Skip to content

fix: security and type safety hardening#61

Merged
AdamJ merged 2 commits intomainfrom
claude/security-type-safety-aoIS5
Mar 22, 2026
Merged

fix: security and type safety hardening#61
AdamJ merged 2 commits intomainfrom
claude/security-type-safety-aoIS5

Conversation

@AdamJ
Copy link
Owner

@AdamJ AdamJ commented Mar 22, 2026

  • removed as string assertions on env vars
  • removed Window debug helpers with Vite's tree-shaker stripping any exposed helpers
  • changed parseInt(value) to parseInt(value, 10) to prevent silent misparse of strings

claude added 2 commits March 22, 2026 15:12
1. Remove unsafe 'as string' assertions on Supabase env vars (supabase.ts)
   - VITE_SUPABASE_URL and VITE_SUPABASE_ANON_KEY were cast to string, hiding
     the string | undefined type from TypeScript. The existing null-guard and
     ?? '' fallback on createClient() already handle the missing-var case;
     removing the assertions lets the compiler enforce that handling correctly.

2. Add explicit radix to parseInt in CSV import (exportUtils.ts)
   - parseInt(taskData.duration) without a radix relies on implicit base-10
     inference. Added parseInt(taskData.duration, 10) to make intent explicit
     and prevent any engine-specific octal/hex surprises.

3. Gate window debug helpers behind import.meta.env.DEV (supabase.ts)
   - getDbCallStats, resetDbCallStats, and clearDbCallLog were attached to
     window in all environments, exposing internal database call telemetry to
     anyone with DevTools access in production. Now gated behind DEV so the
     helpers are stripped from production bundles by Vite's tree-shaker.

https://claude.ai/code/session_012AmNjF3Ju9VJwSWybJqBEw
@AdamJ AdamJ self-assigned this Mar 22, 2026
@AdamJ AdamJ added the enhancement New feature or request label Mar 22, 2026
@AdamJ AdamJ merged commit 87dcdf8 into main Mar 22, 2026
2 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

enhancement New feature or request

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants