256 security improvements

[InfinityBowman]

Summary by CodeRabbit

• Bug Fixes

  • Strengthened account merge validation with explicit token verification
  • Enhanced PDF file type validation with signature verification during imports
  • Improved CSRF cookie security configuration

• Documentation

  • Updated security audit documentation with remediation details

_{✏️ Tip: You can customize this high-level summary in your review settings.}

[coderabbitai]

Caution

Review failed

The pull request is closed.

📝 Walkthrough

Walkthrough

A security audit document is updated with remediation details for account merge token validation, PDF path traversal prevention, and CSRF cookie security configuration. The Google Drive import route is enhanced to validate PDF file signatures before processing, rejecting non-PDF content based on magic bytes rather than MIME type alone.

Changes

Cohort / File(s)	Summary
Security Audit Documentation packages/docs/audits/security-audit-2026-01.md	Updated remediation log entries and formatting to document account merge token validation, PDF path traversal rejection (path separators and control characters), and CSRF cookie security configuration (httpOnly, secure, sameSite, path settings).
PDF Signature Validation packages/workers/src/routes/google-drive.js	Added PDF magic bytes validation immediately after downloading Google Drive file content in /import flow. Rejects files with invalid PDF signatures before processing, returning FILE_ERRORS.INVALID_TYPE error. Imports isPdfSignature and PDF_MAGIC_BYTES from shared utilities.

Estimated code review effort

🎯 2 (Simple) | ⏱️ ~10 minutes

Possibly related PRs

• use mediafile table for file uploads #232: Modifies the same packages/workers/src/routes/google-drive.js file with related functionality including project lookup, unique filename generation, and mediaFiles database inserts for the import flow.

✨ Finishing touches

• 📝 Generate docstrings

---

📜 Recent review details

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

📥 Commits

Reviewing files that changed from the base of the PR and between aaa362a and e2edc22.

📒 Files selected for processing (2)

• packages/docs/audits/security-audit-2026-01.md
• packages/workers/src/routes/google-drive.js

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}