ThreatCrush Monorepo Security Assessment
Notice: All security vulnerabilities, architectural flaws, and risk vectors documented in this audit report have been 100% remediated and verified in production (HEAD). This technical assessment is published with explicit authorization from Profullstack INC for technical reference and transparency.
1. Executive Summary & Scope
Comprehensive whitebox static source code audit combined with dynamic HTTP exploitation on an isolated Podman container. Evaluated the complete ThreatCrush monorepo stack against CVSS v3.1 and OWASP standards. Total findings: 40 vulnerabilities (2 Critical, 9 High, 12 Medium, 17 Low). 11 findings (28%) represented verified direct business-impact risks. All findings fully remediated.
2. Critical Findings & Technical Proofs (Remediated)
TC-01: RLS Privilege Escalation (CVSS 9.9 — Critical)
The Row Level Security (RLS) policy on user_profiles lacked a WITH CHECK expression. Any authenticated user could send an UPDATE payload setting is_admin = true, gaining unrestricted platform control.
TC-32: Unauthenticated Root RCE in Daemon (CVSS 9.8 — Critical)
The background daemon process (threatcrushd) evaluated dynamic modules from unauthenticated network sockets without cryptographic signature validation, allowing remote code execution as root.
QryptChat Web Security & Architecture Assessment
Notice: All security vulnerabilities, architectural flaws, and risk vectors documented in this audit report have been 100% remediated and verified in production (HEAD). This technical assessment is published with explicit authorization from Profullstack INC for technical reference and transparency.
1. Executive Summary & GHSA Publication
Assessment of the QryptChat messaging platform. Identified 56 Security Findings & 37 E-SWE architectural flaws across 2 audit passes. Findings disclosed responsibly under GHSA publication GHSA-3hqc-9v44-j37g. 19 findings (34%) represented verified business impact risks. All findings 100% remediated.
2. Critical Vulnerability Highlights (Remediated)
Participant Injection & Global Read (CVSS 8.3 — Critical)
Flaws NEW-01 and V-002 allowed arbitrary attackers to inject themselves into private E2EE conversation rooms and execute global reads over the entire user database table.
rssamplifier Security Assessment
Notice: All security vulnerabilities, architectural flaws, and risk vectors documented in this audit report have been 100% remediated and verified in production (HEAD). This technical assessment is published with explicit authorization from Profullstack INC for technical reference and transparency.
1. Executive Summary & Scope
Whitebox source audit and dynamic exploitation of rssamplifier. Identified 68 total findings (0 Critical, 11 High, 18 Medium, 29 Low, 10 Informational). 36 findings (53%) represented verified business impact risks. All issues 100% remediated.
2. High Risk Highlights (Remediated)
Stored XSS & Unbounded Paid-API Spend (High Risk)
Confirmed Stored XSS in public RSS feed rendered pages plus unthrottled outbound API proxying that permitted unauthenticated API budget exhaustion. Full PoCs and remediation SQL queries delivered.
Project PUX Security Assessment
Client identity withheld — published anonymously with authorization
1. Executive Summary
Full-scope static whitebox assessment of a real-time collaboration SaaS spanning web application, Electron desktop client, Expo/React Native mobile app, and a Supabase backend (47 SQL migrations). Every finding was established by line-by-line source reading (source→sink) with an independent adversarial verification pass. 170 confirmed findings: 5 Critical, 17 High, 47 Medium, 101 Low. 80 findings (47%) carry confirmed business impact under conditions that hold today — subscription billing as the primary financial asset. Overall risk rating: CRITICAL.
2. Critical Findings Highlights
Unauthenticated Plan Grant — Full Billing Bypass (PUX-001 · CVSS 9.2)
A SECURITY DEFINER function granting subscription plans performs zero auth.uid() validation and zero REVOKE EXECUTE FROM PUBLIC — a pattern present across all 47 SQL migrations. A single unauthenticated RPC call grants any user any paid plan for any duration. Chained with PUX-006 (unbounded duration parameter, CVSS 8.2) and PUX-011 (plan mass-assignment via RLS column update, CVSS 7.1), three independent paths lead to unlimited free access to every paid tier.
Password Reset Without Recovery-Type Check — Account Takeover Chain (PUX-002 · CVSS 9.3)
The reset endpoint validates token signature and expiry but never checks the authentication method or token type: any ordinary access token suffices to overwrite a victim password server-side. Chained with session-token leakage via URL and a wildcard CORS policy, this yields full account takeover without ever touching the victim email.
Unauthenticated Host Takeover in Live Sessions (PUX-003 · CVSS 9.1)
A SECURITY DEFINER room function promotes participants to host without any ownership or role verification — a code comment states it "should be called by service role", but nothing enforces it. Any anonymous caller promotes the first connected participant and takes control of an active session. The sibling transfer function correctly validates identity, marking the flaw as an implementation drift, not a design decision.
3. High-Risk Highlights by Attack Surface
- Supply Chain & Distribution: macOS Gatekeeper quarantine silently stripped pre-consent (PUX-004); self-updating launchers re-execute remote scripts on every update — a persistent backdoor channel once compromised (PUX-005); passphrase-less GPG key in CI able to sign attacker-crafted packages (PUX-010).
- Real-Time Media Plane: Viewer data-channel broadcasts without destination restriction and inbound sender identities discarded (PUX-007/008) let any participant forge kick/mute/control commands against others; LiveKit token IDOR enables impersonation of any participant and host-session orphaning DoS (PUX-014/015).
- Desktop Client: Renderer-controlled path traversal reaching arbitrary file write in the main process (PUX-009); plaintext credential fallback with world-readable permissions on Linux (PUX-016);
javascript:/data:scheme bypass in chat link handling (PUX-018); unsanitized markdown stored into public live pages — stored XSS surface (PUX-019); plaintext "Remember Me" credentials exposed over IPC (PUX-020). - Authorization Model: Session-control grants revocable by any participant via API and independently via direct RLS self-grant (PUX-012/013) — fixing the route alone would leave the PostgREST bypass open; crafted share links resume arbitrary sessions without ownership validation (PUX-021).
4. Systemic Anti-Patterns
These are not isolated bugs but repeated construction patterns across independently written modules — fixing single instances leaves siblings exploitable:
01 · Zero privilege revocation
Not a single REVOKE EXECUTE across 47 migrations — every SECURITY DEFINER function callable with the public anon key.
02 · curl|bash supply chain
Installer, updater and infrastructure bootstrap execute remote scripts without signature or checksum verification.
03 · Unauthenticated IPC boundary
The context bridge forwards any channel to privileged main-process operations without runtime caller validation.
04 · Sed-based config templating
Media-server entrypoints interpolate secrets through sed substitutions vulnerable to special-character injection.
05 · Mutable infrastructure images
Core media infrastructure pulled from floating :latest tags — no digest pinning anywhere.
06 · Unprotected signing keys
Package-signing GPG material generated without passphrase protection and injected as CI secret.
5. Coverage & Verification Discipline
Every finding was corroborated against source reading each referenced mechanism line-by-line (source→sink); where a mechanism was verified but mitigated by code or platform behavior, severity was adjusted downward with the reason documented on the record. 8 candidate findings were actively refuted and excluded (KILLED); 9 potential findings remain tagged INFERIDO pending dynamic confirmation, plus 1 formal hypothesis. Business impact was rated under the OWASP Risk Rating Methodology, orthogonal to technical severity: 80 findings qualify under today’s conditions — 36 requiring immediate action.
6. Remediation Status
Report delivered 2026-08-24. This engagement covered the static phase; a live dynamic verification pass is scheduled as the next deliverable to confirm the INFERIDO set and re-test critical chains post-patch. Remediation tracking runs privately with the engineering team.