Inspection report: sample-shop

I only read files. Nothing was changed, installed or run beyond git commands, and I made no ledger entry because this skill only asks for one when files change, checks run or outside services are called.

Git state

• Branch: main. The working tree is clean, so there's no uncommitted work to protect.
• History (2 commits): 377d861 added the pages, contact form, orders API and admin page. 0f8a8b1 added the project map and ledger in .mos/.
• git diff --stat: empty.
• Project map: .mos/project-map.md was recorded at 377d861. Since then only .mos/ files changed, so the map is still accurate and I checked it against the code.

Stack

Pages and API endpoints

None of the routes handle errors, check their input or limit request rates. Nothing in the app calls either API.

Data, rules and integrations

• Firestore orders: there's no defined shape for an order. It's whatever the caller sends (observed).
• firestore.rules:4: allow read, write: if true lets anyone who has the project ID read, change or delete every order through the Firebase client libraries (observed). The server routes use the admin SDK, which skips these rules anyway (inferred).
• Environment variable names in .env.example: FIREBASE_PROJECT_ID is read at lib/firebase.js:3. SMTP_USER and SMTP_APP_PASSWORD are never read (observed).
• Firebase credentials: none are passed in code, so the app falls back to the host's default Google credentials (inferred).
• Email: SMTP is set up in the env file but not built, and no mail library is installed (observed).
• Login, payments, file storage, analytics, AI providers: none found (observed).

Checks

• Scripts: dev, build and start only (package.json:4). There are no tests, linting or type-checking (observed).
• I ran no checks. A build would need npm install, which this read-only skill doesn't allow. There are no tests to run.

Deployment

• Hosting: there's no vercel.json, firebase.json, Dockerfile or CI setup (observed). It probably targets Vercel or a generic Node host (inferred).
• Firestore rules: no config shows whether they are deployed.

Risks

1. Public database rules: anyone can read and write all orders.
2. Open orders API: order data can be read without logging in, and anyone can write unchecked records.
3. Admin page: /admin has no login. It's harmless today because it shows no data, but it will matter once it does.
4. Contact form: the endpoint silently drops messages, and the /contact page doesn't exist.
5. Route safety: there's no error handling, rate limiting, input checking or check that environment variables are set at startup.
6. No .gitignore: a real .env file could be committed by accident.
7. No lockfile: Next 15.0.0 is an early release with security advisories that later patches fix. npm audit was not run.

Unknowns

• Where the app is deployed, and whether it's live.
• Which Firestore rules are actually deployed.
• How Firebase credentials are supplied at runtime.
• What an order should contain, and who may create or read orders.
• Which SMTP provider sends contact messages, and who receives them.

TASK: Read-only inspection of sample-shop
STATUS: Review — inspection complete, no changes made
LANES: single
TESTS: 0 passed, 0 failed, 0 not run (no test suite exists; build/npm audit NOT RUN — needs npm install)
DEPLOYMENT: 0f8a8b1 — not deployed / deployment target unknown
APPROVALS: none pending
RISKS: public read/write Firestore rules; unauthenticated, unvalidated orders API; unprotected /admin; contact submissions dropped, /contact missing; no .gitignore or lockfile; next@15.0.0 advisories unchecked
NEXT: Choose whether to (a) plan fixes starting with Firestore rules and orders API auth (security/data approvals required), (b) allow npm install + build + npm audit, or (c) confirm deployment target and Firebase credentials setup

Project map — sample-shop

• Commit: 377d8611206c1503b3a4777ca35d27b549171862 (main, "Sample Shop: pages, contact form, orders API, admin")
• Date: 2026-11-11
• Working tree at mapping time: clean
• Previous map: none (first map — no drift to report)

Legend: [O] observed in the named file · [I] inferred (not directly evidenced)

Stack

Pages / routes

Shared components and layouts

API endpoints / server actions

No route has try/catch; errors surface as unhandled 500s. [O]

Data stores and collections

Document schema for orders: undefined — whatever the client posts. [O]

Security rules and policies

Environment variables (names only)

Firebase Admin credentials: none passed explicitly; initializeApp will rely on Application Default Credentials (GOOGLE_APPLICATION_CREDENTIALS or the hosting runtime's service account). [I] No env validation at startup. [O]

External integrations

Background jobs and schedules

None found (no cron config, no vercel.json, no Cloud Functions). [O]

Deployment targets and config

Tests

None. No test runner, no test files, no test script. All areas uncovered. [O]

Dependency table

Risks observed (for follow-up; not fixed by this service)

1. firestore.rules allows public read/write of orders.
2. GET /api/orders exposes order data without authentication.
3. POST /api/orders accepts unauthenticated, unvalidated arbitrary JSON.
4. /admin has no authentication (currently harmless — renders no data).
5. Contact form endpoint silently drops submissions; /contact page missing (broken link on /).
6. No try/catch, rate limiting, input validation or env validation on any route.
7. No .gitignore — a local .env or node_modules could be committed accidentally.
8. No lockfile; next@15.0.0 is an early 15.x release with published security advisories in later patch releases — check npm audit (not run).

Unknowns

• Where the app is deployed and whether a production deployment exists.
• Whether firestore.rules has been deployed to the Firebase project, and what rules are live.
• How Firebase Admin credentials are provided at runtime.
• Intended orders schema and who should be allowed to create/read orders.
• Intended SMTP provider and recipient for contact submissions.
• Whether there are other Firestore collections in the live project not referenced by code.

Scope Contract: lock down orders and make the contact form send email

Basis: repo at 0f8a8b1. .mos/project-map.md was made at 377d861, and only .mos/ files have changed since, so the map is still accurate. Working tree clean. Today is Wed 2026-11-11, so the deadline is Fri 2026-11-13.

Questions to answer in your edits:

• Q1 Who may create orders? I recommend admins only, since nothing in the repo calls POST. If you choose public, I'll keep POST open but validated against a field allowlist and rate-limited.
• Q2 Which inbox should contact mail go to, and which account sends it?
• Q3 Admin email address(es)?
• Q4 Where is the app hosted, and how does it get Firebase admin credentials?
• Q5 Sign in with email/password (recommended) or Google?

Tasks

Parallel lanes

• Lane 0 (sequential, first): T0 → T1. These change package.json, .env.example and lib/firebase.js, which everything else depends on. Adding all dependencies and env var names up front means no later lane needs to touch those files.
• Lane A (sequential): T2 → T3, T4, T5, T6. These all share lib/auth.js, the session cookie and the Firebase Auth env vars, so they stay in one lane.
• Lane B: T8 → T9. These touch only the contact files and the SMTP env vars. They share no files, collections, rules or deploy settings with A or C.
• Lane C: T7. It touches only firestore.rules and firebase.json. The server code uses the admin SDK, which ignores Firestore rules, so this lane doesn't affect A.
• Final (sequential): T10 → T11 → T12.

Suggested order for Friday: do T7 and A7a on Thursday. That closes the open Firestore hole without waiting for the app deploy.

Costs (nothing gets purchased)

I didn't fetch pricing pages this session. Treat every line as verify at checkout.

• Firebase Authentication, email/password: free on Spark and Blaze for up to about 50k monthly active users (from my knowledge, not checked today). Phone/SMS sign-in costs extra and isn't used here. Source: firebase.google.com/pricing.
• Firestore: already in use, no change in usage.
• Gmail SMTP with an app password: free on a personal Gmail account (needs 2-Step Verification), with a limit of roughly 500 sends a day. Sending from a business domain needs Google Workspace; plans are listed at workspace.google.com/pricing.
• npm packages: firebase, nodemailer, vitest, @firebase/rules-unit-testing, firebase-tools are open source and free.
• Hosting: unchanged, provider unknown (Q4).

Approve, edit, or reject? I'll wait for your answer, and answers to Q1–Q5, before changing anything. Once you approve, I'll save this to .mos/approved-brief.md with the date and your exact edits.

TASK: Admin-only orders + contact form email (deadline Fri 2026-11-13)
STATUS: Planned — Scope Contract and 13-task plan waiting for approval
LANES: Lane 0 (T0–T1) → parallel A (auth/orders), B (contact), C (rules) → final review/verify/deploy
TESTS: 0 passed, 0 failed, all not run (planning only; repo has no tests yet)
DEPLOYMENT: not deployed (HEAD 0f8a8b1; live hosting unknown)
APPROVALS: plan approval pending; A1–A7 to be requested at their tasks
RISKS: Firestore rules publicly read/write right now; Next 15.0.0 advisories; admin credentials/hosting unknown; per-instance rate limit; possible outside client-SDK use of orders
NEXT: Approve, edit or reject the plan, and answer Q1–Q5

I didn't write a ledger entry for this step because no files were changed and no external services were called. The only commands run were read-only git commands.

I found 2 critical and 3 high-severity issues. The most urgent: the Firestore rules let anyone read, change or delete every order, and the orders API has no login check at all. The installed Next.js and React versions are also in ranges with a published unauthenticated remote-code-execution advisory.

What I checked (commit 0f8a8b1): I read every file in the repo. The map from 377d861 is still accurate, since only .mos/ files changed after it.

• Secrets: none committed. The search covers history too, because the app files haven't changed since the first commit.
• Logging: the app logs nothing, so nothing sensitive leaks, but there's also no record of who did what.
• npm audit: not run. There's no lockfile, and creating one in the scratchpad was blocked by this session's permissions. The dependency finding (C3) comes from published advisories I know of, not from an audit.
• Ledger: writing to .mos/ledger.md was blocked by the same permissions, so the entry has not been added. The text is ready; say the word and I'll append it.

Critical

C1. The database rules allow public read and write: firestore.rules:4 (allow read, write: if true)

• Attack: the Firebase project ID is meant to be public. Anyone with it can use the client SDK to read every order, change or delete orders, and write junk you pay to store.
• Fix: allow read, write: if false;. The server's Admin SDK ignores these rules, so the API keeps working. Later, add an admin-only rule if needed.
• Unknown: whether this file has been deployed. Check the live rules in the Firebase console.

C2. Anyone can list orders: app/api/orders/route.js:2-5

• Attack: an anonymous GET /api/orders returns the full contents of up to 20 orders, including any names and addresses stored in them.
• Fix: check the user's sign-in token on the server and require an admin role. Return only the fields the admin view needs.

C3. Vulnerable framework versions: package.json:5 (next@15.0.0, react@19.0.0)

• Attack: these versions fall inside the published React Server Components advisories (CVE-2025-55182 / CVE-2025-66478), which allow unauthenticated remote code execution against App Router apps. This app uses the App Router.
• Other advisories: a middleware auth bypass (CVE-2025-29927, fixed in 15.2.3) will matter as soon as login is added through middleware.
• Fix: upgrade to the latest patched 15.x of next and the matching react/react-dom, commit a lockfile, then run npm audit.

High

H1. Orders can be forged: app/api/orders/route.js:6-10

• Attack: whatever JSON a caller sends is stored as an order, with no login and no checks. Anyone can create orders with a made-up price or "paid": true, overwrite fields, or send documents up to 1 MiB to run up costs.
• Fix: require sign-in, check the request against a schema that only allows known fields and caps size, and work out prices and status on the server. Store the customer's user ID on each order.

H2. No rate limiting on any route (/api/orders, /api/contact)

• Attack: spam, write floods and a growing Firestore bill.
• Fix: a per-IP limit, and/or Firebase App Check.

H3. Customers aren't separated from each other

• Orders have no owner field, so once customers can view their own orders, the code has no way to restrict them to their own.
• Fix: add a uid field and filter queries by the signed-in user. This also needs a matching database rule.

Medium

• M1. No error handling (orders/route.js:3,7-8; contact/route.js:2): sending malformed JSON or a Firestore failure produces an unhandled 500 with no log entry. Add try/catch, return 400 for bad input, and log errors with personal data removed.
• M2. /admin needs no login (app/admin/page.js:1): it shows no data today, but it becomes C2 as soon as it does. Check login and role inside the page or its layout on the server. Don't rely on middleware alone.
• M3. No .gitignore: a local .env file or a service-account key file could be committed by accident. Ignore .env* (keep .env.example), node_modules, .next and *service-account*.json.

Low

• L1. No startup check of settings (lib/firebase.js:3): if FIREBASE_PROJECT_ID is missing, the app quietly falls back to whatever credentials the host provides.
• L2. Contact form (contact/route.js): submissions are thrown away. When email sending is added, validate and limit the length of fields, and strip line breaks from header fields to block email header injection. SMTP_APP_PASSWORD is not used anywhere yet.

Needs a specialist

• Penetration test: before launch, once the fixes for C1–H3 are in.
• Legal / compliance: if the open rules (C1) were ever live with real customer data, get a privacy lawyer to assess whether this was a reportable breach under GDPR or CCPA. The Firestore audit logs show whether anyone accessed the data.
• Payments: card details must never go into orders. Use a hosted checkout from a payment provider so PCI DSS card-security rules stay minimal.

Fixes awaiting your approval

A1, A2 and A3 change security or authentication, so another reviewer will check those changes before I propose merging them.

TASK: Security review of sample-shop (read-only)
STATUS: Review — 2 critical, 3 high, 3 medium, 2 low findings
LANES: single
TESTS: 2 passed (file review, secret search), 0 failed, 2 not run (npm audit and git history search: blocked by permissions; no test suite exists)
DEPLOYMENT: 0f8a8b1 — not deployed (no deployment config)
APPROVALS: A1–A5 pending; ledger write blocked by permissions, entry not added
RISKS: live Firestore rules unknown; dependency advisories not confirmed by npm audit; whether data was exposed is unknown
NEXT: approve A1 + A3 first (urgent), then A2/A5; allow the ledger write and npm audit

I fixed the crash: POST /api/contact now returns a 400 instead of a 500 when the body isn't valid JSON. The new test failed on 3 of 4 cases before the fix and passes 4 of 4 after it. I haven't run the app itself or next build, because there's no node_modules here.

Cause: app/api/contact/route.js:2 calls await req.json() with no error handling. A malformed, empty or plain-text body throws a SyntaxError there, and Next.js turns that into a 500.

Fix (app/api/contact/route.js, branch fix/contact-invalid-json, commit b92811b):

• If the body can't be read as JSON, it returns 400 with { ok: false, error: "Request body must be valid JSON." }.
• I also wrapped the whole handler in a try/catch, as the project's policy requires. Any other error returns a plain 500 message and logs only the error type, never what was submitted.
• Valid requests behave the same as before (200 { ok: true }).
• Risk is low: only bad requests change behaviour, and they now get a 400 where they used to get a 500.

Test (tests/contact-route.test.mjs): it uses Node's built-in test runner, so it needs no new packages. It checks one valid request and three bad ones (malformed JSON, plain text, empty body).

• Before the fix: 1 passed, 3 failed with the SyntaxError at route.js:2.
• After the fix: 4 passed. Command: node --test tests/contact-route.test.mjs, on Node v22.23.4.

Also:

• There's no test script in package.json; adding one would go beyond the scope you approved. Until then, run the test with node --test tests/.
• I added an entry to .mos/ledger.md as the project policy requires, in a separate commit (bb7450f), so you can drop it from the PR if you want.
• Nothing has been pushed or deployed.

TASK: Return 400 instead of 500 when POST /api/contact gets a body that isn't valid JSON
STATUS: Review — fixed on branch fix/contact-invalid-json (b92811b + ledger bb7450f), not pushed
LANES: single
TESTS: 4 passed, 0 failed (node --test tests/contact-route.test.mjs); not run: next build, HTTP request to a running app, npm audit
DEPLOYMENT: not deployed (bb7450f exists only locally)
APPROVALS: none pending
RISKS: not checked inside the actual Next.js runtime; the contact form still throws submissions away and has no field validation or rate limiting; no test script in package.json
NEXT: push the branch and open a PR? and whether to approve adding "test": "node --test tests/" to package.json

Here's where things stand. The contact-form fix is finished and its tests passed, but it hasn't been reviewed, pushed or deployed yet. I didn't change any files.

Sources read: .mos/ledger.md, .mos/project-map.md, git status, git log and the branches. There is no .mos/approved-brief.md, so no Scope Contract has been approved yet.

Repo: you're on branch fix/contact-invalid-json. Nothing is uncommitted. It is 2 commits ahead of main (b92811b is the fix and bb7450f is its ledger entry), and main itself is at 0f8a8b1.

Deployment: NOT CHECKED. The repo has no git remote and no hosting config (no vercel.json or firebase.json), and neither the vercel nor the firebase CLI is installed. So nothing tells me where bb7450f would deploy.

Project map: it is out of date. It was made at 377d861, and app/api/contact/route.js, which the map covers, has changed since. Run map again before relying on it for the contact endpoint.

Board

Lanes: single.

NOT RUN / NOT VERIFIED

• next build: NOT RUN (node_modules isn't installed).
• A real request to a running dev server: NOT RUN.
• npm audit: NOT RUN.
• Deployment of bb7450f: NOT CHECKED (no remote and no hosting set up).
• The map doesn't reflect the contact route as it is now.

Open risks (from the ledger and map)

• Firestore: the orders rules let anyone read and write.
• Orders API: it has no login check and no input validation.
• /admin: the page has no protection.
• Contact form:
  • It still throws submissions away and has no field validation or rate limiting.
  • The /contact page it links to is missing, so it returns 404.
• SMTP: the variables are defined but nothing uses them.
• Repo hygiene:
  • There's no .gitignore or lockfile.
  • There's no test script in package.json.

No ledger entry was added because this service only read files and git state.

TASK: Contact-form fix — return 400 instead of 500 on invalid JSON (branch fix/contact-invalid-json)
STATUS: Review — committed at b92811b (+ ledger bb7450f); 4/4 unit tests passed; not pushed, merged or deployed
LANES: single
TESTS: 4 passed, 0 failed, 3 not run (passed: node --test tests/contact-route.test.mjs; not run: next build, real request to a dev server, npm audit)
DEPLOYMENT: bb7450f — NOT CHECKED (no remote, no hosting config, no hosting CLI); not deployed
APPROVALS: none pending with IDs; merge/push of fix/contact-invalid-json needs your explicit approval
RISKS: orders Firestore rules let anyone read/write; orders API has no login or validation; /admin unprotected; contact form discards submissions and /contact page is 404; map out of date; no .gitignore or lockfile; fix not checked on a running app
NEXT: Review the fix and decide whether to merge it into main. Separately, tell me where the app is hosted, and whether to run /master-of-all-skills:map and /master-of-all-skills:plan for the security risks.