Skip to content
Open
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension


Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
36 changes: 19 additions & 17 deletions .env
Original file line number Diff line number Diff line change
@@ -1,28 +1,28 @@
# Database Configuration
DATABASE_URL="postgresql://postgres:password@localhost:5432/basednet"
POSTGRES_USER="postgres"
POSTGRES_PASSWORD="password"
POSTGRES_HOST="localhost"
DATABASE_URL="postgresql://neondb_owner:npg_loex42GnkyEf@ep-small-flower-a5hbgnie-pooler.us-east-2.aws.neon.tech/neondb?sslmode=require"
Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🛑 Security Vulnerability: Database credentials are hardcoded and exposed. This creates a critical security risk allowing unauthorized database access1.

Suggested change
DATABASE_URL="postgresql://neondb_owner:npg_loex42GnkyEf@ep-small-flower-a5hbgnie-pooler.us-east-2.aws.neon.tech/neondb?sslmode=require"
DATABASE_URL="${DATABASE_URL}"

Footnotes

  1. CWE-798: Use of Hard-coded Credentials - https://cwe.mitre.org/data/definitions/798.html

POSTGRES_USER="neondb_owner"
POSTGRES_PASSWORD="npg_loex42GnkyEf"
POSTGRES_HOST="ep-small-flower-a5hbgnie-pooler.us-east-2.aws.neon.tech"
POSTGRES_PORT="5432"
POSTGRES_DB="basednet"
POSTGRES_DB="neondb"

# IPFS Configuration
IPFS_PROJECT_ID=""
IPFS_PROJECT_SECRET=""
IPFS_GATEWAY="https://ipfs.io/ipfs/"
IPFS_PROJECT_ID="971d5aadc982cc62695b"
IPFS_PROJECT_SECRET="11ed2bf0f5a3ec55c8aa8a515b4851deb4489837cdabf4e67681e00ce38af265"
Comment on lines +10 to +11
Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🛑 Security Vulnerability: IPFS API credentials are exposed in plaintext. This allows unauthorized access to your IPFS services and potential data manipulation1.

Suggested change
IPFS_PROJECT_ID="971d5aadc982cc62695b"
IPFS_PROJECT_SECRET="11ed2bf0f5a3ec55c8aa8a515b4851deb4489837cdabf4e67681e00ce38af265"
IPFS_PROJECT_ID="${IPFS_PROJECT_ID}"
IPFS_PROJECT_SECRET="${IPFS_PROJECT_SECRET}"

Footnotes

  1. CWE-798: Use of Hard-coded Credentials - https://cwe.mitre.org/data/definitions/798.html

IPFS_GATEWAY="turquoise-selected-locust-947.mypinata.cloud"
Comment on lines +2 to +12
Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

critical

Hardcoding secrets like database credentials, API keys, and tokens directly into the .env file and committing it to version control is a critical security vulnerability. These secrets are now exposed in the repository's history. They should be removed immediately, and the exposed credentials should be rotated (revoked and re-issued).

Instead of hardcoding, use a .env.example file with placeholder values and add .env to .gitignore. For deployment, use your hosting provider's secret management system (e.g., GitHub Secrets for Actions, Vercel Environment Variables).


# Authentication
INDIE_AUTH_CLIENT_ID=""
INDIE_AUTH_CLIENT_SECRET=""
INDIE_AUTH_REDIRECT_URI="http://localhost:3000/api/auth/callback"
INDIE_AUTH_CLIENT_ID="https://basednet.lol"
INDIE_AUTH_CLIENT_SECRET="a0cb2bbadb0befc7cedfe9f40a9355c52ad107dfdd628a7c009348de579fbb1a"
Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🛑 Security Vulnerability: Authentication secrets are hardcoded and exposed. This compromises the entire authentication system security1.

Suggested change
INDIE_AUTH_CLIENT_SECRET="a0cb2bbadb0befc7cedfe9f40a9355c52ad107dfdd628a7c009348de579fbb1a"
INDIE_AUTH_CLIENT_SECRET="${INDIE_AUTH_CLIENT_SECRET}"

Footnotes

  1. CWE-798: Use of Hard-coded Credentials - https://cwe.mitre.org/data/definitions/798.html

INDIE_AUTH_REDIRECT_URI="https://basednet.lol/callback"

# API Keys & Security
NEXTAUTH_SECRET="basednet-nextauth-secret-key-change-in-production"
NEXTAUTH_URL="http://localhost:3000"
NEXTAUTH_URL="https://basednet.lol"

# Rate Limiting
UPSTASH_REDIS_REST_URL=""
UPSTASH_REDIS_REST_TOKEN=""
UPSTASH_REDIS_REST_URL="https://witty-stingray-45983.upstash.io"
UPSTASH_REDIS_REST_TOKEN="AbOfAAIjcDFhM2M1N2FhNzA3MjY0NTkwYWQ0YjRmNjQ2ODVjMGIwYnAxMA"
Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🛑 Security Vulnerability: Redis access token is exposed in plaintext. This allows unauthorized access to your rate limiting and caching infrastructure1.

Suggested change
UPSTASH_REDIS_REST_TOKEN="AbOfAAIjcDFhM2M1N2FhNzA3MjY0NTkwYWQ0YjRmNjQ2ODVjMGIwYnAxMA"
UPSTASH_REDIS_REST_TOKEN="${UPSTASH_REDIS_REST_TOKEN}"

Footnotes

  1. CWE-798: Use of Hard-coded Credentials - https://cwe.mitre.org/data/definitions/798.html


# Federation
ACTIVITY_PUB_DOMAIN=""
Expand All @@ -35,8 +35,10 @@ ENABLE_FEDERATION=true
ENABLE_CHAT=true

# Services
PINATA_API_KEY=""
PINATA_SECRET_KEY=""
PINATA_API_KEY="971d5aadc982cc62695b"
PINATA_SECRET_KEY="11ed2bf0f5a3ec55c8aa8a515b4851deb4489837cdabf4e67681e00ce38af265"

# Analytics & Monitoring
SENTRY_DSN=""
SENTRY_DSN="https://e8030cc6502f8f8391a6eefb8350b1f0@o4509050597605376.ingest.us.sentry.io/4509050617856000"
Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🛑 Security Vulnerability: Sentry DSN contains sensitive project information that should not be exposed in version control1.

Suggested change
SENTRY_DSN="https://e8030cc6502f8f8391a6eefb8350b1f0@o4509050597605376.ingest.us.sentry.io/4509050617856000"
SENTRY_DSN="${SENTRY_DSN}"

Footnotes

  1. CWE-200: Exposure of Sensitive Information to an Unauthorized Actor - https://cwe.mitre.org/data/definitions/200.html

SENTRY_ORG="basednet"
SENTRY_PROJECT="basednet"
1 change: 1 addition & 0 deletions .gitignore
Original file line number Diff line number Diff line change
@@ -1 +1,2 @@
node_modules
.vercel
Comment on lines 1 to +2
Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P1 | Confidence: High

The gitignore has been drastically reduced from 42 lines to only 2 lines, removing protection for critical files. This change exposes build artifacts (.next/, out/, dist/), environment files (.env, .env*.local), IDE configurations, debug logs, and OS-specific files to version control. This will lead to repository bloat, potential secret leakage, and conflicts between development environments.

Suggested change
node_modules
.vercel
# Restore comprehensive gitignore patterns
node_modules/
.next/
out/
build/
dist/
.env
.env*.local
.vercel
*.log
.DS_Store
Thumbs.db
.vscode/
.idea/

Empty file.
33 changes: 33 additions & 0 deletions .history/.github/workflows/vercel-deploy_20250416041009.yml
Original file line number Diff line number Diff line change
@@ -0,0 +1,33 @@
name: Deploy to Vercel

on:
push:
branches: [main]
workflow_dispatch:

jobs:
deploy:
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v4

- name: Setup Node.js
uses: actions/setup-node@v4
with:
node-version: '20'
cache: 'npm'

- name: Install dependencies
run: npm ci

- name: Install Vercel CLI
run: npm install --global vercel@latest

- name: Pull Vercel Environment Information
run: vercel pull --yes --environment=production --token=${{ secrets.VERCEL_TOKEN }}

- name: Build Project Artifacts
run: vercel build --prod --token=${{ secrets.VERCEL_TOKEN }}

- name: Deploy Project Artifacts to Vercel
run: vercel deploy --prebuilt --prod --token=${{ secrets.VERCEL_TOKEN }}
Comment on lines +1 to +33
Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

medium

The .history directory and its contents appear to be editor-specific local history files. These files should not be committed to the Git repository, as Git itself is the source of truth for version history. Committing these files adds unnecessary clutter, can cause merge conflicts, and may inadvertently expose sensitive information from past versions.

Please add .history/ to your .gitignore file to prevent these files from being tracked.

Empty file.
97 changes: 97 additions & 0 deletions .history/GITHUB_DEPLOYMENT_20250416041359.md
Original file line number Diff line number Diff line change
@@ -0,0 +1,97 @@
# Deploying BasedNet using GitHub Actions and Vercel

## Overview

This document outlines an improved approach to deploying BasedNet to Vercel using GitHub Actions. This approach offers several advantages over direct deployment from a local machine:

1. **Consistent Environment**: Builds happen in a clean Ubuntu environment, avoiding Windows-specific path issues
2. **Automated Workflow**: Deployments are triggered automatically when you push to the main branch
3. **Reproducible Builds**: Every build uses the same setup, reducing "works on my machine" problems
4. **Version Control**: Deployment configuration is tracked in version control

## Prerequisites

Before using this deployment method, you'll need:

1. A GitHub account with your BasedNet code pushed to a repository
2. A Vercel account linked to your GitHub account
3. A Vercel project created for BasedNet

## Setup Instructions

### 1. Generate a Vercel API Token

1. Log in to your [Vercel dashboard](https://vercel.com/dashboard)
2. Go to Settings → Tokens
3. Create a new token with "Full Account" scope
4. Copy the token value (you won't be able to see it again)

### 2. Add the Vercel Token to GitHub Secrets

1. Go to your GitHub repository
2. Navigate to Settings → Secrets and variables → Actions
3. Click "New repository secret"
4. Name: `VERCEL_TOKEN`
5. Value: Paste your Vercel API token
6. Click "Add secret"

### 3. Initial Setup on Vercel

1. From the Vercel dashboard, click "Add New..." → "Project"
2. Import your GitHub repository
3. Configure your project settings:
- Framework Preset: Next.js
- Root Directory: ./
- Build Command: npm run build
- Output Directory: .next
4. Add all required environment variables from your `.env` file
5. Deploy once manually through the Vercel interface to set up the project

### 4. Use GitHub Actions for Future Deployments

After the initial setup, all future deployments will happen automatically through GitHub Actions when you push to the main branch.

## How It Works

The workflow file `.github/workflows/vercel-deploy.yml` defines the deployment process:

1. Checkout the code from GitHub
2. Set up Node.js
3. Install dependencies
4. Install Vercel CLI
5. Pull environment variables from Vercel
6. Build the project
7. Deploy to Vercel

## Troubleshooting

If you encounter deployment issues:

1. Check the GitHub Actions logs for detailed build information
2. Verify all required environment variables are set in Vercel
3. Ensure your Vercel token has the correct permissions
4. Check that the Node.js version in the workflow matches your project requirements

## Manual Deployment

You can also trigger a deployment manually:

1. Go to your GitHub repository
2. Navigate to Actions → "Deploy to Vercel" workflow
3. Click "Run workflow"
4. Select the branch you want to deploy
5. Click "Run workflow"

This will start the deployment process without requiring a code push.

## Security Considerations

The GitHub Actions workflow is configured to deploy only on pushes to the main branch and manual triggers. This prevents unauthorized deployments from feature branches.

The Vercel token is stored securely in GitHub Secrets and is never exposed in logs or outputs.

## Additional Resources

- [GitHub Actions Documentation](https://docs.github.com/en/actions)
- [Vercel CLI Documentation](https://vercel.com/docs/cli)
- [Next.js Deployment Documentation](https://nextjs.org/docs/deployment)
115 changes: 115 additions & 0 deletions .history/GITHUB_DEPLOYMENT_20250416143545.md
Original file line number Diff line number Diff line change
@@ -0,0 +1,115 @@
# Deploying BasedNet using GitHub Actions and Vercel

## Overview

This document outlines an improved approach to deploying BasedNet to Vercel using GitHub Actions. This approach offers several advantages over direct deployment from a local machine:

1. **Consistent Environment**: Builds happen in a clean Ubuntu environment, avoiding Windows-specific path issues
2. **Automated Testing & Linting**: Tests and linting are run before each deployment
3. **Automated Workflow**: Deployments are triggered automatically when you push to the main branch
4. **Reproducible Builds**: Every build uses the same setup, reducing "works on my machine" problems
5. **Version Control**: Deployment configuration is tracked in version control

## Prerequisites

Before using this deployment method, you'll need:

1. A GitHub account with your BasedNet code pushed to a repository
2. A Vercel account linked to your GitHub account
3. A Vercel project created for BasedNet

## Setup Instructions

### 1. Generate a Vercel API Token

1. Log in to your [Vercel dashboard](https://vercel.com/dashboard)
2. Go to Settings → Tokens
3. Create a new token with "Full Account" scope
4. Copy the token value (you won't be able to see it again)

### 2. Add Required Secrets to GitHub

1. Go to your GitHub repository
2. Navigate to Settings → Secrets and variables → Actions
3. Add the following repository secrets:
- `VERCEL_TOKEN`: Your Vercel API token
- `DATABASE_URL`: Your PostgreSQL connection string
- `DB_PASSWORD`: Your database password

### 3. Initial Setup on Vercel

1. From the Vercel dashboard, click "Add New..." → "Project"
2. Import your GitHub repository
3. Configure your project settings:
- Framework Preset: Next.js
- Root Directory: ./
- Build Command: npm run build
- Output Directory: .next
4. Add all required environment variables from your `.env` file
5. Link your local project to Vercel by running:
```
npm run setup:github
```

### 4. Use GitHub Actions for Future Deployments

After the initial setup, all future deployments will happen automatically through GitHub Actions when you push to the main branch.

## How It Works

The workflow file `.github/workflows/deploy.yml` defines the deployment process:

1. **Testing Stage**:
- Sets up a PostgreSQL service for testing
- Runs your test suite against the test database
- Ensures all tests pass before proceeding

2. **Linting Stage**:
- Checks your code for style and potential issues
- Ensures code quality before deployment

3. **Deployment Stage**:
- Only runs if both test and lint stages pass
- Only runs for pushes to the main branch
- Checkout the code from GitHub
- Set up Node.js
- Install dependencies
- Install Vercel CLI
- Pull environment variables from Vercel
- Build the project
- Deploy to Vercel
- Run any required database migrations

## Troubleshooting

If you encounter deployment issues:

1. Check the GitHub Actions logs for detailed build information
2. Verify all required environment variables are set in Vercel
3. Ensure your Vercel token has the correct permissions
4. Check that the Node.js version in the workflow matches your project requirements
5. Look for test or linting errors that might be causing the deployment to fail

## Manual Deployment

You can also trigger a deployment manually:

1. Go to your GitHub repository
2. Navigate to Actions → "Deploy Basednet" workflow
3. Click "Run workflow"
4. Select the branch you want to deploy
5. Click "Run workflow"

This will start the deployment process without requiring a code push.

## Security Considerations

The GitHub Actions workflow is configured to deploy only on pushes to the main branch and manual triggers. This prevents unauthorized deployments from feature branches.

The Vercel token and database credentials are stored securely in GitHub Secrets and are never exposed in logs or outputs.

## Additional Resources

- [GitHub Actions Documentation](https://docs.github.com/en/actions)
- [Vercel CLI Documentation](https://vercel.com/docs/cli)
- [Next.js Deployment Documentation](https://nextjs.org/docs/deployment)
Empty file.
8 changes: 8 additions & 0 deletions .history/jsconfig_20250420051012.json
Original file line number Diff line number Diff line change
@@ -0,0 +1,8 @@
{
"compilerOptions": {
"baseUrl": ".",
"paths": {
"@/*": ["src/*"]
}
}
}
32 changes: 32 additions & 0 deletions .history/next.config_20250416041158.js
Original file line number Diff line number Diff line change
@@ -0,0 +1,32 @@
/** @type {import('next').NextConfig} */
const nextConfig = {
reactStrictMode: true,

env: {
NEXTAUTH_SECRET: process.env.NEXTAUTH_SECRET,
NEXTAUTH_URL: process.env.NEXTAUTH_URL || 'https://basednet.lol',
},
Comment on lines +5 to +8
Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Security Risk: Exposing Secrets to Client-side
The NEXTAUTH_SECRET is included in the env property, which exposes it to the client-side JavaScript bundle. This is a critical security vulnerability, as secrets should only be available on the server. Remove NEXTAUTH_SECRET from the env object and access it only via process.env on the server side.

Recommended Solution:

// Remove NEXTAUTH_SECRET from the env object
env: {
  NEXTAUTH_URL: process.env.NEXTAUTH_URL || 'https://basednet.lol',
},


// Optimize for Vercel deployment
output: 'standalone', // Creates a standalone build that's optimized for Vercel

experimental: {
// Enable modern features
serverComponentsExternalPackages: [], // For better handling of server components
optimizeCss: true, // For CSS optimization
},

// Disable unnecessary source maps in production
productionBrowserSourceMaps: false,

// Improve build performance
swcMinify: true,

// Disable image optimization if not needed (reduces build time)
images: {
unoptimized: process.env.NODE_ENV === 'development',
Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Performance Risk: Image Optimization Based on NODE_ENV
The images.unoptimized flag is set based on process.env.NODE_ENV. If NODE_ENV is misconfigured in production, image optimization will be disabled, leading to degraded performance and increased bandwidth usage.

Recommended Solution:
Ensure that NODE_ENV is correctly set to 'production' in production environments, or consider explicitly setting unoptimized: false for production builds to avoid accidental misconfiguration.

},
};

// Exporting the configuration without Sentry for now
module.exports = nextConfig;
31 changes: 31 additions & 0 deletions .history/next.config_20250419073603.js
Original file line number Diff line number Diff line change
@@ -0,0 +1,31 @@
/** @type {import('next').NextConfig} */
const nextConfig = {
reactStrictMode: true,

env: {
NEXTAUTH_SECRET: process.env.NEXTAUTH_SECRET,
NEXTAUTH_URL: process.env.NEXTAUTH_URL || 'https://basednet.lol',
},
Comment on lines +5 to +8
Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Security Issue: Exposure of Sensitive Environment Variable

The NEXTAUTH_SECRET is included in the env property, which exposes it to client-side JavaScript. This is a critical security risk, as secrets should only be accessible on the server.

Recommended Solution:
Remove NEXTAUTH_SECRET from the env object. Instead, access it directly via process.env.NEXTAUTH_SECRET only in server-side code.


// Optimize for Vercel deployment
output: 'standalone', // Creates a standalone build that's optimized for Vercel

experimental: {
// Enable modern features
optimizeCss: true, // For CSS optimization
serverExternalPackages: [], // For better handling of server components
},

// Disable unnecessary source maps in production
productionBrowserSourceMaps: false,

// Improve build performance

// Disable image optimization if not needed (reduces build time)
images: {
unoptimized: process.env.NODE_ENV === 'development',
Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Logic Issue: Reliance on process.env.NODE_ENV for Image Optimization

The configuration sets images.unoptimized based on process.env.NODE_ENV. Depending on the build environment, this variable may not be set as expected, leading to inconsistent image optimization behavior.

Recommended Solution:
Ensure that NODE_ENV is reliably set during build and consider using Next.js build-time environment variables or configuration flags to control this behavior more predictably.

},
};

// Exporting the configuration without Sentry for now
module.exports = nextConfig;
Loading