fix: fix security issue in index.js

[anupamme]

Summary

Fix critical severity security issue in index.js.

Vulnerability

Field	Value
ID	V-001
Severity	CRITICAL
Scanner	multi_agent_ai
Rule	V-001
File	index.js:26
Assessment	Likely exploitable
Chain Complexity	2-step

Description: The /admin endpoint serves the administrative HTML interface without any authentication or authorization checks. While the POST /api/catchUpLink endpoint has Basic Auth protection, the GET /admin endpoint is completely exposed, allowing unauthenticated access to the administrative UI.

Evidence

Exploitation scenario: Attacker navigates directly to http:///admin without credentials.

Scanner confirmation: multi_agent_ai rule V-001 flagged this pattern.

Production code: This file is in the production codebase, not test-only code.

Threat Model Context

This is a Node.js library - vulnerabilities affect downstream consumers who use this package.

Changes

• index.js

Behavior Preservation

The change is scoped to 1 file on the vulnerable path.

Security Invariant

Property: Protected endpoints reject unauthenticated requests

Regression test

const request = require("supertest");
const app = require("./index");

describe("Protected endpoints reject unauthenticated requests", () => {
  const payloads = [
    { name: "missing auth", header: null },
    { name: "invalid credentials", header: "Basic invalidtoken" },
    { name: "malformed header", header: "Bearer notbasic" },
  ];

  test.each(payloads)("rejects request to /admin with %s", async ({ name, header }) => {
    const req = request(app).get("/admin");
    if (header) req.set("Authorization", header);
    
    const res = await req;
    expect([401, 403]).toContain(res.status);
  });
});

This test guards against regressions — it's useful independent of the code change above.

---

Automated security fix by OrbisAI Security

[netlify]

👷 Deploy request for otc-catchup pending review.

Visit the deploys page to approve it

Name	Link
🔨 Latest commit	8a9bd7c