[SECURITY][MEDIUM] 'pnpm start' (serve package) serves app without any security headers

[LucasMaupin]

Summary

The start script uses the serve npm package (serve -s dist) as a production serving mode. The serve package adds no security headers by default, and the repo has no serve.json configuration file. Any deployment using pnpm start instead of the Docker image gets no X-Frame-Options, no CSP, no X-Content-Type-Options, and no Cache-Control: no-store on /env-config.js (which contains OSC_PAT). This path is documented in README.md as the local quickstart and may be used in non-Docker deployments.

CVSS Score

5.3 (Medium) — CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Category

OWASP A05 — Security Misconfiguration

Affected File(s)

• package.json:10 ("start": "serve -s dist")

Steps to Reproduce

OPEN_LIVE_URL=http://localhost:3000 pnpm start
curl -I http://localhost:8080/
# No security headers — no CSP, X-Frame-Options, etc.

Remediation

Add a serve.json file to the repo root:

{
  "headers": [
    {
      "source": "**",
      "headers": [
        { "key": "X-Frame-Options", "value": "SAMEORIGIN" },
        { "key": "X-Content-Type-Options", "value": "nosniff" },
        { "key": "Referrer-Policy", "value": "strict-origin-when-cross-origin" }
      ]
    },
    {
      "source": "/env-config.js",
      "headers": [
        { "key": "Cache-Control", "value": "no-store, no-cache, must-revalidate" }
      ]
    }
  ]
}

Also add a note in README.md that the Docker image is the canonical production serving path.

References

• serve-handler — configuration
• OWASP A05:2021 — Security Misconfiguration

[LucasMaupin]

The serve package used by pnpm start ships no security headers by default and there's no serve.json in the repo, leaving non-Docker deployments completely unprotected. Labelled bug and good-first-issue — adding a serve.json with the standard header set is a self-contained config file change. A contributor can pick this up.

[LucasMaupin]

PR opened: #48