Lesca is a local development tool designed for personal use. This document outlines security considerations, best practices, and our approach to handling security issues.

Lesca is a local CLI tool that operates under a trust-based security model:

• Users control what code runs via configuration
• Similar trust level to npm scripts, webpack plugins, or VS Code extensions
• No remote code execution or untrusted third-party services

Sensitive Data:

• Authentication cookies stored in local JSON files
• No data transmitted to external services (except LeetCode.com)
• All logging automatically sanitizes sensitive data

File System Access:

• Tool operates within user-specified output directories
• Configuration files stored in user's home directory (~/.lesca/)
• No system-wide modifications

Cookie files contain authentication data. Protect them:

# Set restrictive permissions
chmod 600 ~/.lesca/cookies.json

# Never commit to version control
echo "cookies.json" >> .gitignore

What's in cookie files:

• LeetCode session cookies
• CSRF tokens
• Stored in plaintext JSON (by design for this use case)

⚠️ IMPORTANT: Only use trusted plugins

Plugins have full Node.js API access and can:

• Read/write files anywhere on your system
• Make network requests
• Execute arbitrary code
• Access environment variables

Before using a plugin:

1. ✅ Review the plugin source code
2. ✅ Verify the author/publisher
3. ✅ Check 3rd-party dependencies
4. ✅ Read user reviews/issues

Built-in Protections:

• Path traversal validation (prevents ../ in plugin paths)
• Interface validation (ensures plugins export required fields)

Secure your lesca.config.yaml:

# ❌ DON'T: Store secrets directly
auth:
  cookiePath: '/path/to/cookies.json' # ✅ Reference file path instead

# ✅ DO: Use environment variables for sensitive data
environment:
  LEETCODE_SESSION: ${LEETCODE_SESSION}

If using environment variables for authentication:

# Add to .env (and add .env to .gitignore)
LEETCODE_SESSION=your_session_here
CSRFTOKEN=your_csrf_here

# Load with:
source .env && lesca scrape

Debug mode safely:

# Debug logs are sanitized by default
lesca --debug scrape two-sum

# Sensitive data automatically redacted:
# - Cookies → [REDACTED]
# - Tokens → [REDACTED]
# - Passwords → [REDACTED]

Log files (if enabled):

• Stored in ./lesca.log by default
• Automatically rotated at 10MB
• Sanitization enabled by default

Risk: Malicious plugins can execute arbitrary code.

Mitigation:

• User explicitly configures plugins in lesca.config.yaml
• Document trust requirement
• Code review recommended before use

Future Enhancements:

• Plugin capability permissions system
• --allow-plugins explicit consent flag
• Plugin sandbox/isolation

Risk: Plugin paths could reference parent directories.

Mitigation: ✅ Implemented path validation (v0.2.0+)

Risk: Cookies stored in plaintext JSON files.

Mitigation:

• File system permissions (user's responsibility)
• Cookies never logged or transmitted externally
• Documentation provided

Note: This is standard for local development tools (similar to git credentials, npm tokens, etc.)

If you discover a security vulnerability:

1. DO NOT create a public GitHub issue

2. Use GitHub Security Advisories: Navigate to the repository's Security tab and click "Report a vulnerability"

   • Or email the repository owner directly
   • Subject: [SECURITY] Lesca Vulnerability Report

3. Include:

   • Description of the vulnerability
   • Steps to reproduce
   • Potential impact
   • Suggested fix (if known)

• Initial Response: Within 48 hours
• Status Update: Within 7 days
• Fix Timeline: Depends on severity
  • Critical: 7 days
  • High: 14 days
  • Medium: 30 days
  • Low: Next release

We appreciate security researchers and will:

• Credit you in release notes (if desired)
• Keep you informed throughout the fix process
• Work with you to verify the fix

Summary:

• Code review of plugin system security
• Path traversal validation verified
• Cookie handling practices reviewed
• Logging sanitization confirmed

Findings:

Recommendations Implemented:

• ✅ Path validation for plugin loading
• ✅ Interface validation for plugins
• ✅ Automatic log sanitization
• ✅ Cookie file permission documentation

We regularly monitor dependencies for vulnerabilities:

• npm audit run on every PR (CI/CD)
• Dependabot alerts enabled
• Regular dependency updates

Note: The moderate vulnerabilities are in development dependencies only (vitest test framework). They affect the local development server and do not impact production usage of Lesca. These will be resolved when vitest releases a patched version.

To check current status:

npm audit

• LEGAL.md - Terms of Service compliance
• CONTRIBUTING.md - Development guidelines
• README.md - General documentation

Last Updated: December 2025 Version: v0.1.0