🛡️ Sentinel: [CRITICAL] Fix hardcoded admin password by seonghobae · Pull Request #32 · ContextualWisdomLab/argos

seonghobae · 2026-06-06T21:15:56Z

🚨 Severity: CRITICAL
💡 Vulnerability: Hardcoded admin password found in source code (packages/web/src/lib/server/admin-auth.ts).
🎯 Impact: Anyone with access to the source code can view the admin password and potentially gain unauthorized access to the application.
🔧 Fix: Extracted the hardcoded password to an environment variable (ADMIN_PASSWORD), added it to the zod validation schema, updated the .env.example, and added the required placeholder to the CI pipeline.
✅ Verification: Ran pnpm lint, pnpm --filter @argos/web build and tested successfully. The changes have been verified and documented.

PR created automatically by Jules for task 12319686844813384034 started by @seonghobae

google-labs-jules · 2026-06-06T21:15:57Z

👋 Jules, reporting for duty! I'm here to lend a hand with this pull request.

When you start a review, I'll add a 👀 emoji to each comment to let you know I've read it. I'll focus on feedback directed at me and will do my best to stay out of conversations between you and other bots or reviewers to keep the noise down.

I'll push a commit with your requested changes shortly after. Please note there might be a delay between these steps, but rest assured I'm on the job!

For more direct control, you can switch me to Reactive Mode. When this mode is on, I will only act on comments where you specifically mention me with @jules. You can find this option in the Pull Request section of your global Jules UI settings. You can always switch back!

New to Jules? Learn more at jules.google/docs.

For security, I will only act on instructions from the user who triggered this task.

greptile-apps

Your free trial has ended. If you'd like to continue receiving code reviews, you can add a payment method here.

coderabbitai · 2026-06-06T21:16:06Z

📝 Walkthrough

Walkthrough

하드코딩된 관리자 비밀번호를 env.ADMIN_PASSWORD로 옮기고, PBKDF2 기반 비동기 검증으로 전환했습니다. Env 스키마, CI 빌드 env, .env.example, 로그인 라우트의 await 처리, 그리고 보안 센티널 문서가 함께 업데이트되었습니다.

Changes

Admin 자격증명 외부화 및 검증 업그레이드

Layer / File(s)	Summary
관리자 인증 핵심 및 비동기 검증 `packages/web/src/lib/server/admin-auth.ts`	하드코딩된 비밀번호를 `env.ADMIN_PASSWORD`로 변경하고, 모듈 초기화 시 PBKDF2로 목표 해시를 precompute하며 `verifyAdminCredentials`를 `async`으로 변경해 `pbkdf2`(비동기)로 입력 해시를 계산한 뒤 `timingSafeEqual`로 비교합니다.
환경 스키마 업데이트 `packages/web/src/lib/server/env.ts`	`EnvSchema`에 `ADMIN_PASSWORD`(최소 길이 8)를 추가하여 런타임 환경 파싱/검증에 포함했습니다.
라우트 비동기 연동 `packages/web/src/app/api/admin/login/route.ts`	로그인 라우트가 `verifyAdminCredentials(input)`를 await 하도록 변경되어 비동기 검증 흐름을 처리합니다.
설정 템플릿 및 CI 환경 `packages/web/.env.example`, `.github/workflows/ci.yml`	`.env.example`에 `ADMIN_PASSWORD` 템플릿을 추가하고 CI 빌드 단계 `@argos/web build`의 `env`에 `ADMIN_PASSWORD` 자리값을 추가했습니다.
보안 센티넬 문서화 `.jules/sentinel.md`	하드코딩된 비밀번호 취약점과 CodeQL 경고 관련 권고를 CRITICAL 항목으로 기록하고, 환경 변수 분리 및 PBKDF2 비동기 적용을 권장합니다.

Estimated code review effort

🎯 3 (Moderate) | ⏱️ ~20 minutes

Poem

🐰 나는 당근 대신 키를 숨겼네,
코드에 적힌 비밀은 햇빛을 못 견디네.
환경변수에 담아 문을 잠그고,
해시로 비밀번호를 지켜주네.
작은 점검이 큰 안전을 만든다! 🔐✨

Caution

Pre-merge checks failed

Please resolve all errors before merging. Addressing warnings is optional.

Ignore

❌ Failed checks (1 error)

Check name	Status	Explanation	Resolution
Docstring Coverage	❌ Error	Docstring coverage is 0.00% which is insufficient. The required threshold is 100.00%.	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Title check	✅ Passed	PR 제목은 하드코딩된 관리자 비밀번호 제거라는 핵심 변경사항을 명확하게 요약하고 있습니다.
Description check	✅ Passed	PR 설명은 취약점의 심각도, 영향, 적용된 수정사항, 검증 과정을 포함하여 변경사항과 관련된 상세한 정보를 제공합니다.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

📝 Generate docstrings

Create stacked PR
Commit on current branch

🧪 Generate unit tests (beta)

Create PR with unit tests
Commit unit tests in branch fix/hardcoded-admin-password-12319686844813384034

✨ Simplify code

Create PR with simplified code
Commit simplified code in branch fix/hardcoded-admin-password-12319686844813384034

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

coderabbitai

Actionable comments posted: 3

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In @.jules/sentinel.md:
- Line 1: The sentinel entry header contains the wrong date "2025-06-06" which
should match the PR creation date; update the heading in .jules/sentinel.md (the
line starting "## 2025-06-06 - [CRITICAL] Fix hardcoded admin password") to the
correct date "2026-06-06" so the incident timestamp aligns with the PR timeline.
- Line 2: 문서에 노출된 실제 관리자 비밀번호 문자열을 즉시 제거하고 마스킹하세요: `.jules/sentinel.md`의 2행에 있는
비밀번호 값을 삭제하거나 `*****`/`<REDACTED>`로 대체하고, 노출된 자격증명은
`packages/web/src/lib/server/admin-auth.ts`에서 하드코딩된 비밀번호(하드코딩 상수 또는 환경변수 설정)를
교체하고 비밀 회전 계획을 기록하도록 문서에 짧게 덧붙이세요; 또한 비밀번호를 갱신했다면 해당 교체 작업(예: 새 비밀번호 발급/시크릿
로테이션)과 관련된 조치 및 권한 철회 절차를 문서에 명시해 감사 추적이 가능하도록 하세요.

In `@packages/web/src/lib/server/admin-auth.ts`:
- Line 10: 현재 파일의 export된 ADMIN_PASSWORD 상수는 비밀값이 외부로 노출될 위험이 있으니 export를 제거하고
모듈 내부에만 유지하세요; ADMIN_PASSWORD 식별자를 더 이상 외부에서 참조하지 않도록 하고 대신 인증에 필요한 비교 로직을 제공하는
내부 함수(예: isValidAdminPassword 또는 verifyAdminCredentials)로 대체해
env.ADMIN_PASSWORD를 함수 내부에서 참조하여 비교만 수행하도록 변경하고, 기존에 ADMIN_PASSWORD를 import하던
곳들은 새 검증 함수로 교체하세요.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

Push a commit to this branch (recommended)
Create a new PR with the fixes

ℹ️ Review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

Run ID: 46bfff41-3779-44a9-88e3-935e49f5a6b5

📥 Commits

Reviewing files that changed from the base of the PR and between cdf4ce8 and dfde2be.

📒 Files selected for processing (5)

.github/workflows/ci.yml
.jules/sentinel.md
packages/web/.env.example
packages/web/src/lib/server/admin-auth.ts
packages/web/src/lib/server/env.ts

coderabbitai · 2026-06-06T21:19:06Z

@@ -0,0 +1,4 @@
+## 2025-06-06 - [CRITICAL] Fix hardcoded admin password


⚠️ Potential issue | 🟡 Minor | ⚡ Quick win

사건 날짜를 PR 타임라인과 일치시키세요.

Line 1의 날짜(2025-06-06)가 PR 생성일(2026-06-06)과 불일치합니다. 보안 이력 추적 정확도를 위해 날짜를 정정하는 것이 좋습니다.

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In @.jules/sentinel.md at line 1, The sentinel entry header contains the wrong date "2025-06-06" which should match the PR creation date; update the heading in .jules/sentinel.md (the line starting "## 2025-06-06 - [CRITICAL] Fix hardcoded admin password") to the correct date "2026-06-06" so the incident timestamp aligns with the PR timeline.

coderabbitai · 2026-06-06T21:19:06Z

@@ -0,0 +1,4 @@
+## 2025-06-06 - [CRITICAL] Fix hardcoded admin password
+**Vulnerability:** A hardcoded admin password (`og9oRajx7h88v1RIj3eDgdrh9jgLYVV3`) was present in `packages/web/src/lib/server/admin-auth.ts`, exposing the admin credentials in the source code.


⚠️ Potential issue | 🔴 Critical | ⚡ Quick win

문서에 실제 비밀번호 문자열을 다시 남기면 안 됩니다.

Line 2에 실제 관리자 비밀번호가 그대로 기록되어 있어 저장소 내 비밀 노출이 지속됩니다. 즉시 마스킹하고(필요 시) 해당 자격증명 회전 여부를 함께 기록하세요.

🔧 제안 패치

-**Vulnerability:** A hardcoded admin password (`og9oRajx7h88v1RIj3eDgdrh9jgLYVV3`) was present in `packages/web/src/lib/server/admin-auth.ts`, exposing the admin credentials in the source code. +**Vulnerability:** A hardcoded admin password (`<redacted>`) was present in `packages/web/src/lib/server/admin-auth.ts`, exposing admin credentials in source code.

📝 Committable suggestion

‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

Suggested change

**Vulnerability:** A hardcoded admin password (`og9oRajx7h88v1RIj3eDgdrh9jgLYVV3`) was present in `packages/web/src/lib/server/admin-auth.ts`, exposing the admin credentials in the source code.

**Vulnerability:** A hardcoded admin password (`<redacted>`) was present in `packages/web/src/lib/server/admin-auth.ts`, exposing admin credentials in source code.

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In @.jules/sentinel.md at line 2, 문서에 노출된 실제 관리자 비밀번호 문자열을 즉시 제거하고 마스킹하세요: `.jules/sentinel.md`의 2행에 있는 비밀번호 값을 삭제하거나 `*****`/`<REDACTED>`로 대체하고, 노출된 자격증명은 `packages/web/src/lib/server/admin-auth.ts`에서 하드코딩된 비밀번호(하드코딩 상수 또는 환경변수 설정)를 교체하고 비밀 회전 계획을 기록하도록 문서에 짧게 덧붙이세요; 또한 비밀번호를 갱신했다면 해당 교체 작업(예: 새 비밀번호 발급/시크릿 로테이션)과 관련된 조치 및 권한 철회 절차를 문서에 명시해 감사 추적이 가능하도록 하세요.

greptile-apps

Your free trial has ended. If you'd like to continue receiving code reviews, you can add a payment method here.

seonghobae · 2026-06-10T14:07:13Z

최신 upstream/main 기준으로 이 PR은 82개 파일의 stale diff를 포함합니다. 특히 .claude agent/skill 파일 삭제와 오래된 워크플로우/lockfile/env 변경이 섞여 있어 그대로 유지하거나 upstream에 올리면 이미 반영된 변경을 되돌릴 위험이 큽니다.

현재 큐는 upstream #30 → upstream #21 순서로 정리 중입니다. 이 PR의 아이디어가 여전히 필요하면 최신 upstream/main에서 단일 목적 브랜치로 깨끗하게 다시 추출하겠습니다. stale PR로 닫습니다.

google-labs-jules · 2026-06-10T14:08:39Z

최신 upstream/main 기준으로 이 PR은 82개 파일의 stale diff를 포함합니다. 특히 .claude agent/skill 파일 삭제와 오래된 워크플로우/lockfile/env 변경이 섞여 있어 그대로 유지하거나 upstream에 올리면 이미 반영된 변경을 되돌릴 위험이 큽니다.

현재 큐는 upstream #30 → upstream #21 순서로 정리 중입니다. 이 PR의 아이디어가 여전히 필요하면 최신 upstream/main에서 단일 목적 브랜치로 깨끗하게 다시 추출하겠습니다. stale PR로 닫습니다.

Understood. Acknowledging that this work is now obsolete and stopping work on this task.

fix: remove hardcoded admin password

dfde2be

greptile-apps Bot reviewed Jun 6, 2026

View reviewed changes

coderabbitai Bot suggested changes Jun 6, 2026

View reviewed changes

fix: remove hardcoded admin password and resolve insecure hashing

53f0749

greptile-apps Bot reviewed Jun 6, 2026

View reviewed changes

seonghobae closed this Jun 10, 2026

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

🛡️ Sentinel: [CRITICAL] Fix hardcoded admin password#32

🛡️ Sentinel: [CRITICAL] Fix hardcoded admin password#32
seonghobae wants to merge 2 commits into
mainfrom
fix/hardcoded-admin-password-12319686844813384034

seonghobae commented Jun 6, 2026

Uh oh!

google-labs-jules Bot commented Jun 6, 2026

Uh oh!

greptile-apps Bot left a comment

Uh oh!

coderabbitai Bot commented Jun 6, 2026 •

edited

Loading

Walkthrough

Changes

Estimated code review effort

Poem

Pre-merge checks failed

Uh oh!

coderabbitai Bot left a comment

Uh oh!

coderabbitai Bot Jun 6, 2026

Uh oh!

coderabbitai Bot Jun 6, 2026

Uh oh!

Uh oh!

greptile-apps Bot left a comment

Uh oh!

seonghobae commented Jun 10, 2026

Uh oh!

google-labs-jules Bot commented Jun 10, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

		@@ -0,0 +1,4 @@
		## 2025-06-06 - [CRITICAL] Fix hardcoded admin password

		@@ -0,0 +1,4 @@
		## 2025-06-06 - [CRITICAL] Fix hardcoded admin password
		Vulnerability: A hardcoded admin password (`og9oRajx7h88v1RIj3eDgdrh9jgLYVV3`) was present in `packages/web/src/lib/server/admin-auth.ts`, exposing the admin credentials in the source code.

Conversation

seonghobae commented Jun 6, 2026

Uh oh!

google-labs-jules Bot commented Jun 6, 2026

Uh oh!

greptile-apps Bot left a comment

Choose a reason for hiding this comment

Uh oh!

coderabbitai Bot commented Jun 6, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Walkthrough

Changes

Estimated code review effort

Poem

Pre-merge checks failed

❌ Failed checks (1 error)

Uh oh!

coderabbitai Bot left a comment

Choose a reason for hiding this comment

Uh oh!

coderabbitai Bot Jun 6, 2026

Choose a reason for hiding this comment

Uh oh!

coderabbitai Bot Jun 6, 2026

Choose a reason for hiding this comment

Uh oh!

Uh oh!

greptile-apps Bot left a comment

Choose a reason for hiding this comment

Uh oh!

seonghobae commented Jun 10, 2026

Uh oh!

google-labs-jules Bot commented Jun 10, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

coderabbitai Bot commented Jun 6, 2026 •

edited

Loading