Profa dc10361133 fix(security,perf): Sprint 1 performance and security fixes from QE audit ...

Performance fixes:
- HNSW Array.splice → BinaryHeap for O(log n) insertion (25x speedup)
- vectorSearch N+1 → batch SQL query with IN clause
- loadPatterns N+1 → batched concurrent Promise.all (50/batch)
- Math.min(...spread) → iterative loop to prevent stack overflow at >10K vertices
- Move @faker-js/faker to devDependencies (-5.2MB production)

Security fixes:
- SQL table name allowlist for defense-in-depth (SQLite can't parameterize identifiers)
- Object.assign() → safeAssignPooled() to prevent prototype pollution (3 locations)
- OAuth timingSafeCompare pads strings instead of early-return on length mismatch
- OAuth no longer stores raw tokens (hash-only storage)
- OAuth revokedTokens Set→Map with timestamps for 24hr expiry cleanup
- Remove hardcoded GCP credentials from sync/interfaces.ts defaults
- Add .env.example GCP section with placeholder comments

Testing:
- Add 167 tests for 5 MCP security boundary validators (command, path-traversal, input-sanitizer, crypto, regex-safety)
- Include QE swarm analysis reports for v3.6.3

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

2026-02-11 19:52:45 +00:00

4.4 KiB

Raw Permalink Blame History

View Raw