unicodeveloper / unicodeveloper/globalthreatmap
No rate-limiting, no CORS policy, no CSP headers
Nobody has claimed this yet.
- Dominant language
- TypeScript
- Stars
- 1.8k
- Forks
- 300
- PR merge metrics
- No merged PRs in 30d
Description
- Context: Cloud
- Category: Vulnerability
- Severity: High
Evidence
next.config.ts contains only:
// next.config.ts
const nextConfig: NextConfig = {
reactStrictMode: true,
};
No headers() configuration is present. As a result:
| Missing control | Risk |
|---|---|
Rate limiting on /api/* |
Abuse of Valyu/OpenAI API keys by any client; DoS via credit exhaustion |
Content-Security-Policy |
Increases XSS impact severity (token theft from localStorage) |
Strict-Transport-Security |
Browser does not enforce HTTPS on subsequent loads |
X-Frame-Options / frame-ancestors |
Clickjacking attacks possible |
| CORS policy | Any website can make cross-origin requests to the API routes |
X-Content-Type-Options |
MIME-sniffing attacks |
API routes such as /api/events (POST), /api/reports (POST), and /api/entities (GET) are callable by any origin with no restriction. An attacker who discovers the endpoint can exhaust Valyu and OpenAI credits by submitting bulk requests.
Affected files: next.config.ts
Contributor guide
No contributing guide indexed for this repository
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start by reading next.config.ts and inspect the listed /api/events, /api/reports, and /api/entities routes to understand how requests are handled. The issue identifies missing rate limiting, CORS, CSP, and security headers; done means these controls are implemented for the affected API surface and their behavior is verified.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- next.js, typescript
- Domain
- api, backend, security
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Quiet
- Clarity
- Mostly clear
- Newbie friendliness
- 45/100