fix(security): harden auth, remove leaked artifacts, and close audit alerts

Author: 0xSero

.env.example

@@ -7,12 +7,18 @@
 # =============================================================================
 
 # API server settings
-VLLM_STUDIO_HOST=0.0.0.0
+VLLM_STUDIO_HOST=127.0.0.1
 VLLM_STUDIO_PORT=8080
 
-# Optional API authentication (leave empty for no auth)
+# Required when binding to a non-loopback host such as 0.0.0.0
 VLLM_STUDIO_API_KEY=
 
+# Only set this to true for trusted local environments.
+# VLLM_STUDIO_ALLOW_UNAUTHENTICATED=false
+
+# Optional browser allowlist for direct controller access (comma-separated origins)
+# VLLM_STUDIO_CORS_ORIGINS=http://localhost:3000,http://127.0.0.1:3000
+
 # Inference backend port (where vLLM/SGLang runs)
 VLLM_STUDIO_INFERENCE_PORT=8000
 
@@ -45,7 +51,7 @@ VLLM_STUDIO_DATA_DIR=./data
 # ExLLaMA v3 command template. Must resolve a runnable launch command.
 # Supports any binary with flags; include placeholders exactly as you want them to run.
 # Example: /opt/exllamav3/bin/exllama-server --model /models/my-model --port 8000
-# VLLM_STUDIO_EXLLAMAV3_COMMAND=exllama-server --host 0.0.0.0 --port 8000
+# VLLM_STUDIO_EXLLAMAV3_COMMAND=exllama-server --host 127.0.0.1 --port 8000
 
 # Strict OpenAI model matching for /v1/chat/completions.
 # If true, only configured recipes are routable through the controller.

controller/src/config/env.ts

@@ -14,6 +14,7 @@ export interface Config {
   host: string;
   port: number;
   api_key?: string;
+  cors_origins?: string[];
   daytona_api_url?: string;
   daytona_api_key?: string;
   daytona_proxy_url?: string;
@@ -69,10 +70,45 @@ export const createConfig = (): Config => {
       : localDataDirectory;
   const defaultDatabasePath = resolve(defaultDataDirectory, "controller.db");
 
+  const isLoopbackHost = (value: string): boolean => {
+    const normalized = value.trim().toLowerCase();
+    return normalized === "127.0.0.1" || normalized === "localhost" || normalized === "::1";
+  };
+
+  const parseBooleanFlag = (value: string | undefined): boolean => {
+    if (!value) return false;
+    return ["1", "true", "yes", "on"].includes(value.trim().toLowerCase());
+  };
+
+  const normalizeOrigin = (value: string): string | null => {
+    try {
+      const origin = new URL(value.trim()).origin;
+      return origin === "null" ? null : origin;
+    } catch {
+      return null;
+    }
+  };
+
+  const parseCorsOrigins = (value: string | undefined): string[] => {
+    const defaults = [
+      "http://localhost:3000",
+      "http://127.0.0.1:3000",
+      "http://localhost:3001",
+      "http://127.0.0.1:3001",
+      "http://host.docker.internal:3000",
+      "http://host.docker.internal:3001",
+    ];
+    const candidates =
+      value && value.trim().length > 0 ? value.split(",").map((entry) => entry.trim()) : defaults;
+    return [...new Set(candidates.map((entry) => normalizeOrigin(entry)).filter((entry): entry is string => Boolean(entry)))];
+  };
+
   const schema = z.object({
-    VLLM_STUDIO_HOST: z.string().default("0.0.0.0"),
+    VLLM_STUDIO_HOST: z.string().default("127.0.0.1"),
     VLLM_STUDIO_PORT: z.coerce.number().int().positive().default(8080),
     VLLM_STUDIO_API_KEY: z.string().optional(),
+    VLLM_STUDIO_ALLOW_UNAUTHENTICATED: z.string().optional(),
+    VLLM_STUDIO_CORS_ORIGINS: z.string().optional(),
     VLLM_STUDIO_DAYTONA_API_KEY: z.string().optional(),
     VLLM_STUDIO_DAYTONA_API_URL: z.string().optional(),
     VLLM_STUDIO_DAYTONA_PROXY_URL: z.string().optional(),
@@ -96,6 +132,7 @@ export const createConfig = (): Config => {
   });
 
   const parsed = schema.parse(process.env);
+  const host = parsed.VLLM_STUDIO_HOST.trim() || "127.0.0.1";
 
   const strictOpenAIModels = parsed.VLLM_STUDIO_STRICT_OPENAI_MODELS;
   const strictOpenAIModelsEnabled = strictOpenAIModels
@@ -116,7 +153,7 @@ export const createConfig = (): Config => {
     activationPolicyRaw === "switch_on_request" ? "switch_on_request" : "load_if_idle";
 
   const config: Config = {
-    host: parsed.VLLM_STUDIO_HOST,
+    host,
     port: parsed.VLLM_STUDIO_PORT,
     inference_port: parsed.VLLM_STUDIO_INFERENCE_PORT,
 
@@ -127,6 +164,7 @@ export const createConfig = (): Config => {
     daytona_agent_mode: daytonaAgentMode,
     agent_fs_local_fallback: localAgentFsFallback,
     openai_model_activation_policy: openaiModelActivationPolicy,
+    cors_origins: parseCorsOrigins(parsed.VLLM_STUDIO_CORS_ORIGINS),
     providers: [],
   };
 
@@ -139,6 +177,14 @@ export const createConfig = (): Config => {
   if (parsed.VLLM_STUDIO_API_KEY) {
     config.api_key = parsed.VLLM_STUDIO_API_KEY;
   }
+
+  const allowUnauthenticated = parseBooleanFlag(parsed.VLLM_STUDIO_ALLOW_UNAUTHENTICATED);
+  if (!config.api_key && !allowUnauthenticated && !isLoopbackHost(host)) {
+    throw new Error(
+      "VLLM_STUDIO_API_KEY is required when binding the controller to a non-loopback host. Set VLLM_STUDIO_ALLOW_UNAUTHENTICATED=true only for trusted local environments."
+    );
+  }
+
   if (parsed.VLLM_STUDIO_DAYTONA_API_KEY) {
     config.daytona_api_key = parsed.VLLM_STUDIO_DAYTONA_API_KEY;
   }

controller/src/config/persisted-config.ts

@@ -1,5 +1,5 @@
 // CRITICAL
-import { existsSync, mkdirSync, readFileSync, writeFileSync } from "node:fs";
+import { chmodSync, existsSync, mkdirSync, readFileSync, writeFileSync } from "node:fs";
 import { resolve } from "node:path";
 
 export interface ProviderConfig {
@@ -64,7 +64,13 @@ export const savePersistedConfig = (
       writable[key] = value;
     }
   });
-  mkdirSync(dataDirectory, { recursive: true });
+  mkdirSync(dataDirectory, { recursive: true, mode: 0o700 });
   writeFileSync(path, JSON.stringify(next, null, 2));
+  try {
+    chmodSync(dataDirectory, 0o700);
+    chmodSync(path, 0o600);
+  } catch {
+    // Ignore permission hardening failures on unsupported filesystems.
+  }
   return next;
 };

controller/src/http/app.ts

@@ -24,13 +24,16 @@ import { createMutatingAuthMiddleware, createMutatingRateLimitMiddleware } from
  */
 export const createApp = (context: AppContext): Hono => {
   const app = new Hono();
+  const allowedCorsOrigins = context.config.cors_origins ?? [];
 
   app.use(
     "*",
     cors({
-      origin: "*",
-      allowMethods: ["GET", "POST", "PUT", "DELETE", "OPTIONS"],
-      allowHeaders: ["*"],
+      origin: (origin) => (allowedCorsOrigins.includes(origin) ? origin : null),
+      allowMethods: ["GET", "POST", "PUT", "PATCH", "DELETE", "OPTIONS"],
+      allowHeaders: ["Authorization", "Content-Type", "X-API-Key"],
+      exposeHeaders: ["X-RateLimit-Limit", "X-RateLimit-Remaining", "X-RateLimit-Reset", "Retry-After"],
+      maxAge: 600,
     })
   );
 

controller/src/http/security-middleware.test.ts

@@ -25,6 +25,7 @@ function createContext(apiKey?: string): AppContext {
       strict_openai_models: false,
       daytona_agent_mode: false,
       agent_fs_local_fallback: false,
+      cors_origins: ["http://localhost:3000"],
       ...(apiKey ? { api_key: apiKey } : {}),
     },
     logger: {
@@ -37,35 +38,35 @@ function createContext(apiKey?: string): AppContext {
 }
 
 describe("security middleware", () => {
-  it("blocks mutating requests without API key when configured", async () => {
+  it("blocks read requests without API key when configured", async () => {
     resetMutatingRateLimitStoreForTests();
     const app = new Hono();
     const context = createContext("secret-token");
 
     app.use("*", createMutatingAuthMiddleware(context));
-    app.post("/secure", (ctx) => ctx.json({ ok: true }));
+    app.get("/secure", (ctx) => ctx.json({ ok: true }));
 
-    const response = await app.request("/secure", { method: "POST" });
+    const response = await app.request("/secure", { method: "GET" });
     expect(response.status).toBe(401);
     expect(await response.json()).toEqual({ detail: "Unauthorized" });
   });
 
-  it("accepts mutating requests with bearer token or x-api-key", async () => {
+  it("accepts protected requests with bearer token or x-api-key", async () => {
     resetMutatingRateLimitStoreForTests();
     const app = new Hono();
     const context = createContext("secret-token");
 
     app.use("*", createMutatingAuthMiddleware(context));
-    app.post("/secure", (ctx) => ctx.json({ ok: true }));
+    app.get("/secure", (ctx) => ctx.json({ ok: true }));
 
     const bearer = await app.request("/secure", {
-      method: "POST",
+      method: "GET",
       headers: { Authorization: "Bearer secret-token" },
     });
     expect(bearer.status).toBe(200);
 
     const apiKeyHeader = await app.request("/secure", {
-      method: "POST",
+      method: "GET",
       headers: { "X-API-Key": "secret-token" },
     });
     expect(apiKeyHeader.status).toBe(200);
@@ -83,6 +84,18 @@ describe("security middleware", () => {
     expect(response.status).toBe(200);
   });
 
+  it("allows public health checks without auth", async () => {
+    resetMutatingRateLimitStoreForTests();
+    const app = new Hono();
+    const context = createContext("secret-token");
+
+    app.use("*", createMutatingAuthMiddleware(context));
+    app.get("/health", (ctx) => ctx.json({ ok: true }));
+
+    const response = await app.request("/health", { method: "GET" });
+    expect(response.status).toBe(200);
+  });
+
   it("rate limits mutating requests only", async () => {
     resetMutatingRateLimitStoreForTests();
     const app = new Hono();

controller/src/http/security-middleware.ts

@@ -4,6 +4,7 @@ import type { MiddlewareHandler } from "hono";
 import type { AppContext } from "../types/context";
 
 const MUTATING_METHODS = new Set(["POST", "PUT", "PATCH", "DELETE"]);
+const PUBLIC_PATHS = new Set(["/health"]);
 const DEFAULT_RATE_LIMIT_WINDOW_MS = 60_000;
 const DEFAULT_RATE_LIMIT_MAX_REQUESTS = 120;
 
@@ -22,6 +23,10 @@ function isMutatingRequest(method: string): boolean {
   return MUTATING_METHODS.has(method.toUpperCase());
 }
 
+function isPublicRequest(method: string, path: string): boolean {
+  return method.toUpperCase() === "OPTIONS" || PUBLIC_PATHS.has(path);
+}
+
 function getClientIpFromRequestHeaders(header: (name: string) => string | undefined): string {
   const forwarded = header("x-forwarded-for")
     ?.split(",")
@@ -63,7 +68,7 @@ function buildMutatingRateLimitKey(path: string, method: string, clientIp: strin
 
 export function createMutatingAuthMiddleware(context: AppContext): MiddlewareHandler {
   return async (ctx, next) => {
-    if (!isMutatingRequest(ctx.req.method)) {
+    if (isPublicRequest(ctx.req.method, ctx.req.path)) {
       return next();
     }
 

controller/src/services/daytona/toolbox-client.test.ts

@@ -32,6 +32,11 @@ const createFileListResponse = (): Response =>
     headers: { "content-type": "application/json" },
   });
 
+const toOriginAndPath = (value: string): string => {
+  const parsed = new URL(value);
+  return `${parsed.origin}${parsed.pathname}`;
+};
+
 describe("daytona toolbox config", () => {
   it("derives proxy URL from API base URL", () => {
     expect(resolveDaytonaProxyBaseUrl("https://app.daytona.io/api")).toBe(
@@ -356,9 +361,15 @@ describe("daytona toolbox retry behavior", () => {
       const files = await client.listFiles("session-explicit", "");
       expect(files).toEqual([]);
       expect(
-        calls.some((entry) => entry.url.includes("https://proxy.custom.daytona/toolbox/sandbox-explicit/files/folder"))
+        calls.some(
+          (entry) =>
+            toOriginAndPath(entry.url) ===
+            "https://proxy.custom.daytona/toolbox/sandbox-explicit/files/folder"
+        )
       ).toBe(true);
-      expect(calls.some((entry) => entry.url.includes("/toolbox/toolbox/"))).toBe(false);
+      expect(calls.some((entry) => new URL(entry.url).pathname.includes("/toolbox/toolbox/"))).toBe(
+        false
+      );
     } finally {
       globalThis.fetch = originalFetch;
     }

frontend/.env.example

@@ -9,5 +9,6 @@ NEXT_PUBLIC_LITELLM_URL=http://localhost:4100
 LITELLM_URL=http://localhost:4100
 LITELLM_MASTER_KEY=sk-master
 
-# Optional API authentication
+# Optional controller API authentication
+# Prefer saving this server-side via /api/settings instead of persisting it in the browser.
 API_KEY=