App Security Assessment Report

Vulnerable code

@router.post("/register")
def register(credentials: Credentials):
    email = check(credentials)
    body = call("/signup", {"email": email, "password": credentials.password})
    return session_from(body)

Root cause

register() only validates email shape/password length client-side-equivalent (check()) and then forwards straight to Supabase /signup; when the project's email confirmation is off, session_from() returns a fully usable access_token immediately, with no rate limiting or verification step in front of it — confirmed live by an auth-probe that posted random throwaway credentials and got back a valid, immediately-usable JWT and refresh token.

Impact

An attacker can script unlimited account creation with disposable addresses, each minting a fresh authenticated session in one request; combined with usage.py's per-account $5 LLM budget, this lets an attacker cheaply and repeatedly re-roll free assistant/plan-generation credit, and more generally enables spam signups and credential-stuffing infrastructure with no friction.

Remediation

Enable Supabase's 'Confirm email' setting so /signup never returns tokens for an unverified address, add IP/email-based rate limiting on /auth/register, and consider CAPTCHA or another anti-automation control on the endpoint per the doc's guidance on abuse of high-value flows.

from time import time
from collections import defaultdict
from fastapi import HTTPException, Request

_attempts = defaultdict(list)
RATE_WINDOW = 3600
RATE_MAX = 5

def rate_limit(key: str):
    now = time()
    _attempts[key] = [t for t in _attempts[key] if now - t < RATE_WINDOW]
    if len(_attempts[key]) >= RATE_MAX:
        raise HTTPException(status_code=429, detail="too many signups, try again later")
    _attempts[key].append(now)


@router.post("/register")
def register(credentials: Credentials, request: Request):
    rate_limit(request.client.host)
    email = check(credentials)
    body = call("/signup", {"email": email, "password": credentials.password})
    user = body.get("user") or {}
    if not user.get("email_confirmed_at") and not body.get("access_token"):
        return {"session": False, "user": account(user)}
    return session_from(body)

POST of freshly-generated random credentials to /auth/register returned HTTP 200 with a valid access_token, refresh_token and 3600s expiry immediately — no email confirmation step was enforced by the deployment under test.

Vulnerable code

CMD ["sh", "-c", "exec uvicorn server:app --app-dir backend --host 0.0.0.0 --port ${PORT}"]

Root cause

The image never creates or switches to a non-root user, so uvicorn and the whole FastAPI process (which holds the Anthropic, Supabase, OpenAI and APNs credentials from .env) run as root inside the container — an insecure default left in place, matching the doc's 'a default left in place... a debug setting shipped' pattern.

Impact

If any other flaw in the stack (dependency RCE, deserialization, path traversal in the static file mounts) is ever exploited, the attacker inherits root inside the container immediately, simplifying container breakout and giving unrestricted access to every mounted secret and file (exercise-images, web-setup, templates, .cache).

Remediation

Create a dedicated unprivileged user in the image, chown the app directory to it, and add a USER directive before the CMD; keep pip installs in the root-owned build layer only.

RUN addgroup --system app && adduser --system --ingroup app app \
    && chown -R app:app /app
USER app
CMD ["sh", "-c", "exec uvicorn server:app --app-dir backend --host 0.0.0.0 --port ${PORT}"]

Not dynamically confirmed (static finding only).

Vulnerable code

app.add_middleware(
    CORSMiddleware,
    allow_origins=["*"],
    allow_methods=["*"],
    allow_headers=["*"],
)

Root cause

allow_origins, allow_methods and allow_headers are all wildcarded on every route (including /auth/, /account/, /chat/*), matching the doc's bullet on 'a permissive Access-Control-Allow-Origin: * on authenticated APIs' — any web origin can issue cross-origin requests and read the JSON responses.

Impact

Any third-party page that can obtain or guess a bearer token (e.g. through an XSS elsewhere, a malicious browser extension, or a compromised dependency in the web preview) can call every account, chat and usage endpoint cross-origin without the browser blocking the response; it also removes any origin-based defence-in-depth for the web-setup client.

Remediation

Replace the wildcard with an explicit allow-list of known origins (the Expo web preview host, the production web-setup origin), restrict allow_methods/allow_headers to what is actually used, and leave allow_credentials off since it already is.

import os

ALLOWED_ORIGINS = [o.strip() for o in os.environ.get("ALLOWED_ORIGINS", "").split(",") if o.strip()]

app.add_middleware(
    CORSMiddleware,
    allow_origins=ALLOWED_ORIGINS or ["http://localhost:8081"],
    allow_credentials=False,
    allow_methods=["GET", "POST", "PUT", "DELETE"],
    allow_headers=["Authorization", "Content-Type", "X-Trial-Id"],
)

Not dynamically confirmed (static finding only).

Vulnerable code

legacy-peer-deps=true

Root cause

The project's .npmrc sets no min-release-age, so npm install can resolve a package version within minutes of publication — the same floating/unpinned-resolution pattern the doc warns about ('Floating version ranges... that silently pick up a compromised release').

Impact

A compromised maintainer account or hijacked package could publish a malicious version that CI or a developer machine installs immediately, before the community or registry has time to flag and pull it, and that code would then ship inside the signed mobile release artifact.

Remediation

Add min-release-age=7 to mobile/.npmrc; pin exact dependency versions and commit lockfiles; verify checksums; run dependency scanning in CI; vet new SDKs before adoption.

legacy-peer-deps=true
min-release-age=7

Not dynamically confirmed (static finding only).

Vulnerable code

<key>NSAppTransportSecurity</key>
<dict>
    <key>NSAllowsArbitraryLoads</key>
    <false/>
    <key>NSAllowsLocalNetworking</key>
    <true/>
</dict>

Root cause

NSAllowsLocalNetworking is enabled so the dev client can reach the Metro bundler and a LAN-hosted backend over plain HTTP, which mobsfscan flags as a Network Security Config / ATS exception; NSAllowsArbitraryLoads is correctly left false so this is scoped to local networks only, and it is confined to the GymmateDev target rather than the store build.

Impact

On a shared or hostile local network (public Wi-Fi, a compromised router), traffic between the dev client and the LAN backend could be intercepted or modified, but this is limited to development builds — the comment in app.config.js states production relies on HTTPS with no such exception.

Remediation

Confirm the production Info.plist carries no NSAllowsLocalNetworking/NSAllowsArbitraryLoads exception, keep this exception restricted to the development bundle identifier only, and prefer scoping any future ATS exceptions to specific domains via NSExceptionDomains rather than a blanket local-networking allowance.

<key>NSAppTransportSecurity</key>
<dict>
  <key>NSAllowsArbitraryLoads</key>
  <false/>
  <!-- Keep NSAllowsLocalNetworking only in the Debug/GymmateDev configuration;
       ensure it is absent from the release Info.plist entirely. -->
  <key>NSAllowsLocalNetworking</key>
  <true/>
</dict>

mobsfscan statically confirmed the NSAllowsLocalNetworking=true ATS exception in the shipped Info.plist for the development target.

Vulnerable code

@router.post("/login")
def login(credentials: Credentials):
    email = check(credentials)
    body = call(
        "/token",
        {"email": email, "password": credentials.password},
        params={"grant_type": "password"},
    )
    return session_from(body)

Root cause

The login handler forwards credentials to the identity provider and returns a session but never records the attempt or its outcome, matching the doc's bullet that auditable events like logins are 'not logged at all'.

Impact

Credential-stuffing bursts, brute-force attempts, and successful account takeovers leave no application-level trace, so detection depends entirely on the upstream IdP's own logging, if any exists.

Remediation

Log every login attempt with outcome (success/failure), user identifier, and request metadata; ship logs off-host to a central store; define alert thresholds for failure spikes; never log raw passwords; add rate limiting on repeated failures.

@router.post("/login")
def login(credentials: Credentials):
    email = check(credentials)
    try:
        body = call(
            "/token",
            {"email": email, "password": credentials.password},
            params={"grant_type": "password"},
        )
    except AuthError:
        logger.warning("login_failed", extra={"email": email})
        raise
    logger.info("login_succeeded", extra={"email": email})
    return session_from(body)

Not dynamically confirmed (static finding only).

Vulnerable code

app = FastAPI()

Root cause

FastAPI() is instantiated with its defaults, so /docs, /redoc and /openapi.json are all served publicly with no auth guard or docs_url=None override — an unnecessary developer feature left enabled in a production-facing deployment, and dynamically confirmed reachable at /docs, /redoc and /openapi.json.

Impact

Any unauthenticated visitor can enumerate the complete API surface (every route, request/response schema, including the auth, account, usage and voice endpoints), materially speeding up reconnaissance for further attacks such as the open-registration and CORS issues above.

Remediation

Disable docs_url/redoc_url/openapi_url outside of development (e.g. gated on an ENV variable), or place them behind an internal-only network path/auth dependency if they must remain available for API consumers.

import os

app = FastAPI(
    docs_url="/docs" if os.environ.get("ENV") == "development" else None,
    redoc_url="/redoc" if os.environ.get("ENV") == "development" else None,
    openapi_url="/openapi.json" if os.environ.get("ENV") == "development" else None,
)

Nuclei confirmed all three unauthenticated endpoints live: /docs returned the Swagger UI page, /openapi.json returned the full 21KB API schema, and /redoc returned the ReDoc viewer — all with plain unauthenticated GET requests.