fix(security): close the remaining triage advisories

[lindesvard]

Summary

Closes the five remaining items from the security advisory triage. Stacked on #510 (needs the share-access helper from it); merge #510 first and this PR retargets to main.

Unauthenticated reads (GHSA-vrrm-p9p4-2gfg, GHSA-c98x-mph7-r6vp dup, GHSA-r4g5-vgpj-923m) — Medium

• reference.getChartReferences had no access check. event.bots let anonymous callers through whenever a shareOverview row existed, ignoring public and the password.
• Both now use a new hasAnonymousShareAccessToProject(projectId, cookies, kinds) in share.service.ts: the project must have a public share that is password-free or unlocked with a verified share-access cookie. Members still need project access. Share pages keep working because their viewers hold exactly that cookie.

ClickHouse escaping (GHSA-7fm7-rprq-g8rm, GHSA-gvwr-5684-wjqc, GHSA-gvr5-22f4-pj6g) — Medium

• conversion.service: event names, dates and project id were interpolated raw inside quotes. Now sqlstring.escaped.
• cohort.service profileColumnAccess: the column is an identifier and cannot be escaped, so it now enforces the same allowlist filter-where.service uses and throws on anything else.
• sankey.service: quote-doubling replaced with sqlstring.escape in all eight places. grep -rn "replace(/'/g" packages/db/src is now empty.

Bull Board (GHSA-r627-6vrh-65p9) — Medium

• Mounted only when BULLBOARD_USERNAME and BULLBOARD_PASSWORD are set, behind HTTP Basic auth with constant-time compare. Without them the worker logs a warning and serves only /healthcheck and /metrics (registered before the guard).
• Coolify template gets generated credentials. Docs updated.
• Behavior change for self-hosters: the dashboard is off until they set the two variables.

Secrets in logs (GHSA-xr2x-w49w-hp2c) — Low

• Migration banner redacts credentials in DATABASE_URL / CLICKHOUSE_URL (userinfo and password/sslpassword/user query params; comma-separated ClickHouse URLs handled).
• Email fallback logs one line with a redacted recipient instead of dumping template data.

Unsubscribe secret (GHSA-cv3v-4j56-hr88 side note) — Medium

• No more literal default secret. Requires UNSUBSCRIBE_SECRET or COOKIE_SECRET, read at call time so a missing value fails that request with a clear error.
• Coolify worker now gets COOKIE_SECRET. Before this, the worker on Coolify was signing unsubscribe links with the default and the API was verifying with the real secret, so those links were already broken there.

Test plan

• New: reference.test.ts (anon refused / anon with unlocked share served / member without access refused / member served)
• New: basic-auth.test.ts (accept, missing header, wrong user/password/malformed, colon in password)
• Existing share and js-runtime suites still pass (75 + 10)
• Typecheck: no errors in touched files
• Manual: open a public overview share, confirm chart annotations and bot list still render
• Manual: set the two Bull Board vars on a worker, confirm the browser prompts and the board loads; without them confirm /healthcheck still returns 200

Not in this PR

• Live visitors websocket has no session check (only returns a count; leftover from the already-fixed GHSA-8wr9 draft)
• Site-checker and MCP query-token points from GHSA-cv3v: design decisions, discussed in triage

🤖 Generated with Claude Code

[coderabbitai]

Navigate logical layers of code changes, visualize relationships, and explore their blast radius.

Note

Currently processing new changes in this PR. This may take a few minutes, please wait...

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Advanced

Run ID: 4bb630a7-6a3e-4108-abb2-925664dae74f

📥 Commits

Reviewing files that changed from the base of the PR and between 42fc862 and 466d543.

📒 Files selected for processing (23)

• apps/public/content/docs/self-hosting/environment-variables.mdx
• apps/worker/src/index.ts
• apps/worker/src/utils/basic-auth.test.ts
• apps/worker/src/utils/basic-auth.ts
• packages/common/package.json
• packages/common/server/share-access.ts
• packages/db/code-migrations/migrate.ts
• packages/db/src/services/cohort.service.ts
• packages/db/src/services/conversion.service.ts
• packages/db/src/services/sankey.service.ts
• packages/db/src/services/share.service.ts
• packages/email/src/index.tsx
• packages/email/src/unsubscribe.ts
• packages/js-runtime/src/execute.ts
• packages/js-runtime/src/validate.test.ts
• packages/js-runtime/src/validate.ts
• packages/trpc/src/routers/auth.ts
• packages/trpc/src/routers/event.ts
• packages/trpc/src/routers/reference.test.ts
• packages/trpc/src/routers/reference.ts
• packages/trpc/src/routers/share.test.ts
• packages/trpc/src/routers/share.ts
• self-hosting/coolify.yml

 ________________________________________________
< PENDU: Prompt Engineered Nifty Debugging Unit. >
 ------------------------------------------------
  \
   \   (\__/)
       (•ㅅ•)
       / 　 づ

✨ Finishing Touches

📝 Generate docstrings

• Commit to this branch
• Create a new PR

🧪 Generate unit tests (beta)

• Commit to this branch
• Create a new PR

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}