[tracking] Codebase audit — 68 improvements across security, correctness, architecture & tooling

[rahulkatiyar19955]

Tracking issue for a full code-audit of DataPilot covering the Electron/Node layer, React renderer, backend multi-agent orchestration, LLM provider + FastAPI layer, the data/parser/Neo4j/MCP-worker layer, and build/CI/test/packaging infra.

Meta-finding: the project is well-architected and unusually well-documented (AGENT.md), but there is a consistent gap between the guarantees that document makes and what the code actually enforces — security ("zero-trust IPC", safeStorage-only secrets), grounding (every finding must cite a resolvable log_id), budgets (25k/turn, 200k/session), the <2s plan SLA, and quality gates (lint/test are exit 0 stubs) are specified but not wired up.

68 issues were filed (#27–#94). Each is self-contained with file:line references, impact, and a suggested fix so it can be picked up independently. Security findings are written impact-focused (no exploit recipes).

Labels

• Severity: severity:critical · severity:high · severity:medium · severity:low
• Area: area:electron · area:frontend · area:agent · area:api · area:data · area:infra
• Type: security · bug · tech-debt · enhancement

Suggested order of attack

1. Security pass — the renderer→host and open-API holes: [electron] shell:openPath passes unvalidated renderer path to OS — enables host file/app launch #27, [electron] No runtime IPC payload validation on any ipcMain.handle handler #28, [api] Localhost backend is unauthenticated with wide-open CORS (allow_origins=["*"]) #64, [api] Provider API keys can be reflected to client/logs via str(e) on key-bearing settings endpoints #60, [api] Full prompts/responses logged unredacted to persistent file and served over an endpoint #61, [electron] API keys & Neo4j password injected as container env are exposed via docker inspect #32, [electron] Entire $HOME bind-mounted into backend and worker containers (over-broad scope) #33, [frontend] API keys copied out of safeStorage to backend over plain HTTP and to clipboard #39, [data] Bag file path opened without validation or containment checks #80.
2. Data integrity — before more bags get ingested into a shared graph: [data] Cross-session Log.id collision corrupts causal edges and citations #68, [data] Log timestamps stored as str(timedelta) break ordering and long-bag causal timing #70.
3. Stand up quality gates — so the rest is protected against regression: [infra] CI runs no typecheck/lint/tests/eval gate — broken PRs merge green #71, [infra] No ESLint config — pnpm lint always passes, AGENT.md rules unenforced #87, [infra] No frontend/TypeScript test setup — pnpm test is a no-op that exits 0 #85.
4. Enforce documented invariants — budgets, grounding, timeouts, async Neo4j: [agent] Token budget (25k/turn, 200k/session) is never enforced #42, [agent] Citation grounding bypassed: uncited critical/warning findings pass the composer #50, [agent] No timeouts on LLM calls in the orchestration path #48, [agent] Synchronous Neo4j driver called from async nodes blocks the event loop #46, [api] Cloud provider clients construct SDKs with no request timeout — hung upstream stalls SSE + DB session #65.

---

area:electron (11)

Critical

• [electron] shell:openPath passes unvalidated renderer path to OS — enables host file/app launch #27 — shell:openPath passes unvalidated renderer path to OS (host file/app launch)
• [electron] No runtime IPC payload validation on any ipcMain.handle handler #28 — No runtime IPC payload validation on any ipcMain.handle handler

High

• [electron] Prototype pollution & arbitrary secure-key writes via settings:set / keychain:set #29 — Prototype pollution & arbitrary secure-key writes via settings:set / keychain:set
• [electron] Renderer can repoint the Docker socket via settings:set("docker_socket", …) #31 — Renderer can repoint the Docker socket via settings:set("docker_socket", …)
• [electron] API keys & Neo4j password injected as container env are exposed via docker inspect #32 — API keys & Neo4j password injected as container env exposed via docker inspect
• [electron] Entire $HOME bind-mounted into backend and worker containers (over-broad scope) #33 — Entire $HOME bind-mounted into backend and worker containers
• [electron] storage:usage allows arbitrary-path enumeration and main-thread DoS #37 — storage:usage allows arbitrary-path enumeration and main-thread DoS

Medium

• [electron] keychain falls back to plaintext base64 with no marker when safeStorage is unavailable #40 — keychain falls back to plaintext base64 with no marker when safeStorage is unavailable
• [electron] Docker lifecycle & orchestration robustness (boot races, naming, compose drift, teardown) #41 — Docker lifecycle & orchestration robustness (boot races, naming, compose drift, teardown)
• [electron] IPC robustness: silent keychain/settings failures, unvalidated log-stream args, ignored second-instance argv #51 — IPC robustness: silent keychain/settings failures, unvalidated log-stream args, ignored second-instance argv

Low

• [electron] Type safety: remove pervasive any in orchestrator/preload and unify settings-store type #44 — Type safety: remove pervasive any in orchestrator/preload, unify settings-store type

area:frontend (10)

Critical

• [frontend] Adopt TanStack Query for server state (currently raw fetch + zustand) #30 — Adopt TanStack Query for server state (currently raw fetch + zustand)

High

• [frontend] SSE stream drops final buffered event on done #34 — SSE stream drops final buffered event on done
• [frontend] useChat reads stale sessionId via closure — late refetches target wrong session #35 — useChat reads stale sessionId via closure — late refetches target wrong session
• [frontend] stop() can write 'generation stopped' onto the wrong message #36 — stop() can write 'generation stopped' onto the wrong message
• [frontend] Settings.tsx is 1453 lines — split oversized screen components #38 — Settings.tsx is 1453 lines — split oversized screen components
• [frontend] API keys copied out of safeStorage to backend over plain HTTP and to clipboard #39 — API keys copied out of safeStorage to backend over plain HTTP and to clipboard

Medium

• [frontend] Dead code & slow startup: unused mockData, serial settings IPC, no-op shortcut hook, fake build date #43 — Dead code & slow startup: unused mockData, serial settings IPC, no-op shortcut hook, fake build date
• [frontend] Type safety at the chat-history API boundary: any[] flows unvalidated into the store #45 — Type safety at the chat-history API boundary: any[] flows unvalidated into the store
• [frontend] Robustness & error UX: native dialogs, retry timeout hack, swallowed errors, defaultModel overload #47 — Robustness & error UX: native dialogs, retry timeout hack, swallowed errors, defaultModel overload

Low

• [frontend] Accessibility & theming: missing aria-labels, hardcoded hex colors, manual memoization #49 — Accessibility & theming: missing aria-labels, hardcoded hex colors, manual memoization

area:agent (12)

Critical

• [agent] Token budget (25k/turn, 200k/session) is never enforced #42 — Token budget (25k/turn, 200k/session) is never enforced
• [agent] Synchronous Neo4j driver called from async nodes blocks the event loop #46 — Synchronous Neo4j driver called from async nodes blocks the event loop
• [agent] No timeouts on LLM calls in the orchestration path #48 — No timeouts on LLM calls in the orchestration path

High

• [agent] Citation grounding bypassed: uncited critical/warning findings pass the composer #50 — Citation grounding bypassed: uncited critical/warning findings pass the composer
• [agent] Dead 'dropped' return value masks intent in composer._collect_findings #52 — Dead 'dropped' return value masks intent in composer._collect_findings
• [agent] Replan overflow writes a discarded final; 'bail to composer with partial' never happens #53 — Replan overflow writes a discarded final; 'bail to composer with partial' never happens
• [agent] partial flag off-by-one: exhausted replans composed as partial=False #54 — partial flag off-by-one: exhausted replans composed as partial=False
• [agent] Supervisor plan event can exceed the <2s SSE SLA (no fast-path/timeout) #55 — Supervisor plan event can exceed the <2s SSE SLA (no fast-path/timeout)

Medium

• [agent] Harden query_graph Cypher: weak write-blocklist + unbounded read DoS at the injection surface #56 — Harden query_graph Cypher: weak write-blocklist + unbounded read DoS at the injection surface
• [agent] Orchestration correctness: re-grounding, replan keying, and plan-drop auditing #57 — Orchestration correctness: re-grounding, replan keying, plan-drop auditing
• [agent] Tool hardening: per-tool timeout, worker_subset dispatch enforcement, error handling, recursion guard #58 — Tool hardening: per-tool timeout, worker_subset dispatch enforcement, error handling, recursion guard

Low

• [agent] Duplication & cost-estimate debt: shared Neo4j tool wrapper + per-model pricing #59 — Duplication & cost-estimate debt: shared Neo4j tool wrapper + per-model pricing

area:api (11)

Critical

• [api] Provider API keys can be reflected to client/logs via str(e) on key-bearing settings endpoints #60 — Provider API keys can be reflected to client/logs via str(e) on key-bearing endpoints
• [api] Full prompts/responses logged unredacted to persistent file and served over an endpoint #61 — Full prompts/responses logged unredacted to a persistent file and served over an endpoint

High

• [api] delete_session: db.delete(record) not awaited — single-session delete silently no-ops #62 — delete_session: db.delete(record) not awaited — single-session delete silently no-ops
• [api] Raw exception strings leaked to clients via SSE/HTTP errors; no global exception handler #63 — Raw exception strings leaked to clients via SSE/HTTP errors; no global exception handler
• [api] Localhost backend is unauthenticated with wide-open CORS (allow_origins=["*"]) #64 — Localhost backend is unauthenticated with wide-open CORS (allow_origins=["*"])
• [api] Cloud provider clients construct SDKs with no request timeout — hung upstream stalls SSE + DB session #65 — Cloud provider clients construct SDKs with no request timeout — hung upstream stalls SSE + DB session
• [api] retry_async can fall through to an implicit None return — add terminal re-raise #66 — retry_async can fall through to an implicit None return — add terminal re-raise

Medium

• [api] Input validation & query-param hardening: bound message size, limit/offset, escape Lucene query #67 — Input validation & query-param hardening: bound message size, limit/offset, escape Lucene query
• [api] API hygiene & Pydantic response models: add response_model, validate SSE envelope, fix provider Literal #69 — API hygiene & Pydantic response models: add response_model, validate SSE envelope, fix provider Literal
• [api] Provider client robustness: streaming retry gap, Ollama reachability probe, token-usage accounting #74 — Provider client robustness: streaming retry gap, Ollama reachability probe, token-usage accounting

Low

• [api] Minor cleanup & latent footguns: Pydantic v2 config, settings mutation, blocking Neo4j calls, dead code, json default=str #77 — Minor cleanup & latent footguns: Pydantic v2 config, settings mutation, blocking Neo4j calls, dead code, json default=str

area:data (11)

Critical

• [data] Cross-session Log.id collision corrupts causal edges and citations #68 — Cross-session Log.id collision corrupts causal edges and citations
• [data] Log timestamps stored as str(timedelta) break ordering and long-bag causal timing #70 — Log timestamps stored as str(timedelta) break ordering and long-bag causal timing

High

• [data] clear_session leaks orphaned Fact nodes on every re-ingestion #72 — clear_session leaks orphaned Fact nodes on every re-ingestion
• [data] write_diagnostics cross-links diagnostics to unrelated sensors via loose CONTAINS match #75 — write_diagnostics cross-links diagnostics to unrelated sensors via loose CONTAINS match
• [data] Vector search applies severity filter and pagination after k-NN truncation, dropping valid results #78 — Vector search applies severity filter and pagination after k-NN truncation, dropping valid results
• [data] Bag file path opened without validation or containment checks #80 — Bag file path opened without validation or containment checks
• [data] Inline DB3 parser crashes with KeyError on a message from an undeclared topic #82 — Inline DB3 parser crashes with KeyError on a message from an undeclared topic

Medium

• [data] Ingestion correctness & performance: embedding-dim default, O(n^2) edges, no write transaction, dup parser #84 — Ingestion correctness & performance: embedding-dim default, O(n²) edges, no write transaction, dup parser
• [data] Service & worker contract compliance: corrupt bag reported as ready, untyped parse errors, wrong tool count #86 — Service & worker contract compliance: corrupt bag reported as ready, untyped parse errors, wrong tool count
• [data] Worker /health server binds 0.0.0.0, exposing unauthenticated health on all interfaces #91 — Worker /health server binds 0.0.0.0, exposing unauthenticated health on all interfaces

Low

• [data] Error handling & observability: print() over logging, silent rule-load failure, bare except swallowing errors #89 — Error handling & observability: print() over logging, silent rule-load failure, bare except swallowing errors

area:infra (13)

Critical

• [infra] CI runs no typecheck/lint/tests/eval gate — broken PRs merge green #71 — CI runs no typecheck/lint/tests/eval gate — broken PRs merge green
• [infra] macOS release builds are signed but never notarized — Gatekeeper blocks the app #73 — macOS release builds are signed but never notarized — Gatekeeper blocks the app

High

• [infra] ASAR integrity validation not enabled in packaged builds #76 — ASAR integrity validation not enabled in packaged builds
• [infra] No auto-update mechanism — no electron-updater, no update manifests #79 — No auto-update mechanism — no electron-updater, no update manifests
• [infra] Docker images non-reproducible — uv.lock committed but no Dockerfile uses it #81 — Docker images non-reproducible — uv.lock committed but no Dockerfile uses it
• [infra] All 7 backend/worker containers run as root with user home bind-mounted #83 — All 7 backend/worker containers run as root with user home bind-mounted
• [infra] No frontend/TypeScript test setup — pnpm test is a no-op that exits 0 #85 — No frontend/TypeScript test setup — pnpm test is a no-op that exits 0
• [infra] No ESLint config — pnpm lint always passes, AGENT.md rules unenforced #87 — No ESLint config — pnpm lint always passes, AGENT.md rules unenforced

Medium

• [infra] Image tagging & orchestration inconsistencies break pulls/builds #88 — Image tagging & orchestration inconsistencies break pulls/builds
• [infra] Docker reproducibility & hardening: pin base images, secure Neo4j, fix .dockerignore #90 — Docker reproducibility & hardening: pin base images, secure Neo4j, fix .dockerignore
• [infra] CI security & type-safety gates: secret scanning + stricter tsconfig #92 — CI security & type-safety gates: secret scanning + stricter tsconfig
• [infra] Golden eval harness gives false assurance: one hardcoded log set + dead confidence check #93 — Golden eval harness gives false assurance: one hardcoded log set + dead confidence check

Low

• [infra] Packaging & version hygiene: backend version drift + externalized deps may be missing #94 — Packaging & version hygiene: backend version drift + externalized deps may be missing