fix(security): remove hardcoded PAT, fix API key in URL, upgrade KDF, fix bearer casing

[Aamod-Dev]

Summary

This PR fixes several security vulnerabilities discovered during a comprehensive codebase audit related to issue #5857.

Changes

🔴 Critical

1. Hardcoded GitHub PAT removed — .env.local contained a live GitHub Personal Access Token (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). Replaced with a placeholder.

2. Gemini API key moved from URL to header — Both services/github/burnout-analyzer.ts and app/api/architecture/route.ts were passing the API key as a URL query parameter (?key=${apiKey}). URLs get logged by proxies, CDNs, and server access logs. Moved to the x-goog-api-key header.

3. Weak KDF replaced — lib/crypto.ts used plain SHA-256 for encryption key derivation. SHA-256 is fast (billions of attempts/second on GPU) and designed for integrity, not key derivation. Replaced with PBKDF2 (600,000 iterations, SHA-512).

🟠 High

4. Non-compliant bearer token casing — All Authorization headers used lowercase bearer instead of RFC 6750-compliant Bearer. Fixed across 5 files:

   • lib/github.ts
   • services/github/pr-insights.ts
   • services/github/ci-analytics.ts
   • services/github/burnout-analyzer.ts

5. Token leak in clone error log — app/api/architecture/route.ts logged the full repoUrl (including embedded GitHub token) on clone failure. Now redacted.

6. Plaintext token in return value — lib/github-token-encryption.js parseAndEncryptTokens() returned both plaintext token and encryptedToken. Removed plaintext field (function is currently unused, but this prevents future leaks).

7. decryptToken input validation — lib/crypto.ts decryptToken() had no validation on payload format. Added length check to prevent unhandled auth tag failures.

Files Changed

File	Change
.env.local	Removed hardcoded PAT
app/api/architecture/route.ts	API key to header; redacted clone error log
lib/crypto.ts	PBKDF2 KDF; input validation on decrypt
lib/github-token-encryption.js	Removed plaintext from return
lib/github.ts	bearer → Bearer
services/github/burnout-analyzer.ts	API key to header; bearer → Bearer
services/github/pr-insights.ts	bearer → Bearer
services/github/ci-analytics.ts	bearer → Bearer

[vercel]

@Aamod-Dev is attempting to deploy a commit to the jhasourav07's projects Team on Vercel.

A member of the Team first needs to authorize it.

[github-actions]

👋 Hey @Aamod-Dev! Thanks for your contribution! 🎉

Unfortunately, this PR has been automatically closed because it is not linked to any open issue.

To resolve this, please do the following:

1. Link a valid open issue by editing your PR description to include a closing keyword (e.g., Fixes #<issue-number>).
2. Reopen this PR once the link is added.

💡 You can link multiple issues if needed (e.g. Fixes #12, Closes #34).
If you're working on something that doesn't have an issue yet, please open one first and then link it here.

We look forward to reviewing your PR once an issue is linked! 🚀