Security hardening: root middleware auth backstop, CORS for v1 API, npm CVE fixes

[Copilot]

Addresses remaining open findings from the March 2026 codebase security audit. The three items below were the only findings not yet remediated.

H-2 — Root middleware.ts (auth backstop)

No centralized auth enforcement existed; every route had to self-protect. Added middleware.ts at project root:

• Page routes (/app/*, /admin/*, /onboarding/*, /workspace-recovery/*): redirects unauthenticated users to /auth/signin?next=<path>
• API routes (/api/*): returns 401 for unauthenticated requests; explicit allowlist covers public endpoints (health, auth, billing webhook, SSO, SCIM, trust-packet, cron, debug)
• Session refresh: uses @supabase/ssr createServerClient + getUser() on every request — prevents session spoofing via stale JWTs
• x-verified-ip header: prefers x-real-ip/cf-connecting-ip over user-controlled x-forwarded-for, so downstream rate limiters can trust it
• CORS preflight: handles OPTIONS /api/v1/* returning 204 directly in middleware

// Public API allowlist (no session required)
const PUBLIC_API_PREFIXES = [
  '/api/health', '/api/auth', '/api/billing/webhook',
  '/api/sso', '/api/trust-packet', '/api/scim', '/api/debug', ...
];

L-6 — CORS headers for /api/v1/ routes

The external REST API had no Access-Control-* headers, blocking browser-based integrators. Added via next.config.ts:

{
  source: '/api/v1/:path*',
  headers: [
    { key: 'Access-Control-Allow-Origin', value: '*' },
    { key: 'Access-Control-Allow-Methods', value: 'GET, POST, PUT, PATCH, DELETE, OPTIONS' },
    { key: 'Access-Control-Allow-Headers', value: 'Authorization, Content-Type, X-Requested-With' },
    { key: 'Access-Control-Max-Age', value: '86400' },
  ],
}

Wildcard origin is intentional: per the CORS spec it prevents the browser from sending cookies, so integrators must authenticate via ****** (Supabase JWT). No CSRF exposure.

npm CVEs — npm audit fix

Reduced vulnerability count from 20 → 17. Remaining 17 are all in dev-only testing tools (backstopjs, pa11y, pa11y-ci, puppeteer) that cannot be resolved without major-version breaking changes to the test toolchain; no production impact.

---

💡 You can make Copilot smarter by setting up custom instructions, customizing its development environment and configuring Model Context Protocol (MCP) servers. Learn more Copilot coding agent tips in the docs.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
forma-os	Error		Mar 13, 2026 10:45pm
formaos	Error		Mar 13, 2026 10:45pm