Security: comprehensive tenant, credential, and webhook hardening

[vincentgrobler]

Summary

This PR completes a broad security hardening pass prompted by the confirmed public RLS policy exposure in migration 021. It closes additional tenant-isolation, credential-handling, webhook-authentication, SSRF, arbitrary-code-execution, and dependency risks across the frontend, Supabase functions/database, task runner, CLI, widget, and Zapier app.

Security changes

Database and tenant isolation

• Add migration 085_comprehensive_security_hardening.sql to tighten RLS, grants, RPC execution, workspace membership, invitation acceptance, rate limiting, subscriptions, audit writes, admin operations, and cross-tenant references.
• Restrict knowledge storage and sensitive RPCs to the correct workspace or service role.
• Add tenant-consistency triggers for tasks, team runs, team members, and agent tasks.
• Remove sensitive authenticated-column access for API keys and Google OAuth tokens.
• Remove output_routes from Realtime and scrub integration secrets historically copied into task metadata.

Credentials and OAuth

• Encrypt provider/API and Google OAuth credentials with AES-256-GCM using a stable API_KEY_ENCRYPTION_KEY.
• Add authenticated Edge managers that expose metadata only and lazily migrate legacy plaintext credentials.
• Replace plaintext MCP/A2A/AG-UI token matching with one-way authentication hashes.
• Replace Google OAuth state payloads with random, hashed, expiring, one-time state records bound to the authenticated workspace.

Runtime and network boundaries

• Remove the arbitrary JavaScript code_interpreter execution path.
• Remove MCP stdio command execution; only HTTP streaming transports remain.
• Add outbound URL validation, DNS/IP checks, metadata/private-network blocking, redirect revalidation, and response-size limits.
• Scope A2A, AG-UI, MCP, agent, and task access to the authenticated workspace and published state.

Webhooks and browser security

• Verify Slack, Telegram, Trello, Linear, Resend, cron, database, and integration-registration requests using fail-closed signatures or authenticated identities.
• Stop embedding bot and integration secrets in task source data.
• Pin Stripe return URLs to APP_URL.
• Block unsafe authentication redirects and replace unsafe HTML rendering with React Markdown or DOM APIs.
• Add CSP, HSTS, framing, MIME-sniffing, referrer, and permissions-policy headers.

Dependencies and regression coverage

• Upgrade vulnerable dependencies across the root app, task runner, CLI, chat widget, and Zapier app.
• Add security regression tests for credential encryption/hashing and outbound URL rejection.
• Add a production rollout and credential-rotation checklist in docs/security-hardening-2026-08.md.

Verification

• Root application build: passed
• Root tests: 3 passed
• Root lint: passed, with one pre-existing React Refresh warning
• Task runner build: passed
• Task runner tests: 25 passed
• Modified Supabase Edge Functions: Deno type-check passed
• Migration SQL: parsed successfully with PostgreSQL parser
• Dependency audits: zero known vulnerabilities across all six package trees
• Zapier validation: 37 passed, 0 failed
• CLI, chat widget, and landing builds: passed
• git diff --check: passed

A full local Supabase reset could not be run because Docker was unavailable. The migration has therefore been syntax-validated but must still be exercised in staging before production.

Deployment requirements

This release intentionally fails closed and must be deployed as a coordinated maintenance change:

1. Configure the same stable API_KEY_ENCRYPTION_KEY in Supabase Edge Functions and the task runner.
2. Configure independent WEBHOOK_SECRET, CRON_SECRET, DATABASE_WEBHOOK_SECRET, and enabled integration signing secrets.
3. Apply migration 085, then deploy the Edge Functions and task runner together.
4. Regenerate MCP, A2A, and AG-UI publishing keys.
5. Rotate all credentials and webhook URLs that were stored while the original public policy was active.
6. Reconnect or open Google/provider settings to migrate legacy stored credentials.
7. Run the post-deployment permission and Realtime checks in the deployment checklist.

Compatibility notes

• code_interpreter agents and MCP stdio servers are deliberately disabled.
• Existing MCP/A2A/AG-UI publishing keys stop authenticating until regenerated because legacy rows do not contain the new authentication hash.
• Missing signing/encryption secrets now cause affected integrations to fail closed.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
crewform	Ready	Preview	Aug 18, 2026 7:30am