security

A security remediation workflow for Cognite Flows apps that both finds and fixes issues rather than only reporting them. It is meant to run before shipping any feature that handles credentials, user input, or external data, and to be invoked for security fixes, hardening, or vulnerability remediation. An optional argument scopes the audit to a file or directory; with no argument it audits the whole app. Every step that finds a problem is expected to also fix it, and the steps are run in order.

The workflow begins by mapping the attack surface, reading entry and routing files (src/main.tsx, src/App.tsx), the Vite config, package.json, and any auth, login, token, or credential files, then identifying which routes are behind an auth guard and where external data enters or is written back. Subsequent steps each pair a search with a concrete fix: migrating any raw HTTP, WebSocket, axios, or fetch calls that target CDF-like hosts onto the official Cognite SDK (and removing custom Authorization or api-key headers, since the SDK handles auth); replacing hard-coded secrets with import.meta.env.VITE_* references, adding placeholders to .env.example, and ensuring .env and .env.local are gitignored; neutralizing dangerous DOM APIs by wrapping dangerouslySetInnerHTML with DOMPurify.sanitize() and rewriting eval, new Function, and string-argument setTimeout/setInterval.

Later steps close authentication and authorization gaps (every route showing CDF data must sit behind the Flows auth guard so useCogniteClient returns a non-null sdk, clients must use short-lived OIDC tokens rather than static API keys, and capability checks must happen server-side via CDF ACLs), with specific guidance for the Atlas chat integration: agentExternalId must not be built from user input, and tool execute functions must validate args before using them in queries. Input validation gaps are addressed by adding runtime validation (installing Zod if absent and using safeParse instead of type casts) for values arriving from forms, URL params, or query strings. Concrete grep commands and before/after code snippets are provided throughout to drive each fix.