Security closes (SEC-1..5) + kill the last fake data on the server#7
Draft
aurph wants to merge 2 commits into
Draft
Security closes (SEC-1..5) + kill the last fake data on the server#7aurph wants to merge 2 commits into
aurph wants to merge 2 commits into
Conversation
- SEC-1: require admin on GET /api/newsletter/preview (was public, leaked the subscriber count). The internal call from /newsletter/send forwards the server's own admin key so sends keep working. - SEC-2: require admin on POST /api/social/generate (was public). - SEC-3: allowlist /api/stack timeframe to [1D,5D,1M] and key the cache on the normalized value, killing the ~200-Yahoo-call cache-miss amplification. - SEC-4: stop running the backlog/uranium news scanners (which write JSON) from public GET /api/news; they now run only via authenticated /api/admin/scan-news-now. Wire that into cron to restore automation. - SEC-5: HTML-escape datacenter names before Leaflet divIcon interpolation. - TEST-1: add auth-boundary.test.ts (every admin route rejects missing key, correct key accepted, SEC-3 coercion). 33/33 tests pass.
The CCJ/CEG correlation card was the last fabricated data on the server: Box-Muller noise tuned to target r values (0.82 / 0.65), regenerated per request and presented as 52 weeks of observations (audit finding M5). Now it plots real trailing-year weekly closes from Yahoo: Sprott Physical Uranium Trust (SRUUF) as the spot proxy (holds physical U3O8; URA would be circular, it holds CCJ) against CCJ, with Pearson r computed from the same observed series for both CCJ and CEG. Math is a pure module (server/correlation.ts, date-joined so a dropped OTC bar can't shift the pairing, 7 tests). 6h cache; on Yahoo failure the card shows an explicit empty state instead of fallback data, and r reads null, never a default. First real readings: CCJ r 0.872, CEG r -0.298 - the fake data had CEG at +0.65; reality says the utility does not track spot at all this year. Also: reusePort now Linux-only in server/index.ts (macOS dev fix, known issue), CLAUDE.md known-debt entries updated.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Two long-standing audit items, both verified live before this PR.
1. The five security closes (cherry-pick of da97234 from stale PR #1)
Cherry-pick applied cleanly onto current main (no conflicts). PR #1 can be closed once this merges.
2. Real data replaces the synthetic uranium scatter (audit M5)
The Stack's CCJ/CEG correlation card was Box-Muller noise tuned to target r values, regenerated per request. It now plots real trailing-year weekly closes: Sprott Physical Uranium Trust (SRUUF, physical U3O8 proxy; URA would be circular since it holds CCJ) vs CCJ, with Pearson r computed from the observed series for both CCJ and CEG. Pure math module server/correlation.ts (date-joined pairing, 7 tests), 6h cache, explicit empty state on Yahoo failure instead of fallback data.
First real readings: CCJ r 0.872 (fake claimed 0.82), CEG r -0.298 (fake claimed +0.65 - the utility does not track spot at all this year). Chart labels, tooltip, and methodology copy updated to say exactly what is plotted.
Also: reusePort now Linux-only (macOS dev fix), CLAUDE.md known-debt updated.
Verification
After merge: redeploy on Replit to ship.