From b4a887c22106e57d3da9206b7c232f6fc18fa214 Mon Sep 17 00:00:00 2001 From: Cursor Agent Date: Wed, 24 Jun 2026 09:36:16 +0000 Subject: [PATCH 1/2] fix(security): restrict Firestore reads to admin-only for sensitive collections The config/weirdness, event_logs, and security_reports collections previously allowed read access to any authenticated user (isAuthenticated()). Since Firebase Auth accepts any Google account, this exposed RTSP camera credentials and security event history to unauthorized users. Changed all three collections from 'allow read: if isAuthenticated()' to 'allow read: if isAdmin()' to enforce proper authorization. Co-authored-by: CARBComplianceApp --- workers/silverback-ai-studio/firestore.rules | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/workers/silverback-ai-studio/firestore.rules b/workers/silverback-ai-studio/firestore.rules index 598e0da..6ab1d33 100644 --- a/workers/silverback-ai-studio/firestore.rules +++ b/workers/silverback-ai-studio/firestore.rules @@ -65,19 +65,19 @@ service cloud.firestore { } match /event_logs/{logId} { - allow read: if isAuthenticated(); + allow read: if isAdmin(); allow create: if isAdmin() && isValidEventLog(request.resource.data); allow update, delete: if isAdmin(); } match /security_reports/{reportId} { - allow read: if isAuthenticated(); + allow read: if isAdmin(); allow create: if isAdmin() && isValidSecurityReport(request.resource.data); allow update, delete: if isAdmin(); } match /config/weirdness { - allow read: if isAuthenticated(); + allow read: if isAdmin(); allow write: if isAdmin() && isValidWeirdnessConfig(request.resource.data); } } From 876cd38810238ae394bd350ede4be87641bd4398 Mon Sep 17 00:00:00 2001 From: Cursor Agent Date: Wed, 24 Jun 2026 09:36:22 +0000 Subject: [PATCH 2/2] fix(security): add .env exclusion patterns to root .gitignore The root .gitignore was missing .env, .env.*, .env.local, and .env.production patterns, risking accidental commit of secrets from any directory in the monorepo. The the-unit/api/.gitignore already had these patterns, but the root did not. Co-authored-by: CARBComplianceApp --- .gitignore | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/.gitignore b/.gitignore index 7a07c41..97f37bb 100644 --- a/.gitignore +++ b/.gitignore @@ -3,3 +3,7 @@ node_modules/ .wrangler/ .hermes/ *.log +.env +.env.* +.env.local +.env.production