerfile

2. docker_root_user

Details: Dockerfile does not set a non-root USER — container runs as root
File: launcher/Dockerfile

3. docker_root_user

Details: Dockerfile does not set a non-root USER — container runs as root
File: examples/apps/dockerfile-example/Dockerfile

4. auth_flaw

Details: Potential security issue (insecure_random) in launcher/index.js
File: launcher/index.js
Pattern: insecure_random

5. auth_flaw

Details: Potential security issue (insecure_random) in launcher/core/NodeAppLauncher.js
File: launcher/core/NodeAppLauncher.js
Pattern: insecure_random

6. auth_flaw

Details: Potential security issue (insecure_random) in launcher/core/AppMetadataManager.js
File: launcher/core/AppMetadataManager.js
Pattern: insecure_random

7. auth_flaw

Details: Potential security issue (insecure_random) in launcher/test/AppValidator.test.js
File: launcher/test/AppValidator.test.js
Pattern: insecure_random

This issue was auto-generated by the security sweep cron job.

## Security Scan Results for `node_hub` **Severity:** MEDIUM **Findings:** 7 ### 1. docker_root_user - **Details:** Dockerfile does not set a non-root USER — container runs as root - **File:** `frontend/Dockerfile` ### 2. docker_root_user - **Details:** Dockerfile does not set a non-root USER — container runs as root - **File:** `launcher/Dockerfile` ### 3. docker_root_user - **Details:** Dockerfile does not set a non-root USER — container runs as root - **File:** `examples/apps/dockerfile-example/Dockerfile` ### 4. auth_flaw - **Details:** Potential security issue (insecure_random) in launcher/index.js - **File:** `launcher/index.js` - **Pattern:** `insecure_random` ### 5. auth_flaw - **Details:** Potential security issue (insecure_random) in launcher/core/NodeAppLauncher.js - **File:** `launcher/core/NodeAppLauncher.js` - **Pattern:** `insecure_random` ### 6. auth_flaw - **Details:** Potential security issue (insecure_random) in launcher/core/AppMetadataManager.js - **File:** `launcher/core/AppMetadataManager.js` - **Pattern:** `insecure_random` ### 7. auth_flaw - **Details:** Potential security issue (insecure_random) in launcher/test/AppValidator.test.js - **File:** `launcher/test/AppValidator.test.js` - **Pattern:** `insecure_random` --- *This issue was auto-generated by the security sweep cron job.*

Mark added the

blocked:needs-decision

label

2026-05-15 11:43:47 +00:00

Mark commented

2026-05-15 13:37:04 +00:00

Author

Owner

Bug filed at #51 for the Docker root user issue (3 Dockerfiles). The scanner also flagged .venv/which is vendored code (false positive). Closing security issue.

Mark closed this issue

2026-05-15 13:37:04 +00:00