🛡️ Bright Security Scan

[bararchy]

🛡️ Bright Security Scan

Scan target: repository root at http://localhost:3000

• ✅ Detecting tech stack
  • Tech stack: JavaScript, TypeScript, Go, PostgreSQL
• ✅ Building and starting the application
  • Application running at http://localhost:3000 (repository root)
• ✅ Setting up Bright security scanner and Repeater
  • Repeater connected
• ✅ Preparing application for security scanning
  • DAST preparation completed: no application rate limiter was found, CSRF is permissive, persistent DAST settings were applied, the app was rebuilt, and six rapid real login-actio…
• ✅ Detecting authentication requirements
  • Auth configured (after infra repair)
• ✅ Building route inventory
  • 121 scan-eligible endpoints (agentic route inventory)
• ✅ Registering API endpoints for scanning
  • 103 live entrypoints after pruning 404s
• ✅ Selecting relevant security tests per endpoint
  • Created 10 scan group(s) with per-endpoint test selection
• ✅ Running scans — round 1
  • Auth broken after fixes — cannot continue scanning
• ✅ Fixing 5 vulnerabilities — round 1 (gpt-5.6-luna)
  • Round 1: 0 fix(es) applied, 5 skipped — model: gpt-5.6-luna
• ✅ Authentication broke after round 1 fixes and could not be repaired. 0 fixes were applied and could NOT be fully rolled back — review the branch.

Findings

Severity	Vulnerability	Endpoint	Status
Medium	Cross-Site Request Forgery (CSRF)	OPTIONS http://localhost:3000/_api/user/regenerate-apikey	🔴 Open
Medium	Cross-Site Request Forgery (CSRF)	OPTIONS http://localhost:3000/_api/notifications/read-all	🔴 Open
Medium	Insecure HTTP Method OPTIONS	OPTIONS http://localhost:3000/	🔴 Open
Medium	Cross-Site Request Forgery (CSRF)	OPTIONS http://localhost:3000/api/v1/posts/1/subscription	🔴 Open
Medium	Cross-Site Request Forgery (CSRF)	OPTIONS http://localhost:3000/api/v1/posts/1/votes	🔴 Open