docs: auto-update documentation via Kiro

[Ashishkasaudhan]

Generated by Kiro doc-generator agent.
Triggered by push to main.

📋 AI-Generated Summary

1. Repository overview

This repo is a CI/CD automation demo for Kiro Headless Mode. It contains a deliberately flawed demo application — an Express.js REST API, Terraform AWS infrastructure, and Docker configuration — alongside four GitHub Actions workflows that run purpose-built Kiro agents (code review, PR summary, doc generation, dependency audit) against the codebase.

2. What changed in this PR

This PR adds comprehensive project documentation generated automatically by the Kiro doc-generator agent. Five files were changed with 675 lines of pure additions — no existing code was modified. The README was extended with a documentation section, API quick reference, and module export tables, while four new docs were created from scratch.

3. Key changes

• docs/API.md (290 lines) — Full REST API reference covering all 11 endpoints across auth, users, and products routes, including request/response schemas, parameters, and middleware usage
• docs/ARCHITECTURE.md (157 lines) — Repository structure, component interaction diagrams, Node.js app architecture, dependency table, Kiro agent overview, and infrastructure/Docker summaries
• docs/DEPLOYMENT.md (99 lines) — Setup instructions for local dev, Docker Compose, standalone Docker builds, and Terraform AWS deployment with variable reference and environment variable table
• docs/KNOWN_ISSUES.md (93 lines) — Categorized catalog of all intentional vulnerabilities and anti-patterns across Node.js (SQL injection, auth, validation, performance), Docker (secrets, root, no healthchecks), and Terraform (hardcoded creds, IAM wildcards, public RDS)
• README.md (36 lines added) — New "Documentation" section linking to the four docs, an API quick reference table, and an exported modules table

4. Codebase health

This codebase is intentionally insecure for demo purposes, but reviewers should be aware of the scope:

• Critical security issues everywhere — SQL injection in every database query (string concatenation, never parameterized), hardcoded secrets in at least 6 locations (.env, db.js, auth.js, Dockerfile, docker-compose.yml, main.tf), and an IAM : wildcard policy
• Auth is effectively absent — the auth middleware exists but is never wired into any route, all endpoints are unauthenticated, new users default to admin, and JWTs never expire
• Infrastructure is wide open — RDS is publicly accessible with no encryption or backups, SSH is open to 0.0.0.0/0, S3 public access is not blocked, and IMDSv1 is enabled
• Docker runs as root with secrets baked into image layers, privileged mode enabled, and debug/SSH ports exposed
• Dependency hygiene — unpinned versions (helmet: "*", bcrypt: ">=5.0.0"), unused packages (helmet, moment), and lodash imported for a trivial map operation

5. Testing notes

Since this PR is documentation-only (no code changes), reviewers should verify:

• Accuracy — Spot-check that the API docs match the actual route handlers (parameter names, response shapes, status codes). For example, confirm POST /api/auth/register returns 201 with { token, email } as documented
• Completeness — Verify the KNOWN_ISSUES.md covers the major findings visible in the source (the ISSUE: comments in the code are a good checklist)
• Links — Confirm the four doc links in README.md resolve correctly (docs/API.md, docs/ARCHITECTURE.md, docs/DEPLOYMENT.md, docs/KNOWN_ISSUES.md)
• Diagrams — Check that the ASCII architecture diagrams in ARCHITECTURE.md render correctly in GitHub's markdown preview
• No secrets leaked — The docs reference placeholder credentials; confirm no additional real secrets were introduced in the documentation text

▸ Credits: 0.48 • Time: 41s

Generated by Kiro CLI • Updated at 2026-04-17T07:26:25.068Z

[github-actions]

🤖 Kiro Code Review

Full repository review using Kiro Headless Mode

Full Repository Security & Code Quality Review

Summary Table

Category	Count
🔴 Critical (Security & Data Safety)	22
🟠 Bugs & Correctness	10
🟡 Performance & Scalability	7
🔵 Code Quality & Maintainability	10
⚪ Suggestions	8
Total	57

🔴 Critical (Security & Data Safety)

C1 — Hardcoded Secrets Committed to Repository

Files: nodejs-app/.env:1-8, nodejs-app/src/db.js:5-7, nodejs-app/src/middleware/auth.js:4, nodejs-app/src/routes/auth.js:9
Severity: 🔴 Critical

The .env file contains production database credentials, a JWT signing secret, AWS IAM keys, and a live Stripe secret key — and it is not in .gitignore. The same credentials are also hardcoded directly in db.js, auth.js, and the auth middleware.

Fix: Add .env to .gitignore, rotate ALL exposed credentials immediately, and load secrets from environment variables or a secrets manager.

gitignore

.gitignore — add these lines

.env
.env.*

js
// db.js — use environment variables
const connection = mysql.createPool({
host: process.env.DB_HOST,
user: process.env.DB_USER,
password: process.env.DB_PASSWORD,
database: process.env.DB_NAME,
port: 3306,
});

C2 — SQL Injection in Every Route

Files: nodejs-app/src/routes/auth.js:23,32,47, nodejs-app/src/routes/users.js:19,35,46,55, nodejs-app/src/routes/products.js:29-38,49
Severity: 🔴 Critical

Every SQL query uses string interpolation with unsanitized user input. An attacker can extract the entire database, modify data, or escalate privileges.

js
// VULNERABLE — auth.js:23
const existing = await query(SELECT * FROM users WHERE email = '${email}');

// VULNERABLE — users.js:19
const users = await query(SELECT * FROM users WHERE id = ${req.params.id});

// VULNERABLE — products.js:29
let sql = SELECT * FROM products WHERE name LIKE '%${q}%';

Fix: Use parameterized queries. The mysql driver supports ? placeholders:

js
// db.js — fix the query function to pass params
function query(sql, params) {
return new Promise((resolve, reject) => {
connection.query(sql, params, (err, results) => {
if (err) reject(err);
else resolve(results);
});
});
}

// auth.js — parameterized
const existing = await query('SELECT * FROM users WHERE email = ?', [email]);

// users.js — parameterized
const users = await query('SELECT * FROM users WHERE id = ?', [req.params.id]);

// products.js — parameterized search
let sql = 'SELECT * FROM products WHERE name LIKE ?';
const params = [%${q}%];
if (category) { sql += ' AND category = ?'; params.push(category); }

C3 — No Authentication on User and Product Routes

Files: nodejs-app/src/routes/users.js:7, nodejs-app/src/routes/products.js:7, nodejs-app/src/server.js:19-21
Severity: 🔴 Critical

The authenticate middleware exists in middleware/auth.js but is never imported or applied to any route. All user CRUD and product endpoints are completely unauthenticated. Anyone can list all users (including password hashes), delete users, or create products.

Fix:
js
// server.js
const { authenticate } = require('./middleware/auth');

app.use('/api/auth', authRoutes);
app.use('/api/users', authenticate, userRoutes);
app.use('/api/products', authenticate, productRoutes);

C4 — Password Hashes Exposed via API

Files: nodejs-app/src/routes/users.js:10
Severity: 🔴 Critical

SELECT * FROM users returns all columns including password. Combined with C3 (no auth), anyone can harvest password hashes.

Fix:
js
const users = await query('SELECT id, name, email, role FROM users');

C5 — New Users Default to Admin Role

File: nodejs-app/src/routes/auth.js:33
Severity: 🔴 Critical

The registration endpoint assigns 'admin' role to every new user, granting full privileges.

Fix:
js
await query(
'INSERT INTO users (email, password, name, role) VALUES (?, ?, ?, ?)',
[email, hashedPassword, name, 'user']
);

C6 — Mass Assignment / Privilege Escalation

File: nodejs-app/src/routes/users.js:33-37
Severity: 🔴 Critical

The PUT endpoint accepts role from the request body and writes it directly to the database. Any user can promote themselves to admin.

Fix: Remove role from the allowed update fields, or restrict it to admin-only:
js
const { name, email } = req.body; // do NOT accept role
await query('UPDATE users SET name = ?, email = ? WHERE id = ?', [name, email, req.params.id]);

C7 — Unrestricted File Upload with Path Traversal

File: nodejs-app/src/routes/users.js:50-58
Severity: 🔴 Critical

The avatar upload has no file type validation, no file size limit, and uses req.file.originalname directly in the path — enabling path traversal (e.g., ../../etc/passwd).

Fix:
js
const path = require('path');
const upload = multer({
dest: '/tmp/uploads',
limits: { fileSize: 2 * 1024 * 1024 }, // 2MB
fileFilter: (req, file, cb) => {
const allowed = ['.jpg', '.jpeg', '.png', '.gif'];
const ext = path.extname(file.originalname).toLowerCase();
cb(null, allowed.includes(ext));
},
});

router.post('/:id/avatar', upload.single('avatar'), async (req, res) => {
// Use the multer-generated filename, not originalname
const filePath = /uploads/${req.file.filename};
await query('UPDATE users SET avatar = ? WHERE id = ?', [filePath, req.params.id]);
res.json({ avatar: filePath });
});

C8 — JWT Tokens Never Expire

File: nodejs-app/src/routes/auth.js:12-13
Severity: 🔴 Critical

jwt.sign() is called without an expiresIn option. Stolen tokens are valid forever.

Fix:
js
const signToken = (user) => {
return jwt.sign(
{ id: user.id, email: user.email, role: user.role },
process.env.JWT_SECRET,
{ expiresIn: '1h' }
);
};

C9 — Cookie Set Without Security Flags

File: nodejs-app/src/routes/auth.js:38
Severity: 🔴 Critical

res.cookie("token", token) sets the cookie without httpOnly, secure, or sameSite flags, making it accessible to XSS attacks and vulnerable to CSRF.

Fix:
js
res.cookie('token', token, {
httpOnly: true,
secure: process.env.NODE_ENV === 'production',
sameSite: 'strict',
maxAge: 3600000,
});

C10 — Stack Traces Leaked to Clients

File: nodejs-app/src/server.js:25-30
Severity: 🔴 Critical

The error handler sends err.message and err.stack to the client, revealing internal paths, library versions, and database structure.

Fix:
js
app.use((err, req, res, next) => {
console.error(err.stack);
res.status(500).json({
error: process.env.NODE_ENV === 'production'
? 'Internal server error'
: err.message,
C11 — Terraform Hardcoded AWS Credentials
File: terraform/main.tf:14-15
Severity: 🔴 Critical

AWS access key and secret key are hardcoded in the provider block.

Fix: Remove credentials from the provider and use environment variables, AWS profiles, or IAM roles:
hcl
provider "aws" {
region = var.region
}

C12 — Terraform IAM Policy Grants *:*

File: terraform/main.tf:143-152
Severity: 🔴 Critical

The IAM role policy grants Action = "*" on Resource = "*" — full administrator access to the entire AWS account.

Fix: Apply least-privilege. Grant only the specific actions needed:
hcl
policy = jsonencode({
Version = "2012-10-17"
Statement = [
{
Effect = "Allow"
Action = ["s3:GetObject", "s3:PutObject"]
Resource = "${aws_s3_bucket.uploads.arn}/*"
}
]
})

C13 — RDS Publicly Accessible with No Encryption

File: terraform/main.tf:72,78
Severity: 🔴 Critical

The database is publicly_accessible = true with storage_encrypted = false and backup_retention_period = 0.

Fix:
hcl
publicly_accessible = false
storage_encrypted = true
backup_retention_period = 7
multi_az = true
deletion_protection = true

C14 — S3 Bucket Public Access Not Blocked

File: terraform/main.tf:126-131
Severity: 🔴 Critical

All four public access block settings are false, leaving the uploads bucket open to public access.

Fix:
hcl
block_public_acls = true
block_public_policy = true
ignore_public_acls = true
restrict_public_buckets = true

C15 — EC2 IMDSv1 Enabled (SSRF Risk)

File: terraform/main.tf:113-114
Severity: 🔴 Critical

http_tokens = "optional" allows IMDSv1, which is exploitable via SSRF to steal IAM credentials.

Fix:
hcl
metadata_options {
http_endpoint = "enabled"
http_tokens = "required"
}

C16 — Secrets in EC2 User Data

File: terraform/main.tf:100-104
Severity: 🔴 Critical

Plaintext secrets in user_data are visible in the EC2 console, instance metadata, and CloudTrail logs.

Fix: Use AWS Secrets Manager or SSM Parameter Store and fetch at runtime:
bash
#!/bin/bash
export DB_PASSWORD=$(aws secretsmanager get-secret-value --secret-id kiro/db-password --query SecretString --output text)

C17 — Secrets Baked into Docker Image Layers

File: docker/Dockerfile:5-8,11-14
Severity: 🔴 Critical

ARG and ENV instructions embed secrets into image layers. Anyone with docker history or image access can extract them.

Fix: Remove all ARG/ENV secret lines. Pass secrets at runtime via docker run -e or Docker secrets:
dockerfile

Remove all ARG/ENV lines for secrets

Pass at runtime: docker run -e DB_PASSWORD=... -e JWT_SECRET=...

ENV NODE_ENV=production

C18 — Docker Compose Privileged Mode

File: docker/docker-compose.yml:16
Severity: 🔴 Critical

privileged: true gives the container full host kernel access — a container escape is trivial.

Fix: Remove privileged: true and add resource limits:
yaml
services:
api:

Remove: privileged: true

security_opt:
- no-new-privileges:true
deploy:
resources:
limits:
memory: 512M
cpus: '0.5'

C19 — SSH and Debug Ports Exposed

Files: docker/Dockerfile:27-28, docker/docker-compose.yml:8-9
Severity: 🔴 Critical

Port 22 (SSH) and 9229 (Node.js inspector/debugger) are exposed. The debug port allows remote code execution.

Fix: Remove both from Dockerfile and docker-compose:
dockerfile
EXPOSE 3000

Remove EXPOSE 22 and EXPOSE 9229

C20 — Security Group Allows SSH from 0.0.0.0/0

File: terraform/main.tf:33-38
Severity: 🔴 Critical

SSH is open to the entire internet.

Fix:
hcl
ingress {
from_port = 22
to_port = 22
protocol = "tcp"
cidr_blocks = var.allowed_ssh_cidrs # Restrict to VPN/office IPs
}

C21 — Terraform db_password Variable Not Marked Sensitive

File: terraform/variables.tf:16-20
Severity: 🔴 Critical

The db_password variable has no sensitive = true flag and has a default value, so it appears in plan output and state files.

Fix:
hcl
variable "db_password" {
description = "Database password"
type = string
sensitive = true

Remove the default — require it to be provided

}

C22 — Terraform Output Exposes Password in Plaintext

File: terraform/main.tf:160-162
Severity: 🔴 Critical

output "db_password" prints the database password in every terraform apply and stores it in state.

Fix: Delete this output entirely. If needed, mark it sensitive:
hcl
output "db_password" {
value = aws_db_instance.main.password
sensitive = true
}

---

🟠 Bugs & Correctness

B1 — query() Function Ignores Parameters

File: nodejs-app/src/db.js:24-29
Severity: 🟠 High

The query function accepts params but never passes them to connection.query(), making parameterized queries impossible even if callers tried to use them.

Fix:
js
function query(sql, params) {
return new Promise((resolve, reject) => {
connection.query(sql, params, (err, results) => {
if (err) reject(err);
else resolve(results);
});
});
}

B2 — Auth Middleware Doesn't Strip "Bearer " Prefix

File: nodejs-app/src/middleware/auth.js:10
Severity: 🟠 High

Standard Authorization: Bearer <token> headers will fail verification because the "Bearer " prefix is included in the string passed to jwt.verify().

Fix:
js
const authHeader = req.headers.authorization;
if (!authHeader || !authHeader.startsWith('Bearer ')) {
return res.status(401).json({ error: 'No token provided' });
}
const token = authHeader.split(' ')[1];

B3 — requireRole Doesn't Verify Token First

File: nodejs-app/src/middleware/auth.js:23-30
Severity: 🟠 High

requireRole checks req.user.role but doesn't ensure authenticate ran first. If used standalone, req.user is undefined and the check is bypassed (falls to 403 instead of 401, but the logic is fragile).

Fix: Always chain: router.get('/admin', authenticate, requireRole('admin'), handler)

B4 — User Enumeration via Login Error Messages

File: nodejs-app/src/routes/auth.js:51,57
Severity: 🟠 Medium

Different error messages for "No account found with this email" vs "Incorrect password" allow attackers to enumerate valid emails.

Fix: Use a single generic message:
js
return res.status(401).json({ error: 'Invalid email or password' });

B5 — GET /users/:id Returns undefined for Missing Users

File: nodejs-app/src/routes/users.js:22
Severity: 🟠 Medium

When no user matches, users[0] is undefined and the response is 200 OK with no body.

Fix:
js
if (!users || users.length === 0) {
return res.status(404).json({ error: 'User not found' });
}
res.json(users[0]);

B6 — bcrypt Salt Rounds Too Low

File: nodejs-app/src/routes/auth.js:29
Severity: 🟠 Medium

bcrypt.hash(password, 4) uses only 4 salt rounds. Modern recommendations are 12+.

Fix:
js
const hashedPassword = await bcrypt.hash(password, 12);

B7 — DB Reconnect Has No Backoff

File: nodejs-app/src/db.js:15-16
Severity: 🟠 Medium

On connection failure, setTimeout(connectDB, 1000) retries every second with no exponential backoff, hammering the database.

Fix:
js
let retryDelay = 1000;
function connectDB() {
connection.connect((err) => {
if (err) {
console.error('DB connection failed, retrying in', retryDelay, 'ms');
setTimeout(connectDB, retryDelay);
retryDelay = Math.min(retryDelay 2, 30000);
return;
}
retryDelay = 1000;
console.log('Connected to MySQL');
});
}

B8 — No Graceful Shutdown

File: nodejs-app/src/server.js:33-36
Severity: 🟠 Medium

No SIGTERM/SIGINT handlers. In-flight requests are dropped on deployment, and the DB connection is never closed.

Fix:
js
const server = app.listen(PORT, () => { / ... / });

process.on('SIGTERM', () => {
server.close(() => {
connection.end();
process.exit(0);
});
});

B9 — NaN in Average Rating Calculation

File: nodejs-app/src/routes/products.js:68
Severity: 🟠 Medium

When reviews.length === 0, dividing by zero produces NaN.

Fix:
js
avgRating: reviews.length > 0
? reviews.reduce((sum, r) => sum + r.rating, 0) / reviews.length
: 0,

B10 — CORS Allows All Origins in Production

File: nodejs-app/src/server.js:12
Severity: 🟠 Medium

app.use(cors()) with no options allows any origin to make authenticated requests.

Fix:
js
app.use(cors({
origin: process.env.ALLOWEDORIGINS?.split(',') || 'http://localhost:3000',
credentials: true,
}));

---

🟡 Performance & Scalability

P1 — N+1 Query in /products/stats

File: nodejs-app/src/routes/products.js:60-70
Severity: 🟡 High

Fetches all products, then runs a separate query for each product's reviews. With 1000 products, this is 1001 queries.

Fix: Use a single JOIN with GROUP BY:
js
const stats = await query(
SELECT p.id, p.name, COUNT(r.id) AS reviewCount, COALESCE(AVG(r.rating), 0) AS avgRating
FROM products p
LEFT JOIN reviews r ON r.product_id = p.id
GROUP BY p.id
ORDER BY avgRating DESC
);
res.json(stats);

P2 — O(n²) Bubble Sort in JavaScript

File: nodejs-app/src/routes/products.js:73-80
Severity: 🟡 Medium

Manual bubble sort instead of Array.sort() (O(n log n)) or SQL ORDER BY.

Fix: Handled by P1's SQL ORDER BY, or use stats.sort((a, b) => b.avgRating - a.avgRating).

P3 — No Pagination on List Endpoints

Files: nodejs-app/src/routes/users.js:10, nodejs-app/src/routes/products.js:8
Severity: 🟡 Medium

SELECT * FROM users and SELECT * FROM products return unbounded result sets.

Fix:
js
router.get('/', async (req, res) => {
const page = parseInt(req.query.page) || 1;
const limit = Math.min(parseInt(req.query.limit) || 20, 100);
const offset = (page - 1) limit;
const users = await query('SELECT id, name, email, role FROM users LIMIT ? OFFSET ?', [limit, offset]);
res.json({ data: users, page, limit });
});

P4 — Single Database Connection (No Pooling)

File: nodejs-app/src/db.js:4
Severity: 🟡 Medium

mysql.createConnection() creates a single connection shared across all concurrent requests. Under load, queries will serialize.

Fix:
js
const pool = mysql.createPool({
host: process.env.DBHOST,
user: process.env.DB_USER,
password: process.env.DB_PASSWORD,
database: process.env.DB_NAME,
connectionLimit: 10,
});

P5 — No Caching on Expensive Stats Endpoint

File: nodejs-app/src/routes/products.js:56
Severity: 🟡 Low

/products/stats does heavy computation on every request with no caching. Redis is in docker-compose but unused.

P6 — Floating Point Arithmetic for Currency

File: nodejs-app/src/routes/products.js:15
Severity: 🟡 Low

p.price * 0.9 uses floating point, which causes rounding errors for currency (e.g., 19.99 * 0.9 = 17.991).

Fix: Use integer cents or a decimal library, and round: Math.round(p.price * 90) / 100.

P7 — RDS Auto-Scaling Disabled

File: terraform/main.tf:69
Severity: 🟡 Low

max_allocated_storage = 0 disables storage auto-scaling. The 20GB disk will fill up.

Fix: max_allocated_storage = 100

---

🔵 Code Quality & Maintainability

Q1 — Helmet Installed but Never Used

File: nodejs-app/package.json:12, nodejs-app/src/server.js
Severity: 🔵 Medium

helmet is a dependency but is never imported or applied. It provides critical HTTP security headers (CSP, HSTS, X-Frame-Options, etc.).

Fix:
js
const helmet = require('helmet');
app.use(helmet());

Q2 — No Input Validation on Any Endpoint

Files: nodejs-app/src/routes/auth.js:19, nodejs-app/src/routes/products.js:45
Severity: 🔵 Medium

No validation of email format, password strength, name length, price range, or any field on any endpoint.

Fix: Add a validation library like express-validator or joi:
js
const { body, validationResult } = require('express-validator');

router.post('/register', [
body('email').isEmail().normalizeEmail(),
body('password').isLength({ min: 8 }),
body('name').trim().isLength({ min: 1, max: 100 }),
], async (req, res) => {
const errors = validationResult(req);
if (!errors.isEmpty()) return res.status(400).json({ errors: errors.array() });
// ...
});

Q3 — JWT Secret Duplicated in Three Files

Files: nodejs-app/src/routes/auth.js:9, nodejs-app/src/middleware/auth.js:4, nodejs-app/.env:5
Severity: 🔵 Medium

The same secret is hardcoded in three places. If one is changed, the others break silently.

Fix: Single source of truth via process.env.JWT_SECRET.

Q4 — Unnecessary lodash Dependency

File: nodejs-app/src/routes/products.js:3,13
Severity: 🔵 Low

_.map() is used where native Array.map() works identically. lodash adds ~70KB to the bundle.

Fix: const formatted = products.map(p => ({ ... }));

Q5 — moment Dependency (Deprecated)

File: nodejs-app/package.json:15
Severity: 🔵 Low

moment is in maintenance mode. It's not even used in the codebase.

Fix: Remove it. If date handling is needed later, use date-fns or native Intl.

Q6 — Unpinned/Loose Dependency Versions

File: nodejs-app/package.json:12-15
Severity: 🔵 Medium

• helmet: "*" — accepts any version including breaking changes
• bcrypt: ">=5.0.0" — no upper bound
• lodash: "4.17.20" — pinned to a version with known prototype pollution CVEs (fixed in 4.17.21)

Fix: Pin exact versions or use ~ ranges:
json
"helmet": "~7.1.0",
"bcrypt": "~5.1.1",
"lodash": "4.17.21"

Q7 — Dockerfile Uses node:latest and No Multi-Stage Build

File: docker/Dockerfile:2
Severity: 🔵 Medium

node:latest is not reproducible and includes unnecessary OS packages. No .dockerignore means .git, node_modules, and .env are copied into the image.

Fix:
dockerfile
FROM node:20-alpine AS builder
WORKDIR /app
COPY package*.json ./
RUN npm ci --only=production

FROM node:20-alpine
RUN addgroup -S app && adduser -S app -G app
WORKDIR /app
COPY --from=builder /app/node_modules ./node_modules
COPY src/ ./src/
USER app
EXPOSE 3000
HEALTHCHECK CMD wget -qO- http://localhost:3000/health || exit 1
CMD ["node", "src/server.js"]

Q8 — No Terraform Backend or State Locking

File: terraform/main.tf:3
Severity: 🔵 Medium

No backend block means state is stored locally. Multiple engineers running terraform apply will corrupt state.

Fix:
hcl
terraform {
required_version = ">= 1.5.0"
backend "s3" {
bucket = "kiro-demo-tfstate"
key = "terraform.tfstate"
region = "us-east-1"
dynamodb_table = "terraform-locks"
encrypt = true
}
}

Q9 — Terraform Variables Defined but Not Used

File: terraform/variables.tf (all variables), terraform/main.tf (hardcoded values)
Severity: 🔵 Low

var.region, var.db_password, var.instance_type, and var.allowed_ssh_cidrs are defined but never referenced in main.tf — values are hardcoded instead.

Q10 — MySQL 5.7 End-of-Life

Files: terraform/main.tf:65, docker/docker-compose.yml:24
Severity: 🔵 Medium

MySQL 5.7 reached EOL in October 2023. No security patches are being released.

Fix: Upgrade to MySQL 8.0: engine_version = "8.0" and image: mysql:8.0.

---

⚪ Suggestions

S1 — No Rate Limiting

File: nodejs-app/src/server.js

Add express-rate-limit especially on /api/auth/login to prevent brute-force attacks.

S2 — No Health Check Endpoint

File: nodejs-app/src/server.js

Add GET /health for load balancer and container orchestration health checks.

S3 — No Test Files Exist

The jest test runner is configured but there are zero test files in the repository.

S4 — Redis in Compose but Unused

File: docker/docker-compose.yml:30-35

Redis is deployed with no password and no application code references it.

S5 — Database Port Exposed to Host

File: docker/docker-compose.yml:26

MySQL port 3306 is mapped to the host. In production, only the app container should access it via the Docker network.

S6 — No .dockerignore File

The COPY . . in the Dockerfile copies everything including .git, node_modules, .env, and test files.

S7 — EC2 Instance Has No IAM Instance Profile

File: terraform/main.tf:93

The IAM role api_role is created but never attached to the EC2 instance via an instance profile.

S8 — No required_version for Terraform

File: terraform/main.tf:3

Add required_version = ">= 1.5.0" to prevent running with incompatible Terraform versions.

---

Priority Remediation Order

1. Immediately rotate all secrets — AWS keys, DB password, JWT secret, Stripe key. They are committed to git history.
2. Fix all SQL injection (C2 + B1) — this is the most exploitable vulnerability.
3. Add authentication to routes (C3) and remove password from SELECT (C4).
4. Fix Terraform credentials (C11), IAM policy (C12), and RDS public access (C13).
5. Fix Docker secrets (C17), privileged mode (C18), and exposed ports (C19).
6. Add input validation (Q2), helmet (Q1), and rate limiting (S1).
7. Address performance issues (P1-P4) and upgrade MySQL (Q10).

▸ Credits: 1.13 • Time: 2m 14s

---

Powered by Kiro CLI • Run #5