Sterling Security & Quality Audit Report

Application Inventory

22 wrangler.toml files found. Key applications with server-side logic (Functions/Workers) listed below.

D1 Database Inventory

All Findings

Authentication Implementations

1. Brad's Command Center

Strongest auth implementation. PBKDF2-SHA256 (100K iterations), SMS 2FA via Twilio Verify, rate limiting, session tokens in D1.

// brads-command-center/functions/api/auth.js:18-28
async function hashPassword(password, salt) {
  const enc = new TextEncoder();
  const keyMaterial = await crypto.subtle.importKey(
    'raw', enc.encode(password), 'PBKDF2', false, ['deriveBits']
  );
  const bits = await crypto.subtle.deriveBits({
    name: 'PBKDF2',
    salt: enc.encode(salt),
    iterations: 100000,
    hash: 'SHA-256',
  }, keyMaterial, 256);
  return Array.from(new Uint8Array(bits))
    .map(b => b.toString(16).padStart(2, '0')).join('');
}

// brads-command-center/functions/api/auth.js:95-118
async function checkRateLimit(db, ip) {
  try {
    // ... rate limit logic ...
    return (row?.cnt || 0) >= 5; // blocked if 5+ attempts in 15 min
  } catch (e) {
    return false; // if rate limit table fails, don't block (but log it)
  }
}

// Session creation: auth.js:541-542
const token = generateToken(); // 32 random bytes -> hex
const expiresAt = new Date(Date.now() + 48 * 60 * 60 * 1000).toISOString();

2. Stevens Family Planner

// stevens-family-planner/functions/api/auth.js:114-115
if (password.length < 6) {
  return jsonResponse({ error: 'Password must be at least 6 characters' }, 400);
}

3. OA Client Dashboards

// oa-client-dashboards/functions/api/_middleware.js:17-20
export async function onRequest(context) {
  // AUTH BYPASSED per Brad's directive (July 9, 2026) — all routes public
  return await context.next();
  /* ... 90 lines of auth code commented out ... */
}

4. Core Forum Hub

Uses HMAC-signed JWTs with SHA-256. Has rate limiting, login attempt tracking, and password reset flow. Appears well-implemented. Has CSP headers.

5. NYO Football Schedule

6. Debs Swim School Dashboard

7. Lineup Tool API

JWT-based auth with HMAC-SHA256 signatures. PBKDF2 password hashing with 100K iterations. Stripe webhook signature verification implemented correctly with timestamp tolerance checking. CORS properly configured to specific origins in wrangler.toml.

Authorization & IDOR Analysis

OA Client Dashboards — TOTAL BYPASS

Correction to the above: Individual admin endpoints DO have if (!user) checks that return 401 because context.data.user is never set. So admin endpoints are inaccessible. But non-admin endpoints (dashboard, content, news, tickets, tools, va, hubspot-payments) have NO individual auth checks and are fully open.

Brad's Command Center — Single-User Model

Auth check happens at the start of each endpoint handler via authCheck(request, env). Returns 401 if unauthorized. No multi-tenancy, no IDOR risk by design (single user). However, the master token grants identical access to session-based access with no audit trail differentiation.

// brads-command-center/functions/api/_auth.js:21-52
export async function authCheck(request, env) {
  const auth = request.headers.get('Authorization');
  if (!auth || !auth.startsWith('Bearer ')) {
    return jsonResponse({ error: 'Unauthorized' }, 401);
  }
  const token = auth.slice(7);
  if (token === env.BRAIN_DUMP_TOKEN) {
    return null; // authorized — no user identity attached
  }
  // ... session check ...
}

Stevens Family Planner — Multi-User, Role-Based

Auth check returns user object including role. Some endpoints check user.role === 'admin' for privileged operations (create_user, delete_user, manage_user). The activities and restaurants endpoints do NOT filter by user_id, meaning any authenticated user can see/modify all records.

// stevens-family-planner/functions/api/activities.js:40-45
// ALL activities returned — no user_id filter
const result = await env.DB.prepare(
  'SELECT * FROM activities ORDER BY category, name'
).all();
return jsonResponse({ activities: result.results || [] });

Core Forum Hub — Proper Role-Based

JWT payload includes id, name, role (admin/member). Admin endpoints check role. Meeting endpoints reference the logged-in user's ID for voting, preventing impersonation. Best authorization implementation of all apps.

Lineup Tool API — Per-User Data Isolation

JWT includes userId. Team/player CRUD filters by user_id in D1 queries. IDOR protection appears adequate based on code review: queries use .bind(userId) consistently.

Injection & Input Validation

SQL Injection

Evidence: grep -rn "\.prepare(\`" --include="*.js" --exclude-dir=node_modules returned zero matches. All queries use the pattern .prepare('SELECT ... WHERE x = ?').bind(value).

XSS

Multiple apps use innerHTML to render content, but most of this is admin-only content or server-provided data, not raw user input. Key observations:

• family-travel-chat-v2/index.html:338,386 — sets innerHTML with AI-generated chat responses. If the AI returns HTML/JS, it would execute. LOW risk since the AI is prompted to answer travel questions, not inject scripts.
• brads-command-center/public/index.html:4922 — sets innerHTML with avatar URL from settings. If avatar_url contained a malicious payload, it could execute. Medium risk since avatar_url is set by authenticated users.
• No evidence of raw user input being directly injected into innerHTML from form fields in any app.

Command Injection / SSRF

Input Validation

Input validation varies by app:

Secrets & Configuration

Files Containing the Master Token

CLAUDE.md:987
email-scan/process_emails.py:13
forum-update-builder/process-regen.sh:10
forum-update-builder/regen-processor.sh:10
scripts/process-inbox-replies.js:23
scripts/finance-cashflow-sync.sh:8
scripts/evening-ops-runner.md:85,452
scripts/evening-ops-verify.md:80
skills/cloudflare-pages-inventory-registration.md:14,43
skills/command-center-action-processor.md:15,22,54,62,71,84
skills/command-center-qa.md:16,28,233
conversations/*.md (20+ conversation logs)

Environment Variables by App

The risk is entirely in the local development environment files, not in deployed code.

Data & Privacy Analysis

Personal Data Inventory

COPPA Analysis

Stevens Family Planner

Encryption

• In transit: All Cloudflare Pages/Workers traffic is HTTPS by default. HSTS headers present on major apps. Pass
• At rest: Cloudflare D1 provides encryption at rest by default (Cloudflare infrastructure). Passwords are hashed with PBKDF2-SHA256. Pass
• Session tokens, phone numbers, emails: Stored as plaintext in D1. This is standard practice but noted for completeness.

API & Abuse Protection

Rate Limiting

CORS Configuration

Webhook Signature Verification

Bot/Abuse Protections

Dependencies & Supply Chain

Package.json Files Found

Most apps are zero-dependency (pure Cloudflare Pages Functions with no npm packages). Only a few have package.json:

Hallucinated/Suspicious Packages

Automated Scan Results

Hardcoded Secrets Scan

grep -rn "sk-ant\|sk-or-v1\|api[_-]key.*=.*['\"]" --include="*.js" --include="*.html" --include="*.toml" --exclude-dir=node_modules

Result: 1 match (false positive) — a Puppeteer script searching for API key elements on a page:
  scripts/cloudways-get-api-key.js:55 — querySelectorAll('code, pre, .api-key...')

SQL Injection Scan

grep -rn "\.prepare(\`\|\.prepare(.*\+\|\.prepare(.*\$\{" --include="*.js" --exclude-dir=node_modules

Result: 0 matches

Wildcard CORS Scan

grep -rn "Access-Control-Allow-Origin" --include="*.js" --exclude-dir=node_modules

Results: 60+ matches analyzed. All use origin validation functions except:
  - stevens-family-planner-api/src/index.js:13 — env.CORS_ORIGIN || '*'
    wrangler.toml sets CORS_ORIGIN = "*" (FINDING H-02)

Error Message Leak Scan

grep -rn "err\.message\|e\.message\|error\.message" --include="*.js" --exclude-dir=node_modules | grep -i "response\|json\|return"

Findings:
  brads-command-center/functions/api/statement-scan.js:140 — detail: e.message
  brads-command-center/functions/api/statement-detect.js:127 — detail: e.message
  stevens-family-planner-api/src/index.js:203 — Places API error: ${placesData.error.message}
  lineup-tool-api/src/index.js:542 — session.error.message
  brads-brain-tabs/netlify/functions/sync-monday.js:80 — detail: e.message

npm audit

Could not run npm audit in this environment. npm install would need to be run first in each project directory, which is outside the scope of this read-only audit.

Testing & Quality Assurance

No test runners (Jest, Vitest, Mocha, etc.) are configured in any package.json. No test scripts. No CI/CD pipeline configuration found (no .github/workflows, no wrangler-action configs). No test files of any kind exist in any application directory.

The only testing evidence is a dugoutready-tests/ directory with a package.json, which appears to be a Puppeteer-based manual test setup, not automated CI tests.

OWASP ASVS Level 2 Assessment

Assessment against OWASP Application Security Verification Standard v4.0, Level 2 requirements. Evaluated against the primary apps (Command Center, OA Client Dashboards, SFP, Core Forum Hub, Lineup Tool).

V2: Authentication

V3: Session Management

V4: Access Control

V5: Validation, Sanitization, Encoding

Cannot Verify / Out of Visibility

The following items could not be verified during this source-code-only audit. They require access to the live Cloudflare dashboard, network testing, or runtime environment.

Prioritized Remediation Plan

Immediate (Do Today)

This Week

Next Sprint

Backlog