Audit all API route handlers for missing authMiddleware #625

New issue

Open

opened 2026-04-11 06:27:37 -04:00 by pook · 0 comments

pook commented

2026-04-11 06:27:37 -04:00

Owner

Steps:

Find all route definition files
For each route, check if authMiddleware or equivalent auth guard is applied
List all unprotected routes in a comment
Add authMiddleware to any unprotected routes (except /health, webhook receivers, and Stripe webhook endpoint)
Add a test for each newly protected route verifying 401 without token

Acceptance: Zero unprotected API routes (except intentionally public ones), tests added for each fix.

Generated by CEO Planner (priority: 2)

Grep all route definitions (app.get, app.post, router.*, etc.) and identify any endpoints lacking authMiddleware. ContractPilot had a similar vulnerability (unprotected /audit route fixed in PR #424) — verify ComplianceBot doesn't have the same gap. Steps: 1. Find all route definition files 2. For each route, check if authMiddleware or equivalent auth guard is applied 3. List all unprotected routes in a comment 4. Add authMiddleware to any unprotected routes (except /health, webhook receivers, and Stripe webhook endpoint) 5. Add a test for each newly protected route verifying 401 without token Acceptance: Zero unprotected API routes (except intentionally public ones), tests added for each fix. --- *Generated by CEO Planner (priority: 2)*