What's pending across every project
15 open · sorted by priority then due-date
Filtered by tag security clear
blocker
urgent
Revoke exposed GitHub PAT shared in chat session
RoadIntelix
· roadintelix
· by Prajith
from the conversationprajith: [shared GitHub PAT in chat to clone private repo]\nclaude: Please revoke this token immediately — GitHub Settings → Developer settings → Fine-grained tokens → delete it.
131d ago
06-18 04:24
06-18 04:24
todo
urgent
Rotate Razorpay webhook secret — 'hopewell' is guessable
The RAZORPAY_SECRET_WEBHOOK value in /opt/ocpp/.env on the production VM is literally 'hopewell' — a common English word, effectively no protection. HMAC verification against a guessable secret means anyone who learns the plaintext can forge webhook calls and credit any wallet.
Fix:
1. Razorpay Dashboard → Settings → Webhooks → regenerate a long random secret (32+ char base64).
2. Update /opt/ocpp/.env on the VM (SMTP_PASSWORD-style edit).
3. sudo systemctl restart ocpp.service.
4. Send a test webhook from Razorpay dashboard and confirm it verifies.
This is the single most impactful hardening we can do.
/opt/ocpp/.envinternal/handlers/wallet_handler.go:239-254↗ https://dashboard.razorpay.com/app/webhooks
Vajra Volt Mobile App
· vajra-mobile-app
· by saravanan@scrumclaw.ai
from the conversationclaude: RAZORPAY_SECRET_WEBHOOK=hopewell in .env is weak - anyone who guesses the plaintext can forge webhooks (i.e., forge topups). Regenerate a long random secret in the Razorpay dashboard and update .env, then restart the service. This is the single most impactful hardening you can do.
saravanan: put them in my project tracker - scrumclaw.ai
88d ago
07-31 02:51
07-31 02:51
todo
urgent
Close Cloud SQL to the internet: remove 0.0.0.0 authorized network and require SSL
Instance crypto-track-321e8b45 has a public IP (34.57.238.28), requireSsl=false (ALLOW_UNENCRYPTED_AND_ENCRYPTED), and an authorized network "for EV Connection" = 0.0.0.0 — effectively open to the internet with only the postgres password protecting it. Instance is shared with AdaptiveSAT, Vajra, CitrineOS, tracker. Coordinate with Vajra before removing the EV entry; prefer Cloud SQL connector/Auth Proxy for all clients.
gcloud sql instances describe crypto-track-321e8b45
CoinTrends.ai
· cointrends
· by saravanan@scrumclaw.ai
from the conversationsaravanan: what are the issues you identified in cointrends?
claude: The database is effectively open to the internet: public IP, SSL optional, authorized network 0.0.0.0.
saravanan: create cointrends in tracker and push these items there
10d ago
10-16 19:08
10-16 19:08
todo
urgent
Rotate the postgres superuser password and remove it from code
Password is committed/hardcoded in crypto538-core-service/config/production.yaml + staging.yaml, ml-core-service/main.py, and every CoinTrends_Python script (with the public DB IP). Rotation affects every service on the shared instance. Move to Secret Manager (db_password secret already exists) and read at runtime.
crypto538-core-service/config/production.yamlcrypto538-core-service/config/staging.yamlml-core-service/main.py::get_db_connectionCoinTrends_Python/*.py
CoinTrends.ai
· cointrends
· by saravanan@scrumclaw.ai
from the conversationsaravanan: what are the issues you identified in cointrends?
claude: The postgres superuser password is committed in several places and every service connects as that superuser.
saravanan: create cointrends in tracker and push these items there
10d ago
10-16 19:08
10-16 19:08
todo
urgent
Revoke the committed prod service-account keys and switch to keyless auth
prj-crypto538-prod-260529-*.json key files are in crypto538-core-service, ml-core-service and CoinTrends_Python. Disable/delete those keys in IAM, remove from repos (history too, or treat as burned), rely on Cloud Run service identity / Workload Identity Federation.
crypto538-core-service/prj-crypto538-prod-260529-9964278419d2.jsonml-core-service/prj-crypto538-prod-260529-c7d42674bd4d.json
CoinTrends.ai
· cointrends
· by saravanan@scrumclaw.ai
from the conversationsaravanan: what are the issues you identified in cointrends?
claude: Production service-account key JSONs are committed in two repos and CoinTrends_Python.
saravanan: create cointrends in tracker and push these items there
10d ago
10-16 19:08
10-16 19:08
todo
urgent
Rotate hardcoded API keys (CoinMarketCap, TAAPI, OpenAI) and web-service .env secrets; move to Secret Manager
Keys hardcoded in core main.go constants (per CODE_REVIEW.md #1). web-service .env / .env.staging / .env.production committed with TOKEN_SECRET_KEY, ENCRYPTION_KEY, Stripe keys etc. Rotate, then inject via Secret Manager env refs on Cloud Run.
crypto538-core-service/main.go:157-165crypto538-core-service/main.go:331crypto538-web-service/.envcrypto538-core-service/CODE_REVIEW.md
CoinTrends.ai
· cointrends
· by saravanan@scrumclaw.ai
from the conversationsaravanan: what are the issues you identified in cointrends?
claude: CoinMarketCap, TAAPI and OpenAI keys are hardcoded in main.go; web-service .env files hold JWT and Stripe secrets.
saravanan: create cointrends in tracker and push these items there
10d ago
10-16 19:08
10-16 19:08
todo
urgent
Lock down core service: require auth, especially /db/execStoredProc, /deletefile, /uploadfile, /purgeStageData, /insertdb
crypto538-core-service is deployed --allow-unauthenticated. Options: make it private (IAM invoker = web-service SA + Scheduler SA) and have the webapp go through web-service only; or add an API-key/OIDC check on admin/write routes. Ties to the item about the webapp calling core directly.
crypto538-core-service/main.go:486-532crypto538-core-service/cloudbuild.yaml
CoinTrends.ai
· cointrends
· by saravanan@scrumclaw.ai
from the conversationsaravanan: what are the issues you identified in cointrends?
claude: The core service needs no authentication, including /db/execStoredProc, /insertdb, /uploadfile, /deletefile.
saravanan: create cointrends in tracker and push these items there
10d ago
10-16 19:08
10-16 19:08
blocker
urgent
Lock down core-service /db/execStoredProc: public, no auth, runs any schema.function as postgres
The crypto538-core-service-production endpoint is reachable by anyone: Cloud Run ingress is "all" and allUsers has run.invoker. The handler (stored_proc.go handleExecStoredProc) has no authentication and no allowlist. It accepts any "schema.function" name plus arguments and runs it on the shared Cloud SQL instance as postgres, which is also used by AdaptiveSAT, Vajra and CitrineOS. That includes the dynamic-DDL routines (table_creation_package, tb_*_generator, sp_initialdata_generator). Not exploited or tested. Suggested fix: allowlist the procs actually used plus a shared-secret or IAM check, or remove the route if unused. Validate callers first, per the cleanup rule.
crypto538-core-service/stored_proc.go:135crypto538-core-service/main.go:494
CoinTrends.ai
· cointrends
· by saravanan@scrumclaw.ai
6d ago
10-20 12:44
10-20 12:44
todo
high
Change seeded CMS admin password — admin123 is in the migration file and the CMS is now public
VajraCMS went live at https://cms.vajravolt.com on 2026-09-07. The seed account created by VajraBackendGo/migrations/0033_cms_user.up.sql is admin@vajravolt.in / admin123 — the plaintext password is written in the migration, so anyone with repo access has working credentials to the production CMS.
Saravanan chose to defer this on the day. Not blocking anything, but it should not sit for long.
If there is no change-password UI yet, on the VM:
UPDATE "CMSUser" SET password_hash = crypt('NEW', gen_salt('bf',10)) WHERE email='admin@vajravolt.in';
(pgcrypto bcrypt matches what the CMS auth controller compares against)
Verify the old one stops working:
curl -s -o /dev/null -w '%{http_code}\n' -X POST https://cms-api.vajravolt.com/api/v1/auth/login \
-H 'Content-Type: application/json' -d '{"email":"admin@vajravolt.in","password":"admin123"}'
Expect 401.</body>
migrations/0033_cms_user.up.sql↗ https://cms.vajravolt.com
Vajra Volt Mobile App
· vajra-mobile-app
· by saravanan@scrumclaw.ai
from the conversationclaude: admin@vajravolt.in / admin123 is written in plaintext in migration 0033 and the CMS is now on the public internet — anyone with repo access has working credentials.
saravanan: no pwd change now -
claude: Noted — leaving it, tracked as open.
49d ago
09-07 22:20
09-07 22:20
todo
high
Create least-privilege DB users per service and a read-only analysis role
core-service, ml-core-service and web-service all connect as postgres superuser on a shared instance. Create e.g. cointrends_core (rw on CryptoTrack_Prod.dbo), cointrends_ml (read + prediction tables), cointrends_web (CryptoUserBilling_Prod), cointrends_ro (SELECT only, for analysis/Claude).
CoinTrends.ai
· cointrends
· by saravanan@scrumclaw.ai
from the conversationsaravanan: what are the issues you identified in cointrends?
claude: There's no read-only database role, and every service connects as the superuser.
saravanan: create cointrends in tracker and push these items there
10d ago
10-16 19:09
10-16 19:09
todo
high
Create a dedicated least-privilege DB user for ml-training before scheduling Batch training
Batch training currently connects as `postgres`, the admin of the shared Cloud SQL instance crypto-track-321e8b45, which other products also use. Before scheduling, create a user with access to only the CryptoTrack_Prod objects training needs: getcryptodata, cryptomaster, cryptopredictionslicemaster and updatetracking. Store its password in a new secret and point batch/*.json at it.
HopewellPartners/ml-training batch/*.json#83-#87
CoinTrends.ai
· cointrends
· by saravanan@scrumclaw.ai
7d ago
10-20 02:16
10-20 02:16
todo
Rate-limit / IP-allowlist /webhooks/payment endpoint
The webhook endpoint currently accepts any POST from anywhere. HMAC signature check is the only defense — cryptographically sound, but each invalid request still triggers signature compute + JSON parse + DB lookup, so it's a cheap DoS vector.
Two things worth adding (nginx-level is easiest):
1. Restrict source IPs to Razorpay's published webhook IPs (they publish a list): allow only those in the nginx server block for /webhooks/*.
2. Rate-limit /webhooks/* at nginx (limit_req_zone). Even a modest 20 rps burst limit stops volumetric noise.
Doesn't change functionality, just hardens.
internal/routes/routes.go:161-163internal/handlers/wallet_handler.go:239-303/etc/nginx/sites-available/vajraev
Vajra Volt Mobile App
· vajra-mobile-app
· by saravanan@scrumclaw.ai
88d ago
07-31 02:51
07-31 02:51
todo
Route the webapp through web-service only (stop calling core-service directly)
crypto538-webapp uses REACT_APP_COIN_DATA_BASE_URL pointing at the public core-service Cloud Run URL, bypassing web-service auth/plan checks. Needed before core-service can be made private.
crypto538-webapp/.env.production::REACT_APP_COIN_DATA_BASE_URL
CoinTrends.ai
· cointrends
· by saravanan@scrumclaw.ai
from the conversationsaravanan: what are the issues you identified in cointrends?
claude: The webapp calls the core service directly, bypassing the web service's authentication layer.
saravanan: create cointrends in tracker and push these items there
10d ago
10-16 19:09
10-16 19:09
todo
Restrict write access to gs://nlp_ml_files — ML service unpickles models with weights_only=False
ml-core-service torch.load(..., weights_only=False) and np.load(allow_pickle=True) on files from GCS: anyone who can write to that bucket can execute code in the ML service. Limit bucket writers to the training job identity; consider safetensors / weights-only state_dict.
ml-core-service/main.py::predict
CoinTrends.ai
· cointrends
· by saravanan@scrumclaw.ai
from the conversationsaravanan: what are the issues you identified in cointrends?
claude: The ML service unpickles model files from GCS (weights_only=False); bucket write access = code execution.
saravanan: create cointrends in tracker and push these items there
10d ago
10-16 19:09
10-16 19:09
decision
Keep CoinTrends_Python (training code) outside git until secrets are stripped
The folder holds the DB password, public DB IP and an SA key in every script. Revisit after the secret-rotation items are done.
CoinTrends.ai
· cointrends
· by saravanan@scrumclaw.ai
from the conversationsaravanan: right now - let it sit outside of the repo - due to the secrets it contains.
claude: Recorded; it stays out of the repos for now.
10d ago
10-16 19:10
10-16 19:10