Security audit: Fix vulnerabilities and harden application

[Copilot]

Comprehensive security audit identifying and resolving 9 dependency vulnerabilities, type safety gaps, and missing input validation.

Dependency Updates

• Next.js 15.3.3 → 15.5.6: Fixes cache key confusion (GHSA-g5qg-72qw-gw5v), content injection (GHSA-xv57-4mr9-wg8v), and SSRF via middleware redirects (GHSA-4342-x723-ch2f)
• npm audit: Resolved all remaining vulnerabilities (8 packages: @babel/runtime, axios, brace-expansion, form-data, tmp)

Type Safety

Added explicit type annotations to AI flow handlers, eliminating implicit any types:

// Before
async (input) => { ... }

// After  
async (input: ExtractIngredientsInput) => { ... }

Input Validation

Added file size limit (10MB) to image upload handler to prevent DoS:

const maxSizeInBytes = 10 * 1024 * 1024;
if (file.size > maxSizeInBytes) {
  toast({ variant: 'destructive', title: 'File Too Large' });
  return;
}

Data Protection

• Removed SQLite database files from version control
• Updated .gitignore to exclude *.sqlite* files permanently

Verification

• CodeQL: 0 alerts
• npm audit: 0 vulnerabilities
• TypeScript: Clean compilation

Warning

Firewall rules blocked me from connecting to one or more addresses (expand for details)

I tried to connect to the following addresses, but was blocked by firewall rules:

• fonts.googleapis.com
  • Triggering command: /usr/local/bin/node /home/REDACTED/work/eatinformed/eatinformed/node_modules/next/dist/compiled/jest-worker/processChild.js (dns block)

If you need me to access, download, or install something from one of these locations, you can either:

• Configure Actions setup steps to set up my environment, which run before the firewall is enabled
• Add the appropriate URLs or hosts to the custom allowlist in this repository's Copilot coding agent settings (admins only)

Original prompt

check security

---

💬 We'd love your input! Share your thoughts on Copilot coding agent in our 2 minute survey.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Preview	Comments	Updated (UTC)
eatinformed	Ready	Preview	Comment	Nov 13, 2025 10:46am