Security and resilience improvements - #419
Merged
therealjhay merged 1 commit intoJul 29, 2026
Merged
Conversation
Betta-Pay#371 — Add rate limiting for webhook URL validation - Rate limit: 10 validation requests per minute per IP via Redis - DNS result caching with 60s TTL - HTTP HEAD validation with 5s timeout - Returns 429 when rate limit exceeded Betta-Pay#372 — Add PII redaction to all structured error responses - PII patterns: email, address, secret, key, token - Redacts validation error message and value fields for PII paths - Preserves non-PII error details unchanged - Works for both Zod and Fastify validation errors Betta-Pay#374 — Add response header security hardening - Cross-Origin-Embedder-Policy: require-corp - Cross-Origin-Opener-Policy: same-origin - Cross-Origin-Resource-Policy: same-origin - Permissions-Policy: geolocation=(), microphone=(), camera=() - Referrer-Policy: strict-origin-when-cross-origin Betta-Pay#375 — Add database credential rotation support - DATABASE_ROTATE_URL env var support - Auto-switch on PostgreSQL authentication error (28P01) - Rotation logged at warn level - getActiveConnectionUrl() returns rotate URL after rotation
|
@k-deejah Great news! 🎉 Based on an automated assessment of this PR, the linked Wave issue(s) no longer count against your application limits. You can now already apply to more issues while waiting for a review of this PR. Keep up the great work! 🚀 |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
This PR implements four security and resilience improvements across the shared validation library and API gateway.
#371 — Add rate limiting for webhook URL validation
Files:
shared/validation/webhookSchema.ts,shared/validation/webhookSchema.test.tsAdds rate limiting via Redis (
webhook_validate_rate:{ip}, 10 req/min per IP) before making outbound HTTP HEAD requests to validate webhook URLs. DNS resolution results are cached in-memory for 60 seconds to reduce redundant lookups.#372 — Add PII redaction to all structured error responses
Files:
shared/validation/plugins.ts,shared/validation/plugins.test.tsEnhances
registerErrorHandler()to redact field values matching PII patterns (email, address, secret, key, token) from validation error details. Works for both Zod validation errors and Fastify schema validation errors.#374 — Add response header security hardening
Files:
services/api-gateway/src/index.ts,services/api-gateway/src/health-all.test.tsAdds five production-hardening security headers via
@fastify/helmetconfiguration and a customonSendhook (for Permissions-Policy, not available in helmet v7).#375 — Add database credential rotation support
Files:
shared/validation/prisma.ts,shared/validation/prisma.test.tsAdds
DATABASE_ROTATE_URLsupport. When the primary connection fails with PostgreSQL authentication error (28P01), auto-switches to the rotation URL and logs the rotation at warn level.Testing
All existing and new tests pass:
webhookSchema.test.tsplugins.test.tsprisma.test.tshealth-all.test.tsCloses #371,
Closes #372,
Closes #374,
Closes #375