Reported issues for newsintel

Pod holds 17 of 17 problems reported by people outside the maintainer team. Issues filed by the project's own owners, members and collaborators are excluded entirely — a maintainer's release checklist is not a warning to a prospective user.

Back to newsintel.

Most discussed

Harden /ops/status access with admin scope or internal mode

Outcome

Reduce infrastructure metadata exposure from /ops/status.

In scope

• Add admin-only access strategy (key scope, dedicated token, or internal-only mode)
• Preserve useful diagnostics for operators
• Add tests validating non-admin rejection
• Update SECURITY.md + README operational section

Validation

• npm run typecheck
• npm test
• npm run build

Read the thread · 2026-03-09 · closed · 3 comments

Add Fastify schema for POST /briefing/feedback (validation + response contract)

Outcome

Define strict schema validation and response contract for POST /briefing/feedback.

In scope

• Add route-level schema for body and response
• Keep existing degraded behavior (200/202) explicit in contract
• Add/adjust tests for invalid payload and accepted paths
• Document constraints in README

Validation

• npm run typecheck
• npm test
• npm run build

Read the thread · 2026-03-09 · closed · 3 comments

Add Fastify schema for GET /sources and include contract assertions

Outcome

Add request/response schema for GET /sources and strengthen E2E assertions against the schema-backed contract.

In scope

• Add Fastify route schema to /sources
• Ensure output shape is explicit and version-safe
• Update E2E tests to assert key contract fields
• Update README/OpenAPI notes if needed

Validation

• npm run typecheck
• npm test
• npm run build

Notes

Keep behavior backward-compatible for current consumers.

Read the thread · 2026-03-09 · closed · 3 comments

Simplify portal to one-click X connect and self-serve API key

Outcome

Public self-serve UX: user clicks "Connect X", authorizes, gets API key (shown once) with no manual bootstrap token.

In Scope

• Simplify portal UI to single primary flow (Connect X -> Authorize -> Receive API key)
• Add public self-serve backend flow that does not require user-supplied bearer
• Generate one active key per connected user context (or deterministic per OAuth identity) and return plaintext once
• Keep secure storage (hash only)
• Add anti-abuse guard (basic rate limit

Read the thread · 2026-03-10 · closed · 2 comments

Implement X.com OAuth PKCE + encrypted token storage

Outcome

Implement OAuth 2.0 PKCE with X.com and persist encrypted access/refresh tokens for profile sync jobs.

In Scope

• OAuth start/callback routes and token exchange
• secure token storage with encryption at rest
• token refresh path and expiration handling
• tests for callback success/failure/expired tokens
• docs for env vars and setup

Out of Scope

• UI frontend
• multi-provider social auth

Validation

• npm run typecheck
• npm test
• npm run build

Deliverables

Read the thread · 2026-03-09 · closed · 2 comments

security: lock down OAuth redirect + state handling

Problem

The current X OAuth flow accepts a client-provided redirect_uri and exposes a poll endpoint that can return an issued API key based only on state.

This creates a key-theft path:

1. attacker starts OAuth with attacker-controlled redirect URI
2. victim authorizes on X
3. attacker receives code + state
4. attacker completes callback / polling
5. attacker obtains the victim-issued NewsIntel API key

Scope

• src/routes/oauth.ts
• src/config.ts
• .env.example
• OAuth test

Read the thread · 2026-03-25 · closed · 1 comment

Security: scryptSync on hot path blocks event loop (DoS amplification)

Problem

src/lib/dynamicApiKeys.ts:38 — scryptSync blocks the Node.js event loop. Called on every API request with a dynamic key via auth middleware.

function hashApiKey(plaintextKey: string, salt: string) {
  return crypto.scryptSync(plaintextKey, salt, 64).toString('hex');
}

Risk Level

medium

Impact

Attacker can amplify DDoS by sending many requests with ni_live_* prefixed tokens, each forcing synchronous scrypt computation blocking the event loop.

Recomm

Read the thread · 2026-03-10 · closed · 1 comment

Security: Hardcoded default secrets in docker-compose.yml

Problem

docker-compose.yml:11-14 — Default secrets hardcoded:

API_KEYS: \${API_KEYS:-dev-newsintel-key}
OPS_ADMIN_KEY: \${OPS_ADMIN_KEY:-dev-ops-admin-key}
TOKEN_ENCRYPTION_SECRET: \${TOKEN_ENCRYPTION_SECRET:-dev-token-encryption-secret-change-me}

Risk Level

medium

Impact

If deployed without customization, any attacker who reads the open-source repo knows all secrets.

Recommended Fix

Remove defaults for security-sensitive values. Fail fast if not explicitly set. Add

Read the thread · 2026-03-10 · closed · 1 comment

Most recent

security: isolate merge credentials from PR-executed CI jobs

Problem

Sensitive GitHub Actions jobs currently run on internal PR branches with write-scoped permissions and merge-related credentials in the same workflow family.

Fork PRs are blocked, which is good, but internal PRs still represent a meaningful blast radius if a maintainer/collaborator account is compromised.

Scope

• .github/workflows/qa-guardian.yml
• .github/workflows/qa-autofix.yml
• possibly split workflows

Required changes

• Separate review/test execution from auto-merge

Read the thread · 2026-03-25 · closed · 0 comments

oss: add API deprecation headers and sunset notice mechanism (RFC 8594)

Problem

The project has a well-defined deprecation policy in docs/RELEASE_POLICY.md and legacy route redirects in src/app.ts:106-126, but there is no machine-readable deprecation signaling. Clients and integrations cannot programmatically detect deprecated endpoints.

Impact

• Silent breakage: Clients using deprecated routes (e.g., /briefing → /v1/briefing) receive no warning that the redirect may be removed.
• Integration reliability: AI agents and MCP clients relying on

Read the thread · 2026-03-12 · closed · 0 comments

sec: auth degraded mode silently weakens security guarantees

Problem

src/lib/dynamicApiKeys.ts falls back to an in-memory key store when the database is unreachable. In degraded mode:

1. Only keys created during the current process lifetime are validated.
2. Keys created in prior runs (or by other instances) are invisible — potentially allowing revoked keys to work if the DB is restored with different state.
3. The degraded state is exposed via /readyz but there is no active alerting, log escalation, or metric to trigger operator attention.

Read the thread · 2026-03-12 · closed · 0 comments

ops: implement graceful shutdown (SIGTERM handler, connection draining)

Problem

src/index.ts starts the Fastify server, schedulers, and queue workers but registers no signal handlers. When the container/process receives SIGTERM (e.g., Kubernetes rolling update, docker stop), the process is force-killed after the grace period, dropping in-flight requests and interrupting background jobs.

Related: #147 (closed but not resolved based on current code).

Impact

• Dropped requests: In-flight HTTP requests receive no response, causing client-side errors.

Read the thread · 2026-03-12 · closed · 0 comments

Create NewsIntel MCP server (token-per-user, dynamic integration)

Build an MCP server for NewsIntel that works with per-user API tokens, enabling dynamic personalized retrieval for secretaries/agents and third-party AI clients.\n\nScope:\n- standalone MCP server package in repo\n- tools: sync_profile, get_profile, get_news_briefing\n- each tool accepts (user token) to support multi-tenant integrations\n- configurable API base URL\n- README with integration examples\n\nValidation:\n- server starts via stdio\n- tool calls hit live API and return structured JSON

Read the thread · 2026-03-11 · closed · 0 comments

Security: /metrics endpoint exposed without authentication

Problem

src/routes/metrics.ts:4-9 — The Prometheus /metrics endpoint has no authentication.

Risk Level

high

Impact

Exposes internal operational metrics (sync failures, request counts, workspace IDs, user keys in labels) to any unauthenticated caller. Leaks infrastructure information useful for reconnaissance.

Recommended Fix

Add bearerAuth or opsAdminAuth as a preHandler, or restrict to internal network.

Change class

hotfix

Part of #100

Read the thread · 2026-03-10 · closed · 1 comment

Security: Workspace ID from untrusted header enables cross-tenant access

Problem

src/lib/userKey.ts:5-7 — Workspace ID is derived entirely from client-supplied X-Workspace-Id header with no validation against authenticated user's actual workspace membership.

export function workspaceIdFromHeaders(headers?: Record<string, any>) {
  const raw = String(headers?.['x-workspace-id'] || headers?.['X-Workspace-Id'] || '').trim();
  return (raw || config.defaultWorkspaceId).toLowerCase();
}

Risk Level

high

Impact

Any authenticated user can se

Read the thread · 2026-03-10 · closed · 1 comment

Security: In-memory fallback silently bypasses database for auth operations

Problem

Multiple auth-critical functions silently catch database errors and fall back to in-memory Maps:

• src/lib/dynamicApiKeys.ts:103-127,154-159,184-186,220-229
• src/lib/xOAuthTokens.ts:87-89,131-133

Functions affected: createDynamicApiKey, isValidDynamicApiKey, listDynamicApiKeys, upsertXOAuthTokens, getXOAuthTokens

Risk Level

high

Impact

• A revoked key in the database might still validate against the in-memory fallback
• OAuth tokens stored only in volatile memo

Read the thread · 2026-03-10 · closed · 1 comment

Security: Ops admin key comparison vulnerable to timing attack

Problem

src/routes/ops.ts:23 — The opsAdminAuth function compares the admin key using !== (strict equality), which is vulnerable to timing attacks. An attacker can progressively guess the admin key character-by-character by measuring response time differences.

if (adminKey !== config.opsAdminKey) {

Risk Level

critical

Impact

An attacker with network access could extract the ops admin key through statistical timing analysis.

Recommended Fix

Use `crypto.timi

Read the thread · 2026-03-10 · closed · 1 comment

The remaining reports are on the project's issue tracker.