March 17, 2026

[vinaysrao1]

Housekeeping

• PRs that need review
• Issues that need PRs

Coop v1 readiness

• Vite and Apollo updates
• Other security issues

Coop simplification

• What are the key hurdles to adoption, maintenance, extension
• Package level
• Architecture level (reduce services, clean up dependencies). The key question here is what purpose does the head version serve

Coop features

• Config based signals <— done
• Model cards
• Agentic assist

[julietshen]

Notes

High level

• Better labeling and prioritization (Juliet, Cassidy, and Vinay) for Good First Issues

PRs

• CI pipeline failure due to Betterer improvement - Juan Approved (ci: Realign Betterer results file with current code base state #117)
• Configure HMA ( [HMA][Exchanges] Configure HMA exchanges directly from coop  #115): UX questions from Felix. Vinay to do code review. UX from Felix
• GraphQL depth to 10 (Setting GraphQL depth limit to 10 #109): Pawel to review the PR
• Vite migration (Migrate to vite #74): Juan reviewing. We need to remove older dependencies in package.json, import, npm installs. once reviewed - Juan will merge. Unless there are concerns during review, this should be ready by EOW.

Issues

• Tracking node versions with Dependabot (Track Node version with Dependabot #118) - pick up after back
• Model cards inside coop (Integration model cards #79)
  • Done for existing integrations (Google, OAI and Zentropi need to upload now). Extend to upload for newer signal integrations
• NCMEC setting savings need designs (Provide a warning if NCMEC settings are saved without additional information #76 )

Coop Security Readiness

• for v1 readiness, where do we stand?
• @vinaysrao1 shared a Google doc draft of a Security plan that will be cross-posted to Github Discussions.
  • Working Checklist
    • Secured cookies
    • Postgres backed sessions
    • API key hashing
    • Password hashing
    • SAML SSO support
    • Graphql introspection disabled
    • Eslint-plugin security in lint pipeline
    • Parametrized queries (no raw SQL)
  • 6 main priorities for Coop v1 security readiness
    • Run npm audit in CI: We have 300+ packages across many lock files. This is our major eng work and most of the dependabot alerts are coming from here.
    • Run owasp-top-ten in CI to catch issues eslint does not check (access, cryptographic failures, injection, data integrity failures, SSRF)
      • CodeQL might cover the top 10. - @juanmrad to take
    • Pin docker images: Pin all service versions in docker to avoid supply chain risks
      • Should be done, @pawiecz to confirm
    • Deeper dependency scanning like we did for Osprey - FawltyDeps-like package for Typescript
    • More testing security features like API key requests, SAML callbacks, oversized requests, rate limit checks
    • Audit logging: This is for org safety to track user creation, role changes, API key rotation etc.
• Vite migration should clean up most npm alerts in server. Apollo migration is next as a higher priority. Express, Helmet, and Tailwind are breaking changes and would be the next priority. @juanmrad to look into enabling Dependabot into CVEs. Recognized that these might not be main attack vectors for coop instances.
• Decision to focus on CVEs and then figure out the schedule for updating.

Code simplification

• TLDR; hundreds of packages that need cleanup for code hygiene. There are also feature and architecture-level cleanup, including reducing services and number of databases needed for Coop.
• need community feedback

[emanueleaina]

This and next week @pawiecz will be enjoying a well deserved vacation, if anybody needs to discuss anything for when @pawiecz will be back just poke @emanueleaina. :)

[julietshen]

Here is the discussion topic for Coop's codebase simplification and architecture cleanup: #123

[pawiecz]

The last remaining unpinned Docker image was addressed in #311