lfx-self-serve: Skill for Claude Code

Self Serve Security Review

LFX One is the authenticated front door for every persona. It holds the user's OIDC session and brokers each authenticated business request to the microservice mesh with that user's identity and bearer token. It also exposes a deliberately public surface — the data-bearing /meetings/ join pages and /public/api, plus /docs, health, and a few non-data utility routes — reachable without a user session, where handlers use M2M credentials for the upstream calls that need them (optional-auth routes may still carry a user token). auth.middleware.ts is the authoritative inventory for routes that reach the auth middleware (the OIDC login/logout/callback routes mount earlier in server.ts), so verify a route's class there before calling a public route a regression. So the failure modes that matter here are a cross-user or cross-persona authorization bypass, a session or token leak, member PII exposure, and anything that lets an anonymous caller reach more than the public surface intends. Those facts set the stakes for every security judgment.

Methodology

Run a focused, diff-aware review, not a whole-repo audit:

1. Only new risk. Assess what this PR introduces or weakens. Do not relitigate pre-existing issues the diff does not touch.
2. Assume hostile input, report only what is real. Flag only high-confidence, concretely exploitable findings: if you cannot trace a path from an attacker-controlled input (a request param, body, header, cookie, the returnTo URL, user- or project-supplied content) to a sensitive sink, it is not a reportable security finding.
3. Three passes.
   • Context: discover, from the code and the repo docs at review time, the guards this application relies on around the diff (the route's auth class, the effective-identity helpers, validateAndSanitizeUrl / fetchSafeUrl, the logger's redaction, Angular's default sanitizer, constantTimeEquals). Never assume a guard exists; find it.
   • Comparative: does the change deviate from the guard patterns the surrounding code establishes? docs/reviews/knowledge-base/security.md records the patterns this repo has been bitten by — use it as a checklist of known shapes, not a substitute for tracing the actual path.
   • Assessment: trace each input to its sink and confirm a guard sits on the path the data actually takes, not three functions away.
4. Confidence-gate every finding (1-10, report only >= 8, matching the reviewer skill's >=80% gate). A few real findings beat a speculative list.
5. Evidence, not vibes. Each finding names the file and function, what the attacker controls, the boundary crossed, the concrete impact, and the fix.