Resolve security advisor findings and harden CI

Author: Codex

.env.example

@@ -27,6 +27,8 @@ CORS_ALLOWED_ORIGINS=
 ENABLE_ADMIN_MODE=false
 
 # Service-role key — owner only, never share, never expose to browser
+SUPABASE_SECRET_KEY=
+# Legacy fallback only. Prefer SUPABASE_SECRET_KEY for server/admin operations.
 SUPABASE_SERVICE_ROLE_KEY=
 
 # Admin unlock secret for /__admin/login

.github/dependabot.yml

@@ -0,0 +1,26 @@
+version: 2
+updates:
+  - package-ecosystem: npm
+    directory: /
+    schedule:
+      interval: weekly
+      day: monday
+      time: "06:00"
+      timezone: Asia/Kolkata
+    open-pull-requests-limit: 5
+    groups:
+      development-dependencies:
+        dependency-type: development
+    commit-message:
+      prefix: deps
+
+  - package-ecosystem: github-actions
+    directory: /
+    schedule:
+      interval: weekly
+      day: monday
+      time: "06:15"
+      timezone: Asia/Kolkata
+    open-pull-requests-limit: 5
+    commit-message:
+      prefix: ci

.github/workflows/auto-label.yml

@@ -15,7 +15,7 @@ jobs:
 
     steps:
       - name: 🏷️ Apply labels based on file changes
-        uses: actions/labeler@v5
+        uses: actions/labeler@v6
         with:
           repo-token: ${{ secrets.GITHUB_TOKEN }}
           configuration-path: .github/labeler.yml

.github/workflows/ci.yml

@@ -25,10 +25,10 @@ jobs:
 
     steps:
       - name: ⬇️ Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v7
 
       - name: 🟢 Setup Node.js ${{ matrix.node }}
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@v6
         with:
           node-version: ${{ matrix.node }}
 
@@ -202,6 +202,8 @@ jobs:
             community-patch-v4.sql
             sql/006_security_policy_cleanup.sql
             sql/007_comprehensive_sql_rls_hardening.sql
+            sql/008_security_invoker_rpc_boundary.sql
+            sql/009_remove_redundant_indexes.sql
             sql/backup_manifests.sql
             scripts/verify-sql-hardening.sql
             sql/verify-security.sql
@@ -241,7 +243,7 @@ jobs:
             echo "❌ .env is tracked; remove it before release"
             exit 1
           fi
-          if git grep -nE 'SUPABASE_SERVICE_ROLE_KEY[[:space:]]*=[[:space:]]*eyJ|SUPABASE_ACCESS_TOKEN[[:space:]]*=[[:space:]]*sbp_|ADMIN_SECRET[[:space:]]*=[[:space:]]*[A-Za-z0-9_-]{24,}' -- \
+          if git grep -nE 'SUPABASE_SECRET_KEY[[:space:]]*=[[:space:]]*sb_secret_[A-Za-z0-9_-]{16,}|SUPABASE_SERVICE_ROLE_KEY[[:space:]]*=[[:space:]]*eyJ|SUPABASE_ACCESS_TOKEN[[:space:]]*=[[:space:]]*sbp_|ADMIN_SECRET[[:space:]]*=[[:space:]]*[A-Za-z0-9_-]{24,}' -- \
                ':!*.md' ':!.env.example' ':!public/assets/**'; then
             echo "❌ Hardcoded private secret detected!"
             exit 1
@@ -252,7 +254,7 @@ jobs:
       - name: 📋 Schema file stats
         run: |
           set -euo pipefail
-          for f in isotope-complete.sql community-patch-v4.sql sql/006_security_policy_cleanup.sql sql/007_comprehensive_sql_rls_hardening.sql sql/backup_manifests.sql sql/verify-security.sql scripts/verify-sql-hardening.sql performance-patch.sql; do
+          for f in isotope-complete.sql community-patch-v4.sql sql/006_security_policy_cleanup.sql sql/007_comprehensive_sql_rls_hardening.sql sql/008_security_invoker_rpc_boundary.sql sql/009_remove_redundant_indexes.sql sql/backup_manifests.sql sql/verify-security.sql scripts/verify-sql-hardening.sql performance-patch.sql; do
             if [ -f "$f" ]; then
               echo "=== $f ==="
               echo "  Size   : $(wc -c < "$f") bytes"
@@ -334,7 +336,7 @@ jobs:
           unzip -q "isotope-v${VERSION}-ci-test.zip" -d "$TMPDIR"
           echo "Verifying extracted release..."
           FAIL=0
-          for f in server.mjs package.json setup.sh install-termux.sh bin/isotope .env.example public/sync/backup-normalizer.js public/sync/local-data-adapter.js server/backup-manager.mjs scripts/prove-new-browser-restore.mjs sql/backup_manifests.sql sql/007_comprehensive_sql_rls_hardening.sql scripts/verify-sql-hardening.sql docs/sync-system.md docs/storage-backup-system.md docs/supabase-connection-map.md; do
+          for f in server.mjs package.json setup.sh install-termux.sh bin/isotope .env.example public/sync/backup-normalizer.js public/sync/local-data-adapter.js server/backup-manager.mjs scripts/prove-new-browser-restore.mjs sql/backup_manifests.sql sql/007_comprehensive_sql_rls_hardening.sql sql/008_security_invoker_rpc_boundary.sql sql/009_remove_redundant_indexes.sql scripts/verify-sql-hardening.sql docs/sync-system.md docs/storage-backup-system.md docs/supabase-connection-map.md; do
             if [ -f "$TMPDIR/$f" ]; then
               echo "  ✅ $f"
             else
@@ -358,7 +360,7 @@ jobs:
       # ── Upload logs on failure ────────────────────────────────────────────────
       - name: 📤 Upload CI logs on failure
         if: failure()
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v7
         with:
           name: ci-logs-node${{ matrix.node }}-${{ github.run_id }}
           path: |

.github/workflows/codeql.yml

@@ -21,10 +21,10 @@ jobs:
 
     steps:
       - name: ⬇️ Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v7
 
       - name: 🔍 Initialize CodeQL
-        uses: github/codeql-action/init@v3
+        uses: github/codeql-action/init@v4
         with:
           languages: javascript-typescript
           # Config excludes public/ (154 minified React bundle files) and docs/
@@ -34,9 +34,9 @@ jobs:
           config-file: ./.github/codeql/codeql-config.yml
 
       - name: 🏗️ Autobuild
-        uses: github/codeql-action/autobuild@v3
+        uses: github/codeql-action/autobuild@v4
 
       - name: 📊 Perform CodeQL Analysis
-        uses: github/codeql-action/analyze@v3
+        uses: github/codeql-action/analyze@v4
         with:
           category: /language:javascript-typescript

.github/workflows/dependency-review.yml

@@ -20,10 +20,10 @@ jobs:
 
     steps:
       - name: ⬇️ Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v7
 
       - name: 🔒 Dependency Review
-        uses: actions/dependency-review-action@v4
+        uses: actions/dependency-review-action@v5
         with:
           fail-on-severity: high
           comment-summary-in-pr: always

.github/workflows/lighthouse.yml

@@ -22,10 +22,10 @@ jobs:
 
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v7
 
       - name: Setup Node.js
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@v6
         with:
           node-version: '22'
           cache: npm
@@ -44,7 +44,7 @@ jobs:
 
       - name: Upload Lighthouse reports
         if: always()
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v7
         with:
           name: lighthouse-reports
           path: |

.github/workflows/pages.yml

@@ -28,13 +28,13 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v7
       - name: Setup Pages
-        uses: actions/configure-pages@v4
+        uses: actions/configure-pages@v6
       - name: Upload artifact
-        uses: actions/upload-pages-artifact@v3
+        uses: actions/upload-pages-artifact@v5
         with:
           path: './docs'
       - name: Deploy to GitHub Pages
         id: deployment
-        uses: actions/deploy-pages@v4
+        uses: actions/deploy-pages@v5

.github/workflows/regenerate-release.yml

@@ -24,7 +24,7 @@ jobs:
 
     steps:
       - name: ⬇️ Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v7
         with:
           fetch-depth: 0
 
@@ -47,7 +47,7 @@ jobs:
           echo "version=$VERSION" >> "$GITHUB_OUTPUT"
 
       - name: 🟢 Setup Node.js
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@v6
         with:
           node-version: '22'
 
@@ -107,6 +107,8 @@ jobs:
             isotope-complete.sql
             sql/backup_manifests.sql
             sql/007_comprehensive_sql_rls_hardening.sql
+            sql/008_security_invoker_rpc_boundary.sql
+            sql/009_remove_redundant_indexes.sql
             scripts/verify-sql-hardening.sql
             docs/sync-system.md
             docs/storage-backup-system.md

.github/workflows/release.yml

@@ -21,7 +21,7 @@ jobs:
 
     steps:
       - name: ⬇️ Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v7
         with:
           fetch-depth: 0
 
@@ -44,7 +44,7 @@ jobs:
           echo "version=${VERSION}" >> "$GITHUB_OUTPUT"
 
       - name: 🟢 Setup Node.js
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@v6
         with:
           node-version: '22'
 
@@ -183,6 +183,8 @@ jobs:
             sql/backup_manifests.sql
             sql/006_security_policy_cleanup.sql
             sql/007_comprehensive_sql_rls_hardening.sql
+            sql/008_security_invoker_rpc_boundary.sql
+            sql/009_remove_redundant_indexes.sql
             scripts/verify-sql-hardening.sql
             docs/sync-system.md
             docs/storage-backup-system.md