fix(security): validate postMessage origins and fix slack middleware path

[Mitch Goudy (mgoudy91)]

Summary

Slack lambda — missing leading slash (APPS-1)

• `apps/slack/lambda/lib/app.ts`: `'api/tokens'` → `'/api/tokens'` in middleware mount. The missing slash meant `path-to-regexp@0.1.x` never matched, silently bypassing request verification on `POST /api/tokens`.

Wildcard postMessage — senders (APPS-2)
All four sender files replaced `'*'` with `document.referrer ? new URL(document.referrer).origin : window.location.origin`:

• `apps/typeform/frontend/src/processTokenCallback.ts`
• `apps/slack/frontend/src/index.tsx`
• `apps/smartling/frontend/src/standalone.ts`
• `apps/jira/jira-app/src/standalone.ts`

Wildcard postMessage — receivers (APPS-2)
Added `event.origin` checks to all receivers:

• Typeform: `origin !== window.location.origin`
• Slack: `message.origin !== new URL(BACKEND_BASE_URL).origin`
• Smartling: `origin !== window.location.origin`
• Jira: `e.origin !== new URL(constants.OAUTH_REDIRECT_URI).origin`

Test plan

• Slack OAuth connect flow works end-to-end
• `POST /api/tokens` now has request verification applied
• Typeform, Smartling, Jira OAuth flows still deliver tokens correctly
• `postMessage` from a foreign origin is ignored by each receiver

🤖 Generated with Claude Code

[wiz-inc-38d59fb8d7]

Wiz Scan Summary

Scanner	Findings
Vulnerabilities	-
Sensitive Data	-
Secrets	-
IaC Misconfigurations	-
SAST Findings	10
Software Management Findings	-
Total	10

View scan details in Wiz

To detect these findings earlier in the dev lifecycle, try using Wiz Code VS Code Extension.