[comp] Production Deploy

[github-actions]

This is an automated pull request to release the candidate branch into production, which will trigger a deployment.
It was created by the [Production PR] action.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Preview	Comments	Updated (UTC)
app (staging)	Building			Nov 7, 2025 10:24pm
portal (staging)	Ready	Preview	Comment	Nov 7, 2025 10:24pm

[CLAassistant]

Thank you for your submission! We really appreciate it. Like many open source projects, we ask that you sign our Contributor License Agreement before we can accept your contribution.
_{You have signed the CLA already but the status is still pending? Let us recheck it.}

[comp-ai-code-review]

🔒 Comp AI - Security Review

🟡 Risk Level: MEDIUM

1 low-severity npm issue (ai@5.0.0) plus hardcoded API token and secret-handling issues found in EmptyState.tsx.

---

📦 Dependency Vulnerabilities

🟢 NPM Packages (LOW)

Risk Score: 2/10 | Summary: 1 low CVE found

Package	Version	CVE	Severity	CVSS	Summary	Fixed In
ai	5.0.0	GHSA-rwvc-j5jr-mgvh	LOW	N/A	Vercel’s AI SDK's filetype whitelists can be bypassed when uploading files	5.0.52

---

🛡️ Code Security Analysis

View 1 file(s) with issues

🟡 apps/app/src/app/(app)/[orgId]/cloud-tests/components/EmptyState.tsx (MEDIUM Risk)

#	Issue	Risk Level
1	Hardcoded API token in logo URLs	MEDIUM
2	Exposed token in client bundle (public)	MEDIUM
3	Credentials stored in client state (in-memory)	MEDIUM
4	Console.error may log sensitive info	MEDIUM
5	Server error payloads shown via toast (info leak)	MEDIUM
6	External image requests can leak token via Referer	MEDIUM
7	No format validation for pasted service account JSON	MEDIUM
8	Secret inputs sent directly from client network calls	MEDIUM

Recommendations:

1. Remove hardcoded tokens from client-side assets. Do not embed tokens in image URLs. Serve these assets from your own backend or use truly public (non-secret) keys only.
2. Avoid embedding any secret or private token in client bundles. Move sensitive tokens to server-side configuration and proxy asset requests through your backend where possible.
3. Do not persist secrets longer than necessary in UI state. Minimize the lifetime in memory (e.g., clear credentials immediately after use or success) and avoid storing in persistent client storage (localStorage/sessionStorage).
4. Avoid logging raw error objects or server responses with console.error. Log only necessary, non-sensitive information in client logs; send detailed logs to server-side telemetry with appropriate access controls and redaction.
5. Do not show raw server error payloads to users. Instead display generic user-friendly messages (e.g., 'Unable to validate credentials') and surface detailed errors only in server-side logs for debugging.
6. Remove tokens from query parameters on external resources. Token-bearing URLs are exposed in network logs, browser history, and referer headers. If a third-party asset requires a token, host the asset yourself or proxy the request through your backend.
7. Validate pasted service-account JSON client-side before sending: check it is valid JSON and optionally validate required fields/schema and length. Also perform server-side schema validation and enforce strict limits on size and content.
8. Ensure secrets are transmitted to your backend over TLS to an authenticated endpoint and avoid direct client-to-third-party transmission of credentials. Prefer a server-side flow for credential validation/connection that exchanges short-lived tokens and does not expose secrets to third parties.

---

💡 Recommendations

View 3 recommendation(s)

1. Upgrade package ai from 5.0.0 to >= 5.0.52 in package.json/lockfile to address GHSA-rwvc-j5jr-mgvh.
2. Remove hardcoded API token(s) from apps/app/src/app/(app)/[orgId]/cloud-tests/components/EmptyState.tsx — do not embed secrets in image URLs or JSX; replace with non-secret asset URLs and ensure tokens are never included in client-visible strings.
3. Validate and sanitize pasted service-account JSON in the component (try JSON.parse, enforce required fields and max size), avoid persisting credentials in component state (clear immediately after use: set to null/undefined) and stop sending raw secret inputs directly in client-originating third‑party requests.

---

Powered by Comp AI - AI that handles compliance for you. Reviewed Nov 7, 2025

[claudfuen]

🎉 This PR is included in version 1.57.0 🎉

The release is available on GitHub release

Your semantic-release bot 📦🚀