Zivvy
Zivvy

Production Readiness Report

Zivvy provides continuous readiness intelligence for high-stakes engineering teams.

REPOSITORYacme-dashboard
COMMIT2d8f3c1
GENERATED30 June 2026
Mitigation Required

Executive Summary

The repository has identified 20 total findings. One critical vulnerability must be addressed immediately before proceeding with production deployment.

error

Critical Blockers

1 critical vulnerability identified in core authentication logic require immediate hotfix.

warning

High Priority

2 findings require attention before scaling. These involve potential data exposure vectors.

analytics

Total Findings: 20

1 Critical, 2 High, 7 Medium, and 10 Low severity issues discovered across the codebase.

Core Dimensions

lock_openAuthenticationFAIL
admin_panel_settingsAuthorizationREVIEW
hubDependenciesPASS
cloud_doneInfrastructurePASS
keySecretsPASS
codeHeadersREVIEW
psychologyAI SecurityPASS
Current Readiness
72/ 100

Remediation Steps

+15Fix Critical Authentication Bypass
priority_high
+8Resolve 2 High priority findings
chevron_right
+5Address 7 Medium severity alerts
chevron_right

Risk Overview

Critical
1
High
2
Medium
7
Low
10

All Findings

20 issues across 4 severity levels — every finding from this scan is listed below.

Critical 1High 2Medium 7Low 10

Critical

1
Critical Finding

Potential JWT Authentication Bypass

lib/auth/jwt-verify.ts

psychology AI Explanation

The JWT verification logic uses a weak signature validation that can be bypassed if the 'alg' header is set to 'none'. This allows anyone to forge valid tokens.

Hotfix Recommendation

Explicitly whitelist supported algorithms and reject 'none' in the jose library.

lib/auth/jwt-verify.tsTypeScript
-const payload = decode(token);
+const payload = await jwtVerify(token, secret, { algorithms: ['HS256'] });

High

2
High Finding

Exposed Admin API Route Without Auth Middleware

app/api/admin/users/route.ts

Admin user listing endpoint is reachable without session validation or role checks.

Recommendation

Wrap the route with server-side auth middleware and enforce an admin role claim.

app/api/admin/users/route.tsTypeScript
-export async function GET() { return listUsers(); }
+export const GET = withAdminAuth(async () => listUsers());
High Finding

SQL Injection Risk in Dynamic Query Builder

lib/db/search.ts

User-supplied sort column is interpolated into SQL without an allowlist.

Recommendation

Map user input to a fixed set of column names before building the query.

lib/db/search.tsTypeScript
-const orderBy = `ORDER BY ${input.sort}`;
+const orderBy = `ORDER BY ${ALLOWED_SORT_COLUMNS[input.sort] ?? 'created_at'}`;

Medium

7
Medium Finding

Unsecured S3 Bucket CORS Policy

terraform/storage.tf

The asset storage bucket allows wildcards in AllowedOrigins, enabling cross-site data extraction from malicious domains.

terraform/storage.tfHCL
allowed_origins = ["*"] # Change to specific domain
Impacted Assets
  • • s3://acme-public-assets
  • • s3://acme-user-uploads-staging
Medium Finding

Missing Rate Limiting on Auth Endpoints

app/api/auth/login/route.ts

Login and password reset endpoints accept unlimited attempts from a single IP.

Recommendation

Add per-IP and per-account throttling with exponential backoff.

Medium Finding

Outdated Dependency with Known CVE

package.json

lodash@4.17.20 is vulnerable to prototype pollution in certain merge paths.

Recommendation

Upgrade lodash to 4.17.21 or replace merge usage with a safer utility.

Medium Finding

Session Cookie Missing Secure Flag

lib/session.ts

Session cookies are issued without Secure and SameSite=strict in production.

Recommendation

Set Secure, HttpOnly, and SameSite=strict on all auth cookies.

Medium Finding

Verbose Error Messages Leak Stack Traces

middleware/error-handler.ts

Unhandled exceptions return full stack traces to API clients in production.

Recommendation

Return a generic error ID to clients and log details server-side only.

Medium Finding

Missing Content-Security-Policy Header

middleware/security-headers.ts

Responses do not set CSP, increasing XSS blast radius for any injected script.

Recommendation

Add a restrictive CSP with nonce-based script loading for the app shell.

Medium Finding

Hardcoded Internal Service URL in Client Bundle

src/lib/analytics.ts

A staging internal API hostname is embedded in client-side code shipped to browsers.

Recommendation

Move internal URLs to server-only environment variables.

Low

10
Low Finding

Docker Container Running as Root

Dockerfile

The production image does not define a non-root USER for the Node process.

Recommendation

Add a dedicated app user and run the container as UID 10001.

Low Finding

Missing X-Frame-Options Header

middleware/security-headers.ts

Clickjacking protection header is not set on HTML responses.

Recommendation

Set X-Frame-Options: DENY or use frame-ancestors in CSP.

Low Finding

Console.log Statements in Production Code

src/lib/billing.ts

Debug logging of customer metadata remains in the production bundle.

Recommendation

Remove debug logs or guard them behind a development-only logger.

Low Finding

Unused Environment Variable in .env.example

.env.example

LEGACY_WEBHOOK_SECRET is documented but no longer referenced in the codebase.

Recommendation

Delete stale variables from .env.example to avoid misconfiguration.

Low Finding

Missing robots.txt Security Headers

public/robots.txt

Staging admin paths are not disallowed for crawlers.

Recommendation

Disallow /admin and /api in robots.txt for public deployments.

Low Finding

Test API Keys in Comments

scripts/seed.ts

Commented example keys resemble real credentials and may confuse reviewers.

Recommendation

Replace with obvious placeholders like sk_test_REPLACE_ME.

Low Finding

Unpinned npm Package Versions

package.json

Several dependencies use caret ranges without a lockfile integrity review cadence.

Recommendation

Pin critical security packages and enable automated dependency scanning.

Low Finding

Missing Health Check Endpoint

app/api/health/route.ts

Load balancer probes hit / which returns the full marketing page instead of a lightweight health check.

Recommendation

Expose GET /api/health returning 200 with dependency status only.

Low Finding

Stale Lockfile Entry

bun.lock

A transitive dependency entry references a package version no longer used in package.json.

Recommendation

Regenerate the lockfile and commit the cleaned result.

Low Finding

Missing Request ID in Logs

lib/logger.ts

Structured logs omit a correlation ID, making incident triage across services harder.

Recommendation

Generate x-request-id per request and include it in all log lines.

bolt

Critical Intelligence

Actionable Summary: While your overall architecture is modern, the Critical JWT vulnerability is a non-starter for production. An attacker can assume administrative privileges with zero effort.

Beyond the critical blocker, your 10 low-severity issues suggest some technical debt in Docker configuration—mostly unnecessary root privileges in non-critical workers. Fixing the top 3 (Critical + 2 High) will bring your Ship Score to a safe 85+.

Summary based on automated pattern matching against current SOC2 Type II standards.

Tech Stack Composition

FrameworkNext.js 16
IdentityClerk
DatabasePostgreSQL
PlatformVercel
AI EngineOpenAI
RuntimeDocker

Know exactly what
you’re shipping.

Continuous Security Automation

ZIVVY SECURITY OPS SYSTEM v0.0.9-beta