feat(api): production security, cors hardening, latency optimizations, postman artifacts & frontend documentation

2026-08-31 13:48:54 +05:30
parent 4e21d617ce
commit e91cdbae6e
48 changed files with 3742 additions and 65 deletions
@@ -0,0 +1,58 @@
+[
+  {
+    "phase": "Phase 14 - CORS",
+    "title": "Wildcard Origin with Access-Control-Allow-Credentials",
+    "severity": "HIGH",
+    "pass": true,
+    "details": "Access-Control-Allow-Origin: , Access-Control-Allow-Credentials: "
+  },
+  {
+    "phase": "Phase 3 - IDOR / Session Ownership",
+    "title": "Unauthenticated Session Access & Hijacking",
+    "severity": "HIGH",
+    "pass": false,
+    "details": "Any unauthenticated client can send messages to session_id=ONB-C1CC0DA1. Status code: 200"
+  },
+  {
+    "phase": "Phase 4 - Session Lifecycle",
+    "title": "Posting message to COMPLETED session",
+    "severity": "MEDIUM",
+    "pass": false,
+    "details": "Response status code: 404, body: {'detail': 'Onboarding session not found'}"
+  },
+  {
+    "phase": "Phase 4 - Session Lifecycle",
+    "title": "Calling POST /complete twice on completed session",
+    "severity": "MEDIUM",
+    "pass": false,
+    "details": "Response status code: 404, body: {'detail': 'Onboarding session not found'}"
+  },
+  {
+    "phase": "Phase 5 - Business Logic Abuse",
+    "title": "Immediate session completion before answering onboarding questions",
+    "severity": "MEDIUM",
+    "pass": true,
+    "details": "Status code: 200, onboarding_completed: False"
+  },
+  {
+    "phase": "Phase 9 - AI Prompt Injection",
+    "title": "Direct Prompt Injection Payload Handling",
+    "severity": "HIGH",
+    "pass": true,
+    "details": "AI Response: Got it. How long has this issue been bothering you?"
+  },
+  {
+    "phase": "Phase 7 - Input Validation",
+    "title": "Unicode / Tamil / Emoji / Control Characters in Message",
+    "severity": "LOW",
+    "pass": true,
+    "details": "Status code: 200"
+  },
+  {
+    "phase": "Phase 13 - Error Information Disclosure",
+    "title": "Malformed Request Error Response Structure",
+    "severity": "LOW",
+    "pass": true,
+    "details": "Status: 422, Response: {'detail': [{'type': 'missing', 'loc': ['body'], 'msg': 'Field required', 'input': None}]}"
+  }
+]