Skip to content

fix: the supabase edge functions ping and ping-v2 ac... in index.ts#5443

Open
orbisai0security wants to merge 1 commit into
unionlabs:mainfrom
orbisai0security:fix-fix-v-001-ping-secret-header-auth
Open

fix: the supabase edge functions ping and ping-v2 ac... in index.ts#5443
orbisai0security wants to merge 1 commit into
unionlabs:mainfrom
orbisai0security:fix-fix-v-001-ping-secret-header-auth

Conversation

@orbisai0security
Copy link
Copy Markdown

Summary

Fix critical severity security issue in mpc/edge/supabase/functions/ping/index.ts.

Vulnerability

Field Value
ID V-001
Severity CRITICAL
Scanner multi_agent_ai
Rule V-001
File mpc/edge/supabase/functions/ping/index.ts:5

Description: The Supabase edge functions ping and ping-v2 accept a 'secret' parameter directly from the request body without proper validation or secure transmission mechanisms. This secret is transmitted in plaintext within the JSON request body, making it vulnerable to interception through network sniffing, logging, or man-in-the-middle attacks. The code does not implement any additional authentication mechanisms such as JWT validation, HMAC signatures, or token-based authentication to protect this sensitive parameter.

Changes

  • mpc/edge/supabase/functions/ping/index.ts

Verification

  • Build passes
  • Scanner re-scan confirms fix
  • LLM code review passed

Automated security fix by OrbisAI Security

Automated security fix generated by Orbis Security AI
@vercel
Copy link
Copy Markdown

vercel Bot commented Apr 8, 2026

Someone is attempting to deploy a commit to the unionbuild Team on Vercel.

A member of the Team first needs to authorize it.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant