A file-upload audit, a verified-payment-webhook audit, and an XSS audit, each with a proof step and a retest step.
Audit every file-upload path in this repository. Report file and line for each upload handler, then check: authenticated authorization, allowlisted extensions, server-verified MIME type, file-signature validation, maximum size, generated storage name, storage outside the executable web root, download headers, and malware scanning or quarantine where the risk warrants it. Do not trust the browser-provided filename or Content-Type. Give me a severity-ranked findings table first. After I approve it, implement the smallest safe patch and add tests for a renamed executable, an oversized file, a double extension, and an unauthorized upload.Find every payment webhook endpoint and identify its provider. Confirm the handler verifies the provider signature using the exact raw request body and the official SDK, rejects stale or replayed requests where the provider supports timestamps, and stores processed event IDs so duplicate delivery cannot grant access twice. Report the current evidence as file and line before editing. After approval, patch the handler, preserve the raw body through the framework middleware, add idempotency, and write tests for an invalid signature, a modified payload, and the same valid event delivered twice.Trace every place user-controlled text is rendered in the browser, including usernames, comments, profile fields, markdown, URLs, and rich text. Flag raw HTML APIs such as dangerouslySetInnerHTML, innerHTML, v-html, or equivalent. Keep the framework's contextual output encoding enabled. Where the product intentionally accepts HTML, sanitize it with a maintained allowlist-based library configured for the required tags only. Add a restrictive Content Security Policy as defence in depth, not as the primary fix. Show findings first, then patch only after approval and add tests using script tags, event-handler attributes, javascript URLs, and malformed markup.Save the prompt with the source links and the date you verified them. When the tool, policy, price, interface, or documentation changes, update the guide before you reuse the workflow. Keep the inputs and outputs beside the project so the next run can be checked instead of reconstructed from memory.