fix(security): harden saved-credential, proxy egress, and response-cap paths from the release audit

- Refuse session callers resolving saved service-account secrets on POST /api/auth/oauth/token
- Refuse a proxied hostname when any resolved record is blocked (the proxy re-resolves)
- Apply the response cap to every body, not only decoded ones (undici's http proxy wrapper ignores maxResponseSize)
- Bind workload-identity subjects to their owner at mint time
- Bound Databricks token/identity JSON reads; refuse single-slash https:/ in typed URLs; case-insensitive Dynatrace /api/vN strip
- Twilio recordings: stay on the Twilio API origin and bound fetch concurrency
- Firecrawl: count crawl maxDepth below the start URL; stop sending unused search sources
- sim-setup reset refuses when Docker is installed but unreachable
- Remove the dead requireDeployment branch from workflow access middleware; reuse requireMutableWorkflow; move a misplaced TSDoc
- Docs: CONTRIBUTING setup via sim-setup, sim-setup README, Helm read-only-root mounts, proxy and NO_PROXY behavior, GitLab CSV body limit

Author: waleedlatif1

.github/CONTRIBUTING.md

@@ -140,24 +140,22 @@ Using clear and consistent commit messages makes it easier for everyone to under
 
 To set up your local development environment:
 
-### Option 1: Using NPM Package (Simplest)
+### Option 1: Using the setup wizard (Simplest)
 
-The easiest way to run Sim locally is using our NPM package:
+The easiest way to run Sim locally is the `sim-setup` wizard:
 
 ```bash
-npx simstudio
+npx sim-setup
 ```
 
-After running this command, open [http://localhost:3000/](http://localhost:3000/) in your browser.
-
-#### Options
-
-- `-p, --port <port>`: Specify the port to run Sim on (default: 3000)
-- `--no-pull`: Skip pulling the latest Docker images
+The wizard checks Docker, ports, memory, and disk space, generates the required secrets, writes `.env` and a Docker Compose file into a new `sim` directory, starts the containers, runs database migrations, and waits for the health checks to pass. When it finishes, open [http://localhost:3000/](http://localhost:3000/) in your browser.
 
 #### Requirements
 
-- Docker must be installed and running on your machine
+- Node.js 20 or newer
+- Docker with the Compose plugin, installed and running
+
+See the [`sim-setup` README](../packages/sim-setup/README.md) for options and management commands.
 
 ### Option 2: Using Docker Compose
 

apps/docs/content/docs/integrations/firecrawl.mdx

@@ -184,7 +184,7 @@ Crawl entire websites and extract structured content from all accessible pages
 | --------- | ---- | -------- | ----------- |
 | `url` | string | Yes | The website URL to crawl \(e.g., "https://example.com" or "https://docs.example.com/guide") |
 | `limit` | number | No | Maximum number of pages to crawl \(e.g., 50, 100, 500\). Default: 100 |
-| `maxDepth` | number | No | Maximum URL path depth \(e.g., 1 allows /docs and /docs/index.html\). Independent of link discovery depth |
+| `maxDepth` | number | No | Maximum path depth below the starting URL \(e.g., 1 from /docs allows /docs/guide and /docs/guide/index.html\). Independent of link discovery depth |
 | `formats` | json | No | Output formats for scraped content \(e.g., \["markdown"\], \["markdown", "html"\], \["markdown", "links"\]\) |
 | `prompt` | string | No | Natural-language crawl guidance supplied by existing configurations |
 | `excludePaths` | json | No | URL paths to exclude from crawling \(e.g., \["/blog/*", "/admin/*", "/*.pdf"\]\) |

apps/docs/content/docs/platform/self-hosting/networking.mdx

@@ -278,7 +278,7 @@ This depends on the runtime. The published images run Bun. If you build the stan
 | Everything through the SSRF guard — SSO OIDC discovery, the HTTP block, tools, connectors, outbound webhooks, content fetches, MCP servers, and model endpoints typed into a block | Yes — see [Proxying guarded requests](#proxying-guarded-requests) |
 | SSO sign-in — the token, JWKS, and userinfo calls made while a user signs in | Yes — they use the default `fetch` |
 | SSO domain verification (TXT lookup) | No — DNS, sent to `1.1.1.1` and `8.8.8.8` unless `DOMAIN_VERIFICATION_NAMESERVERS` names your resolvers |
-| Amazon Bedrock, object storage on S3, and every AWS integration (DynamoDB, SQS, Lambda, Textract, and the rest) | Yes — each AWS client gets a proxy-aware agent while a proxy is set. Bedrock then uses HTTP/1.1 instead of HTTP/2 |
+| Amazon Bedrock, object storage on S3, and every AWS integration (DynamoDB, SQS, Lambda, Textract, and the rest) | Yes — each AWS service client gets a proxy-aware agent while a proxy is set, and STS calls made for its credentials inherit it. Bedrock then uses HTTP/1.1 instead of HTTP/2. IAM Identity Center (SSO) credential lookups do not use the proxy |
 | Email via SMTP, and the SMTP block | No — SMTP is not HTTP. Use a mail relay the app can reach directly, or Resend or SES |
 | Email via Amazon SES | Yes — the AWS SDK client above |
 | OTLP export from the server SDK | Yes — the exporters get the same proxy-aware agent |
@@ -289,7 +289,7 @@ The practical consequence: a mandatory-egress-proxy environment can route LLM tr
 
 ### Proxying guarded requests
 
-A request through the SSRF guard keeps its checks when it is proxied. Before each request, and again for each redirect hop, the app resolves the destination's hostname with its own DNS and refuses it if any policy in [Security](/platform/self-hosting/security#the-ssrf-boundary) blocks the address. It then hands the hostname, not the address, to the proxy, so a proxy that allowlists by domain sees the name it expects.
+A request through the SSRF guard keeps its checks when it is proxied. Before each request, and again for each redirect hop, the app resolves the destination's hostname with its own DNS and refuses it if any policy in [Security](/platform/self-hosting/security#the-ssrf-boundary) blocks any of the addresses it resolves to, since the proxy may connect to any of them. It then hands the hostname, not the address, to the proxy, so a proxy that allowlists by domain sees the name it expects.
 
 - **DNS must still resolve inside the container.** A destination that the app cannot resolve is refused before the proxy is asked.
 - **The proxy resolves the name again.** The app cannot pin the address across a proxy, so the proxy's own egress policy is the last check.
@@ -301,6 +301,8 @@ A request through the SSRF guard keeps its checks when it is proxied. Before eac
 
 Set `NO_PROXY` for every destination that is not on the public internet, not just model endpoints. The app reaches the realtime server (`SOCKET_SERVER_URL`), the Presidio PII service (`PII_URL`), and itself (`INTERNAL_API_BASE_URL`) over the same default `fetch`, alongside self-hosted Ollama, LiteLLM, and vLLM — so a proxy that cannot reach your internal network breaks live updates and PII redaction, not only inference. AWS clients and OTLP export follow the same rule, so also add an internal S3-compatible store such as MinIO, AWS VPC endpoints, and an in-cluster OpenTelemetry collector.
 
+Each entry is a hostname, a domain suffix (`.svc` or `*.svc`), or an IP address, optionally followed by `:port`. Bracket IPv6 addresses (`[::1]`). CIDR ranges are not supported. `*` disables the proxy only when it is the whole value.
+
 Set it in the application environment, not your shell — under `app.env` on Helm, or the service's `environment:` on Compose. On Helm the suffixes alone are not enough: the chart wires `SOCKET_SERVER_URL`, `PII_URL`, and `OLLAMA_URL` to bare Service names, which no domain suffix matches. Add those names too — `helm template` prints the rendered ones, and the prefix is the release name unless it already contains `sim`, in which case it is the release name alone:
 
   ```yaml

apps/docs/openapi-v2-resources.json

@@ -23929,7 +23929,7 @@
                         "type": "string",
                         "minLength": 1,
                         "maxLength": 4194304,
-                        "description": "UTF-8 CSV contents, up to 4 MiB."
+                        "description": "UTF-8 CSV contents, up to 4 MiB. Both files travel in one request body limited to 10 MiB after JSON encoding."
                       }
                     },
                     "required": ["filename", "content"],
@@ -23949,7 +23949,7 @@
                         "type": "string",
                         "minLength": 1,
                         "maxLength": 4194304,
-                        "description": "UTF-8 CSV contents, up to 4 MiB."
+                        "description": "UTF-8 CSV contents, up to 4 MiB. Both files travel in one request body limited to 10 MiB after JSON encoding."
                       }
                     },
                     "required": ["filename", "content"],

apps/sim/app/api/auth/oauth/token/route.test.ts

@@ -290,6 +290,111 @@ describe('OAuth Token API Routes', () => {
       })
     })
 
+    describe('saved service-account credentials', () => {
+      const authorized = {
+        ok: true,
+        requesterUserId: 'test-user-id',
+        credentialOwnerUserId: 'test-user-id',
+        workspaceId: 'workspace-id',
+      }
+
+      beforeEach(() => {
+        authOAuthUtilsMockFns.mockResolveOAuthAccountId.mockResolvedValueOnce({
+          accountId: '',
+          credentialId: 'saved-credential-id',
+          credentialType: 'service_account',
+          providerId: 'vanta-service-account',
+          workspaceId: 'workspace-id',
+          usedCredentialTable: true,
+        })
+        authOAuthUtilsMockFns.mockResolveServiceAccountToken.mockResolvedValue({
+          accessToken: 'saved-secret',
+        })
+        mockGetToolMetadata.mockReturnValue({
+          id: 'vanta_list_tests',
+          params: {},
+          oauth: { required: true, provider: 'vanta', credentialKind: 'service-account' },
+        })
+      })
+
+      it('refuses to release the secret to a session caller', async () => {
+        hybridAuthMockFns.mockCheckSessionOrInternalAuth.mockResolvedValueOnce({
+          success: true,
+          authType: 'session',
+          userId: 'test-user-id',
+        })
+        mockAuthorizeCredentialUse.mockResolvedValueOnce(authorized)
+
+        const response = await POST(
+          createMockRequest('POST', {
+            credentialId: 'saved-credential-id',
+            toolId: 'vanta_list_tests',
+          })
+        )
+
+        expect(response.status).toBe(403)
+        const body = await response.json()
+        expect(body).toMatchObject({ code: 'SERVICE_ACCOUNT_SESSION_FORBIDDEN' })
+        expect(JSON.stringify(body)).not.toContain('saved-secret')
+        expect(authOAuthUtilsMockFns.mockResolveServiceAccountToken).not.toHaveBeenCalled()
+      })
+
+      it('resolves the secret for an internal-JWT execution caller', async () => {
+        hybridAuthMockFns.mockCheckSessionOrInternalAuth.mockResolvedValueOnce({
+          success: true,
+          authType: 'internal_jwt',
+          userId: 'test-user-id',
+        })
+        mockAuthorizeCredentialUse.mockResolvedValueOnce(authorized)
+
+        const response = await POST(
+          createMockRequest('POST', {
+            credentialId: 'saved-credential-id',
+            toolId: 'vanta_list_tests',
+            workflowId: 'workflow-id',
+          })
+        )
+
+        expect(response.status).toBe(200)
+        await expect(response.json()).resolves.toMatchObject({
+          accessToken: 'saved-secret',
+          credentialType: 'service_account',
+        })
+      })
+    })
+
+    it('still returns an OAuth token to a session caller', async () => {
+      hybridAuthMockFns.mockCheckSessionOrInternalAuth.mockResolvedValueOnce({
+        success: true,
+        authType: 'session',
+        userId: 'test-user-id',
+      })
+      mockAuthorizeCredentialUse.mockResolvedValueOnce({
+        ok: true,
+        requesterUserId: 'test-user-id',
+        credentialOwnerUserId: 'test-user-id',
+      })
+      authOAuthUtilsMockFns.mockGetCredential.mockResolvedValueOnce({
+        id: 'credential-id',
+        accessToken: 'test-token',
+        refreshToken: 'refresh-token',
+        accessTokenExpiresAt: new Date(Date.now() + 3600 * 1000),
+        providerId: 'google',
+      })
+      authOAuthUtilsMockFns.mockRefreshTokenIfNeeded.mockResolvedValueOnce({
+        accessToken: 'session-oauth-token',
+        refreshed: false,
+      })
+
+      const response = await POST(createMockRequest('POST', { credentialId: 'credential-id' }))
+
+      expect(response.status).toBe(200)
+      await expect(response.json()).resolves.toMatchObject({
+        accessToken: 'session-oauth-token',
+        credentialType: 'oauth',
+      })
+    })
+
     describe('credentialAccountUserId + providerId path', () => {
       it('should reject internal JWT authentication', async () => {
         hybridAuthMockFns.mockCheckSessionOrInternalAuth.mockResolvedValueOnce({

apps/sim/app/api/resume/[workflowId]/[executionId]/[contextId]/route.ts

@@ -160,7 +160,7 @@ export const GET = withRouteHandler(
     }
   ) => {
     const { workflowId: requestedWorkflowId } = await context.params
-    const access = await validateWorkflowAccess(request, requestedWorkflowId, false)
+    const access = await validateWorkflowAccess(request, requestedWorkflowId)
     if (access.error) {
       return NextResponse.json({ error: access.error.message }, { status: access.error.status })
     }

apps/sim/app/api/workflows/[id]/executions/[executionId]/route.ts

@@ -23,7 +23,7 @@ export const GET = withRouteHandler(
     const { id: workflowId, executionId } = parsed.data.params
     const { includeOutput, selectedOutputs } = parsed.data.query
 
-    const access = await validateWorkflowAccess(request, workflowId, false)
+    const access = await validateWorkflowAccess(request, workflowId)
     if (access.error) {
       return NextResponse.json({ error: access.error.message }, { status: access.error.status })
     }

apps/sim/app/api/workflows/[id]/paused/route.ts

@@ -14,7 +14,7 @@ export const GET = withRouteHandler(
     if (!parsed.success) return parsed.response
     const { id: workflowId } = parsed.data.params
 
-    const access = await validateWorkflowAccess(request, workflowId, false)
+    const access = await validateWorkflowAccess(request, workflowId)
     if (access.error) {
       return NextResponse.json({ error: access.error.message }, { status: access.error.status })
     }

apps/sim/app/api/workflows/middleware.test.ts

@@ -1,8 +1,3 @@
-/**
- * Tests for workflow access middleware — focused on the workspace-scoped
- * API key boundary check in the `requireDeployment=false` branch.
- */
-
 import {
   hybridAuthMockFns,
   workflowAuthzMockFns,
@@ -13,10 +8,6 @@ import { NextRequest } from 'next/server'
 import { beforeEach, describe, expect, it, vi } from 'vitest'
 
 vi.mock('@/lib/workflows/utils', () => workflowsUtilsMock)
-vi.mock('@/lib/api-key/service', () => ({
-  authenticateApiKeyFromHeader: vi.fn(),
-  updateApiKeyLastUsed: vi.fn(),
-}))
 
 import { WORKSPACE_KEY_SCOPE_DENIED } from '@/lib/api-key/policy-messages'
 import { validateWorkflowAccess } from '@/app/api/workflows/middleware'
@@ -25,12 +16,11 @@ function makeRequest() {
   return new NextRequest(new URL('https://example.com/api/workflows/wf-1'))
 }
 
-describe('validateWorkflowAccess (requireDeployment=false)', () => {
+describe('validateWorkflowAccess', () => {
   beforeEach(() => {
     workflowsUtilsMockFns.mockGetWorkflowById.mockResolvedValue({
       id: 'wf-1',
       workspaceId: 'ws-A',
-      isDeployed: true,
     })
     workflowAuthzMockFns.mockAuthorizeWorkflowByWorkspacePermission.mockResolvedValue({
       allowed: true,
@@ -48,7 +38,7 @@ describe('validateWorkflowAccess (requireDeployment=false)', () => {
       workspaceId: 'ws-B',
     })
 
-    const result = await validateWorkflowAccess(makeRequest(), 'wf-1', false)
+    const result = await validateWorkflowAccess(makeRequest(), 'wf-1')
 
     expect(result.error).toEqual({
       message: WORKSPACE_KEY_SCOPE_DENIED,
@@ -70,7 +60,7 @@ describe('validateWorkflowAccess (requireDeployment=false)', () => {
       message: 'Access denied',
     })
 
-    const result = await validateWorkflowAccess(makeRequest(), 'wf-1', false)
+    const result = await validateWorkflowAccess(makeRequest(), 'wf-1')
 
     expect(result.error).toEqual({ message: 'Access denied', status: 403 })
   })