Root cause
Authentication & access control introduced
Add API server with routes, services, and middleware
AI-written code added four unauthenticated API endpoints, exposing heartbeat issues, CLI auth challenges, skills data, and full deployment health details.
How AI contributed: Direct introductionPublished Apr 16, 2026 in 
paperclipai/paperclipAll 8 findings in this repository
Show full advisory descriptionHide advisory description
Four unauthenticated API endpoints in authenticated mode: (1) GET /api/heartbeat-runs/:runId/issues, (2) POST /api/cli-auth/challenges, (3) GET /api/skills/index|available|:skillName, (4) GET /api/health full deployment details.
Fix
Security fix
[codex] harden authenticated routes and issue editor reliability (#3741)
AI-assisted fix: ChatGPT/Codex · Dotta
Case facts
- GHSA ID
- GHSA-XFQJ-R5QW-8G4J
- Published
- Apr 16, 2026
- Severity
- Not scored
- Language
- TypeScript
- AI tool
Claude- AI role
- Direct introduction
- Vulnerable release
- < 2026.416.0
- Fixed release
- 2026.416.0
AI-assisted change
AI-assisted changeserver/src/app.tssource paperclipai/paperclip@c9d7cbfe44+42−0
@@ -0,0 +1,42 @@+import express, { Router } from "express";+import path from "node:path";+import { fileURLToPath } from "node:url";+import type { Db } from "@paperclip/db";+import { httpLogger, errorHandler } from "./middleware/index.js";+import { healthRoutes } from "./routes/health.js";+import { agentRoutes } from "./routes/agents.js";+import { projectRoutes } from "./routes/projects.js";+import { issueRoutes } from "./routes/issues.js";Show 8 hidden lines
+import { goalRoutes } from "./routes/goals.js";+import { activityRoutes } from "./routes/activity.js";++export function createApp(db: Db, opts: { serveUi: boolean }) {+ const app = express();++ app.use(express.json());+ app.use(httpLogger);++ // Mount API routes+ const api = Router();+ api.use("/health", healthRoutes());+ api.use("/agents", agentRoutes(db));+ api.use("/projects", projectRoutes(db));+ api.use("/issues", issueRoutes(db));Show 18 hidden lines
+ api.use("/goals", goalRoutes(db));+ api.use("/activity", activityRoutes(db));+ app.use("/api", api);++ // SPA fallback for serving the UI build+ if (opts.serveUi) {+ const __dirname = path.dirname(fileURLToPath(import.meta.url));+ const uiDist = path.resolve(__dirname, "../../ui/dist");+ app.use(express.static(uiDist));+ app.get("*", (_req, res) => {+ res.sendFile(path.join(uiDist, "index.html"));+ });+ }++ app.use(errorHandler);++ return app;+}The API router mounts the health endpoint and several resource routers but never installs a global authentication guard, and the health handler itself only returns a static ok. Sensitive sub-resources were reachable under this router without an actor being checked.
AI-assisted changeserver/src/routes/health.tssource paperclipai/paperclip@c9d7cbfe44+11−0
@@ -0,0 +1,11 @@+import { Router } from "express";++export function healthRoutes() {+ const router = Router();++ router.get("/", (_req, res) => {+ res.json({ status: "ok" });+ });+Show 2 hidden lines
+ return router;+}The health route is a bare Router with no middleware, confirming that this route surface carried no default authentication when it was introduced.
Security fix
Fixserver/src/routes/activity.tssource paperclipai/paperclip@32a9165ddf+2−1
@@ -3,7 +3,7 @@ import { z } from "zod"; import type { Db } from "@paperclipai/db"; import { validate } from "../middleware/validate.js"; import { activityService } from "../services/activity.js";-import { assertBoard, assertCompanyAccess } from "./authz.js";+import { assertAuthenticated, assertBoard, assertCompanyAccess } from "./authz.js"; import { heartbeatService, issueService } from "../services/index.js"; import { sanitizeRecord } from "../redaction.js"; Show 1 hidden lines
@@ -81,6 +81,7 @@ export function activityRoutes(db: Db) { }); router.get("/heartbeat-runs/:runId/issues", async (req, res) => {+ assertAuthenticated(req); const runId = req.params.runId as string; const run = await heartbeat.getRun(runId); if (!run) {the issue sub-resource now calls assertAuthenticated before reading a heartbeat run's issues, pinning a missing authentication check on top of the existing board and company gates.
Fixserver/src/app.tssource paperclipai/paperclip@32a9165ddf+14−2
@@ -86,6 +86,16 @@ function shouldServeViteDevHtml(req: ExpressRequest): boolean { return req.accepts(["html"]) === "html"; } +export function shouldEnablePrivateHostnameGuard(opts: {+ deploymentMode: DeploymentMode;+ deploymentExposure: DeploymentExposure;+}): boolean {Show 22 hidden lines
+ return (+ opts.deploymentExposure === "private" &&+ (opts.deploymentMode === "local_trusted" || opts.deploymentMode === "authenticated")+ );+}+ export async function createApp( db: Db, opts: {@@ -123,8 +133,10 @@ export async function createApp( }, })); app.use(httpLogger);- const privateHostnameGateEnabled =- opts.deploymentMode === "authenticated" && opts.deploymentExposure === "private";+ const privateHostnameGateEnabled = shouldEnablePrivateHostnameGuard({+ deploymentMode: opts.deploymentMode,+ deploymentExposure: opts.deploymentExposure,+ }); const privateHostnameAllowSet = resolvePrivateHostnameAllowSet({ allowedHostnames: opts.allowedHostnames, bindHost: opts.bindHost,The private-hostname guard helper is extracted and the health endpoint decides how much detail to expose based on deployment mode and actor type, so unauthenticated callers on authenticated deployments no longer receive full internal health details.
Fixserver/src/routes/health.tssource paperclipai/paperclip@32a9165ddf+31−3
@@ -7,6 +7,14 @@ import { readPersistedDevServerStatus, toDevServerHealthStatus } from "../dev-se import { instanceSettingsService } from "../services/instance-settings.js"; import { serverVersion } from "../version.js"; +function shouldExposeFullHealthDetails(+ actorType: "none" | "board" | "agent" | null | undefined,+ deploymentMode: DeploymentMode,+) {Show 11 hidden lines
+ if (deploymentMode !== "authenticated") return true;+ return actorType === "board" || actorType === "agent";+}+ export function healthRoutes( db?: Db, opts: {@@ -23,9 +31,19 @@ export function healthRoutes( ) { const router = Router(); - router.get("/", async (_req, res) => {+ router.get("/", async (req, res) => {+ const actorType = "actor" in req ? req.actor?.type : null;+ const exposeFullDetails = shouldExposeFullHealthDetails(+ actorType,+ opts.deploymentMode,+ );Show 37 hidden lines
+ if (!db) {- res.json({ status: "ok", version: serverVersion });+ res.json(+ exposeFullDetails+ ? { status: "ok", version: serverVersion }+ : { status: "ok", deploymentMode: opts.deploymentMode },+ ); return; } @@ -70,7 +88,7 @@ export function healthRoutes( const persistedDevServerStatus = readPersistedDevServerStatus(); let devServer: ReturnType<typeof toDevServerHealthStatus> | undefined;- if (persistedDevServerStatus) {+ if (persistedDevServerStatus && typeof (db as { select?: unknown }).select === "function") { const instanceSettings = instanceSettingsService(db); const experimentalSettings = await instanceSettings.getExperimental(); const activeRunCount = await db@@ -85,6 +103,16 @@ export function healthRoutes( }); } + if (!exposeFullDetails) {+ res.json({+ status: "ok",+ deploymentMode: opts.deploymentMode,+ bootstrapStatus,+ bootstrapInviteActive,+ });+ return;+ }+ res.json({ status: "ok", version: serverVersion,the health handler now branches on deployment mode and actor, returning only a minimal status for unauthenticated requests while full details stay gated behind a board or agent identity.
Patch fingerprints
AI-assisted change 54402145515c48f412cd4f0668c1c0127dfb6d28ac535a0913b3e5ac9e4cb739 · Fix 3b606031fd3b414c7311c7e72535b040ae4930eca2a10f29ce4945a151fa1e81