Run comprehensive tests for all API features including USPS integration, Platphorm MCP, ShipRush, and security.
" }, { "kind": "security", "source_path": "components/shipping/test-runner.tsx", "line": 521, "text": "testDesc?.category === 'security' ? 'border-orange-300 text-orange-700 dark:text-orange-400' :" }, { "kind": "security", "source_path": "components/shipping/test-runner.tsx", "line": 570, "text": "Tests cover ZIP validation, rate calculations, Platphorm integration, ShipRush service, and security features" }, { "kind": "security", "source_path": "docs/ROADMAP.md", "line": 52, "text": "#### Security" }, { "kind": "security", "source_path": "docs/ROADMAP.md", "line": 69, "text": "- Security Tests" }, { "kind": "deprecated", "source_path": "docs/VANAGAIN_SHIPPING_SOLUTION_PLAN.md", "line": 24, "text": "1. **Legacy API Dependency**: Code uses deprecated `RateV4Request` XML format" }, { "kind": "security", "source_path": "docs/VANAGAIN_SHIPPING_SOLUTION_PLAN.md", "line": 211, "text": "### Security Note (Phase 1)" }, { "kind": "security", "source_path": "docs/VANAGAIN_SHIPPING_SOLUTION_PLAN.md", "line": 217, "text": "## Phase 2: Security & Reliability (Week 2-3)" }, { "kind": "security", "source_path": "docs/VANAGAIN_SHIPPING_SOLUTION_PLAN.md", "line": 391, "text": "# Security (Phase 2)" }, { "kind": "security", "source_path": "docs/VANAGAIN_SHIPPING_SOLUTION_PLAN.md", "line": 499, "text": "### Phase 2 (Security)" }, { "kind": "security", "source_path": "docs/VANAGAIN_SHIPPING_SOLUTION_PLAN.md", "line": 546, "text": "- 🔒 **Security**: Authentication added incrementally" }, { "kind": "security", "source_path": "lib/openapi.ts", "line": 142, "text": "security: []," }, { "kind": "security", "source_path": "lib/openapi.ts", "line": 204, "text": "security: [{ PlatPhormApiKey: [] }, { PlatPhormBearer: [] }]," }, { "kind": "security", "source_path": "lib/phase1.ts", "line": 334, "text": "'/.well-known/security.txt'," }, { "kind": "todo", "source_path": "lib/platphorm-service.ts", "line": 115, "text": "// TODO: Integrate with VanAgain's cart API when available" }, { "kind": "security", "source_path": "lib/test-descriptions.ts", "line": 16, "text": "category: 'validation' | 'calculation' | 'integration' | 'security' | 'api' | 'future';" }, { "kind": "security", "source_path": "lib/test-descriptions.ts", "line": 47, "text": "security: {" }, { "kind": "security", "source_path": "lib/test-descriptions.ts", "line": 48, "text": "name: 'Security & JA4+'," }, { "kind": "security", "source_path": "lib/test-descriptions.ts", "line": 49, "text": "description: 'Tests for security features including JA4+ fingerprinting, rate limiting, and bot protection patterns.'," }, { "kind": "security", "source_path": "lib/test-descriptions.ts", "line": 212, "text": "category: 'security'," }, { "kind": "security", "source_path": "lib/test-descriptions.ts", "line": 246, "text": "category: 'security'," }, { "kind": "security", "source_path": "lib/test-descriptions.ts", "line": 291, "text": "// Security & JA4+ Tests" }, { "kind": "security", "source_path": "lib/test-descriptions.ts", "line": 296, "text": "category: 'security'," }, { "kind": "security", "source_path": "lib/test-descriptions.ts", "line": 301, "text": "category: 'security'," }, { "kind": "security", "source_path": "lib/test-descriptions.ts", "line": 307, "text": "category: 'security'," }, { "kind": "security", "source_path": "lib/test-descriptions.ts", "line": 312, "text": "category: 'security'," }, { "kind": "security", "source_path": "lib/test-descriptions.ts", "line": 317, "text": "category: 'security'," }, { "kind": "security", "source_path": "lib/test-descriptions.ts", "line": 322, "text": "category: 'security'," }, { "kind": "security", "source_path": "lib/test-descriptions.ts", "line": 327, "text": "category: 'security'," }, { "kind": "security", "source_path": "lib/test-descriptions.ts", "line": 350, "text": "full: 'Documents POST /api/webhooks/shiprush endpoint for receiving ShipRush tracking updates. Validates HMAC signatures for security.'," }, { "kind": "security", "source_path": "lib/test-descriptions.ts", "line": 450, "text": "filterBySuite: 'Filter tests by category (USPS, Platphorm, ShipRush, Security, API, Future).'," }, { "kind": "security", "source_path": "lib/usps-extra-services.ts", "line": 123, "text": "description: 'Maximum security and detailed tracking for valuables'," }, { "kind": "security", "source_path": "middleware.ts", "line": 122, "text": "// Set Security Headers" }, { "kind": "security", "source_path": "middleware.ts", "line": 126, "text": "response.headers.set('Strict-Transport-Security', 'max-age=31536000; includeSubDomains');" }, { "kind": "unsafe", "source_path": "middleware.ts", "line": 127, "text": "response.headers.set('Content-Security-Policy', \"default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval'; style-src 'self' 'unsafe-inline'; img-src 'self' data: https:; font-src 'self' data:; connect-src 'self' https:;\");" }, { "kind": "security", "source_path": "README.md", "line": 17, "text": "- JA4+ HTTP fingerprinting for security analytics" }, { "kind": "security", "source_path": "README.md", "line": 159, "text": "## Security" }, { "kind": "security", "source_path": "ROADMAP.md", "line": 3, "text": "This roadmap outlines the current state of the USPS Shipping API v3 project and proposes actionable next steps across Features, Performance, Security, and User Experience (UX/Accessibility). The goal is to evolve the current Minimum Viable " }, { "kind": "security", "source_path": "ROADMAP.md", "line": 10, "text": "- **Security:** \"Sentinel\" has hardened the API by removing hardcoded secrets, mitigating timing attacks in password validation, sanitizing error responses, enforcing JA4+ fingerprinting, and implementing basic rate limiting." }, { "kind": "security", "source_path": "ROADMAP.md", "line": 44, "text": "## 4. Security Hardening" } ], "security": { "secret_risks": [], "unsafe_patterns": [ { "name": "child-process-exec", "confidence": "medium", "evidence_paths": [ "lib/platphorm-service.ts" ] }, { "name": "dangerously-set-html", "confidence": "medium", "evidence_paths": [ "components/json-ld.tsx", "components/ui/chart.tsx" ] }, { "name": "sql-injection-review-needed", "confidence": "medium", "evidence_paths": [ "lib/db.ts" ] }, { "name": "ssrf-review-needed", "confidence": "medium", "evidence_paths": [ "components/shipping/trace-viewer.tsx", "lib/mcp-client.ts", "lib/platphorm-service.ts", "lib/polymarket-api.ts", "lib/shiprush-service.ts", "lib/usps-service.ts" ] } ], "sensitive_data_indicators": [ { "name": "api_key", "confidence": "medium", "evidence_paths": [ "__tests__/lib/platphorm-service.test.ts", "__tests__/lib/shiprush-service.test.ts", "__tests__/lib/usps-service.test.ts", "app/.well-known/ai-plugin.json/route.ts", "app/.well-known/trust.json/route.ts", "app/api/v1/packages/presets/route.ts", "app/api/v1/reports/quote/route.ts", "app/api/v1/shipments/route.ts", "app/api/v1/tests/route.ts", "app/faq/page.tsx", "app/llms-full.txt/route.ts", "app/llms.txt/route.ts", "app/page.tsx", "components/shipping/mcp-status.tsx", "docs/VANAGAIN_SHIPPING_SOLUTION_PLAN.md", "lib/db.ts", "lib/mcp-client.ts", "lib/openapi.ts", "lib/phase1.ts", "lib/platphorm-service.ts" ] }, { "name": "card", "confidence": "medium", "evidence_paths": [ "__tests__/components/api-tester.test.tsx", ".Jules/bolt.md", ".Jules/sentinel.md", "app/api-policy/page.tsx", "app/faq/page.tsx", "app/globals.css", "app/jobs/page.tsx", "app/layout.tsx", "app/page.tsx", "app/privacy/page.tsx", "app/terms/page.tsx", "components/api-policy/available-endpoints-card.tsx", "components/api-policy/best-practices-card.tsx", "components/api-policy/rate-limits-card.tsx", "components/api-policy/response-headers-card.tsx", "components/api-policy/security-requirements-card.tsx", "components/shipping/api-debug-panel.tsx", "components/shipping/api-tester.tsx", "components/shipping/developer-panel.tsx", "components/shipping/health-status.tsx" ] }, { "name": "email", "confidence": "medium", "evidence_paths": [ "__tests__/api/shipments.test.ts", "__tests__/lib/shiprush-service.test.ts", "app/.well-known/ai-plugin.json/route.ts", "app/api/v1/shipments/route.ts", "app/api/v1/tests/route.ts", "app/privacy/page.tsx", "app/terms/page.tsx", "components/footer.tsx", "components/json-ld.tsx", "docs/ROADMAP.md", "docs/VANAGAIN_SHIPPING_SOLUTION_PLAN.md", "lib/db.ts", "lib/openapi.ts", "lib/shipping-types.ts", "lib/shiprush-service.ts", "lib/test-config.ts", "lib/types/shipping.ts", "lib/usps-extra-services.ts", "scripts/001-create-schema.sql" ] }, { "name": "fingerprint", "confidence": "medium", "evidence_paths": [ "__tests__/api/audit.test.ts", "__tests__/api/domestic-rates-comprehensive.test.ts", "__tests__/api/international-rates-comprehensive.test.ts", "__tests__/api/rates.test.ts", "__tests__/integration/api-ui-sync.test.ts", "__tests__/integration/e2e-rate-flow.test.ts", "__tests__/lib/db.test.ts", "__tests__/lib/fingerprint.test.ts", "__tests__/middleware/middleware.test.ts", "app/api-policy/page.tsx", "app/api/v1/audit/route.ts", "app/api/v1/fingerprint/route.ts", "app/api/v1/rates/calculate/route.ts", "app/api/v1/rates/international/route.ts", "app/api/v1/shipments/route.ts", "app/api/v1/tests/route.ts", "app/api/v1/tracking/[trackingNumber]/route.ts", "app/faq/page.tsx", "app/layout.tsx", "app/privacy/page.tsx" ] }, { "name": "health", "confidence": "medium", "evidence_paths": [ "__tests__/api/health.test.ts", "__tests__/components/api-tester.test.tsx", "__tests__/lib/db.test.ts", "__tests__/lib/mcp-client.test.ts", "__tests__/lib/platphorm-service.test.ts", "__tests__/middleware/middleware.test.ts", ".Jules/code-health-review.md", "app/api-policy/page.tsx", "app/api/health/route.ts", "app/api/mcp/route.ts", "app/api/v1/health/route.ts", "app/api/v1/status/route.ts", "app/api/v1/tests/route.ts", "app/api/v1/usps/status/route.ts", "app/robots.txt/route.ts", "components/api-policy/available-endpoints-card.tsx", "components/footer.tsx", "components/shipping/api-docs-tab.tsx", "components/shipping/api-tester.tsx", "components/shipping/developer-docs.tsx" ] }, { "name": "ip address", "confidence": "medium", "evidence_paths": [ "app/faq/page.tsx", "app/privacy/page.tsx", "lib/test-descriptions.ts" ] }, { "name": "location", "confidence": "medium", "evidence_paths": [ "__tests__/lib/platphorm-service.test.ts", ".Jules/bolt.md", "app/error.tsx", "app/global-error.tsx", "components/shipping/api-tester.tsx", "components/shipping/international-rate-form.tsx", "components/shipping/rate-calculator-form.tsx", "components/shipping/test-runner.tsx", "lib/ai-tools.ts", "lib/client-logger.ts", "lib/platphorm-service.ts", "lib/shiprush-service.ts", "lib/test-descriptions.ts", "lib/types/shipping.ts", "lib/usps-service.ts", "ROADMAP.md" ] }, { "name": "oauth", "confidence": "medium", "evidence_paths": [ "__tests__/lib/usps-service-rates.test.ts", "app/api/v1/tests/route.ts", "docs/ROADMAP.md", "docs/VANAGAIN_SHIPPING_SOLUTION_PLAN.md", "lib/usps-service.ts", "README.md" ] }, { "name": "password", "confidence": "medium", "evidence_paths": [ ".Jules/sentinel.md", "lib/test-descriptions.ts", "README.md", "ROADMAP.md" ] }, { "name": "payment", "confidence": "medium", "evidence_paths": [ "lib/country-codes.ts", "lib/usps-extra-services.ts" ] }, { "name": "pii", "confidence": "medium", "evidence_paths": [ "lib/fingerprint.ts", "package-lock.json", "pnpm-lock.yaml" ] }, { "name": "secret-like environment variables", "confidence": "medium", "evidence_paths": [ "package.json" ] }, { "name": "token", "confidence": "medium", "evidence_paths": [ "__tests__/api/health.test.ts", "__tests__/api/international-rates-comprehensive.test.ts", "__tests__/integration/api-ui-sync.test.ts", "__tests__/integration/e2e-rate-flow.test.ts", "__tests__/lib/usps-service-rates.test.ts", "app/api/health/route.ts", "app/api/v1/rates/international/route.ts", "app/api/v1/status/route.ts", "app/api/v1/usps/status/route.ts", "app/faq/page.tsx", "components/shipping/health-status.tsx", "docs/ROADMAP.md", "docs/VANAGAIN_SHIPPING_SOLUTION_PLAN.md", "lib/openapi.ts", "lib/usps-service.ts", "package-lock.json", "pnpm-lock.yaml" ] } ] }, "generated_at": "2026-05-16T16:44:20.854Z" }