[Programcode]

Summary

Time-boxed source audit of DebateLab, following the Cloudflare security-audit skill. Application code is unchanged. Nothing was sent to production, staging, Stripe, or AI providers, and target code was not executed.

The report is SECURITY-AUDIT.md. Ranked result:

• Medium: discount promo codes return before user_promos is written or redemptions_count is incremented. Checkout then sets allow_promotion_codes: true. The report now includes the SQL and Checkout change that records the cap and sends one promo_ id.
• Medium: keepalive_events and keepalive_heartbeat have TO anon policies and GRANT ALL to anon. The publishable key can insert and read monitor rows and overwrite the heartbeat.
• Low: share returns thrown PostgREST text. create-portal returns Stripe's error message.
• Not assigned: import-source checks DNS and then fetches the name again. The report includes a pinned dial and an egress-proxy version. The fetch was not run.

The second pass also read every edge-function auth gate, SECURITY DEFINER search_path assignments, storage policies in source, XSS sinks, collaboration membership checks, AI session quota, vercel.json CSP, public/sw.js, and npm audit --package-lock-only (0 advisories). No critical or high issue was confirmed. The remaining gap is listed in the report.

Test plan

• Read the severity table at the top of SECURITY-AUDIT.md.
• Check finding 1 against redeem_promo_code_atomic and create-checkout, including the fix SQL.
• Check finding 4 against 20260820070000_reconcile_prod_only_objects.sql.
• Do not merge this PR as a product change. It is an audit note only.

  

[coderabbitai]

Important

Draft PR not reviewed

Draft PRs are not automatically reviewed by default.

• Trigger a manual review

To automatically review draft PRs, update your CodeRabbit configuration:

reviews:
  auto_review:
    drafts: true

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Note

🎁 Summarized by CodeRabbit Free

Your organization is on the Free plan. CodeRabbit will generate a high-level summary and a walkthrough for each pull request. For a comprehensive line-by-line review, please upgrade your subscription to CodeRabbit Essentials by visiting https://app.coderabbit.ai/settings/billing.

_{Comment @coderabbitai help to get the list of available commands.}

[Programcode]

Superseded by #230, which fixed all five findings; the migrations and functions are deployed to prod.