🎯 Security audit hardening — Node + Vue (2026-06 audit)

[PierreBrisorgueil]

Parent tracker for the confirmed findings of a multi-agent security audit of the Node + Vue stacks (auth / authz / identity, config env-gating, input handling, supply chain). Each finding was adversarially verified (two independent skeptics + a tiebreak per finding); 19 confirmed out of 36 raw candidates. Refuted candidates (uploads IDOR, multer MIME/size guards, JWT-cookie Secure flag, path-to-regexp ReDoS, stale .snyk files) are intentionally not filed.

Sub-issues

• S1 (Node) — OAuth callback trusts client-asserted identity → pre-auth account takeover · critical
• S2 (Node) — Mass assignment on signup (emailVerified / providerData client-settable) · high
• S3 (Node) — Org self-join via shadowed Organization policy subject · high
• S4 (Node) — Production env-gate defect class: error leak + swagger / mongoose-debug / rate-limiter defaults · medium + low
• S5 (Node) — Hardening bundle: login timing oracle, sharp resize DoS, dependabot auto-merge, prod deps · low
• S6 (Vue) — Hardening bundle: reverse tabnabbing, href scheme, console credential logging, security headers, npm ci, stale deploy key · low

Sibling epic: #3804 (Auth & session hardening). Related: #3825 (email-change emailVerified reset), #3833 (invitations scoping).

Each sub-issue ships through the normal stack flow (/feature → /verify → PR). Order: S1 → S2 → S3 first (server-side trust boundaries), then S4, then S5 / S6.

Created via /dev:issue