@patronage/software-factory 1.0.0-alpha.3 → 1.0.0-alpha.31

package/dist/review-prompts/security/SKILL.md

@@ -51,6 +51,7 @@ Load only matching references:
 | Crypto and randomness | Weak hashes, predictable random values, static IVs, ECB mode, timing-unsafe compares, unsigned tokens, or custom crypto protect security-sensitive data. |
 | Abuse controls | Sensitive or expensive operations such as login, MFA, invites, exports, password reset, billing, email, SMS, or paid API calls lack meaningful rate, quota, replay, or idempotency controls. |
 | CI and workflows | Workflow changes let untrusted or caller-controlled code, text, artifacts, caches, or actions reach privileged execution, secrets, write tokens, releases, packages, deployments, or sensitive runners. |
+| Infrastructure exposure | An infrastructure declaration publishes a service to the internet without a declared authentication mechanism. In an Alchemy stack, a Worker declaring `workersDev: true`, a `domain`, or `routes` must also declare its guard — Cloudflare Access, an auth secret binding, or an equivalent check inside the Worker — or carry a written reason in the change for why it is public. |
 
 ## Severity
 

package/dist/review-prompts/security/references/javascript-typescript.md

@@ -22,6 +22,7 @@ Use this when reviewing JavaScript, TypeScript, Node, React, Next.js, or browser
 | Path traversal | `path.join(root, userPath)` without realpath containment, archive extraction by entry name | Normalize and resolve real paths, verify containment, generate server-side filenames |
 | Webhook forgery | State-changing webhook parses JSON before verifying signature or skips timestamp/replay checks | Verify raw body signature, timestamp freshness, replay/idempotency, and provider secret before side effects |
 | Secrets exposure | Secrets in client components, `NEXT_PUBLIC_*`, serialized props, logs, or error responses | Server-only reads, redacted logs, safe error messages, no hardcoded production fallback |
+| Public Worker without auth | Alchemy `Cloudflare.Worker` gains `workersDev: true`, a `domain`, or a `routes` entry while its handler enforces no identity check | Cloudflare Access on the Worker (`access` prop or an Access application destination), an auth secret binding the handler verifies, or a written reason in the change for why the Worker is public |
 
 ## False-Positive Controls