feat(security): add security vulnerability reports module and checkout lifecycle by claudfuen · Pull Request #2193 · trycompai/comp

claudfuen · 2026-02-27T01:55:18Z

Summary

This PR introduces a full Security → Vulnerability Reports flow in-app with a backend integration path to Maced pentest runs, plus a feature-flag rollout gate for Security exposure.

Why

Security reporting needed a concrete async workflow (create → checkout → queue visibility → progress tracking → report artifacts) with staged rollout capability. The scope now includes production-readiness guardrails for future Stripe and safer enablement controls.

What changed

1) Security product surface and workflow

apps/app/src/app/(app)/[orgId]/security/page.tsx
apps/app/src/app/(app)/[orgId]/security/vulnerability-reports/page.tsx
apps/app/src/app/(app)/[orgId]/security/vulnerability-reports/vulnerability-reports-page-client.tsx
- Submits report generation requests to app API route.
- Moved form into modal.
- Handles checkout return (?checkout=success|error&runId=...).
- Shows queued vs completed list state and actions per report.
apps/app/src/app/(app)/[orgId]/security/vulnerability-reports/checkout/page.tsx
- Mock one-time checkout page that returns to report list.
apps/app/src/app/(app)/[orgId]/security/vulnerability-reports/[reportId]/page.tsx
apps/app/src/app/(app)/[orgId]/security/vulnerability-reports/[reportId]/vulnerability-report-page-client.tsx
- Dedicated report details page with status/progress and artifact actions.

2) App API proxy layer

apps/app/src/app/api/security/vulnerability-reports/_api-proxy.ts
apps/app/src/app/api/security/vulnerability-reports/route.ts
apps/app/src/app/api/security/vulnerability-reports/[id]/route.ts
apps/app/src/app/api/security/vulnerability-reports/[id]/progress/route.ts
apps/app/src/app/api/security/vulnerability-reports/[id]/report/route.ts
apps/app/src/app/api/security/vulnerability-reports/[id]/pdf/route.ts
apps/app/src/app/api/security/vulnerability-reports/webhook/route.ts

3) Backend API module (Maced orchestration)

apps/api/src/security-vulnerability-reports/security-vulnerability-reports.module.ts
apps/api/src/security-vulnerability-reports/security-vulnerability-reports.controller.ts
apps/api/src/security-vulnerability-reports/security-vulnerability-reports.service.ts
apps/api/src/security-vulnerability-reports/dto/create-vulnerability-report.dto.ts
apps/api/src/app.module.ts

4) Type/model alignment

apps/app/src/lib/security/vulnerability-reports-client.ts
- Updated model typing for report/progress contract shape.

5) App-shell stabilization and rollout control

apps/app/src/app/(app)/[orgId]/components/AppShellWrapper.tsx
- Adds TooltipProvider + SSR-stable logo variant handling.
- Security rail/sidebar now renders from isSecurityEnabled.
apps/app/src/app/(app)/[orgId]/components/app-shell-search-groups.tsx
- Security command-search item now feature-flag conditional.
apps/app/src/app/(app)/[orgId]/layout.tsx
- Reads PostHog is-security-enabled flag and passes to shell.
apps/app/src/app/(app)/[orgId]/security/layout.tsx
- Route-level flag gate for /security/* so disabled users are blocked at entry.

Scope

Frontend: Add Security module navigation + dedicated job list/detail/checkouts.
API bridge: Add robust app-side routes to list/create/job status/progress and report/pdf output proxies.
Backend: Add v1/security-vulnerability-reports integration module for Maced pentests endpoints, including webhook relay and callback URL normalization.
Rollout safety: Security feature availability controlled via PostHog flag is-security-enabled.
Not in scope (yet): production Stripe checkout integration (current flow remains mocked one-time flow), internal reporting/analytics dashboards, and org-level entitlement UI.

Runtime cost / safety note

The MACED provider is token-expensive per generation (~$50/run). This PR intentionally avoids forcing any automatic/subscribed generation behavior and keeps job creation explicit. When validating end-to-end with real credentials, use a deliberate, single-run smoke test only.

Env / configuration notes

Backend key integration should be server-side only: MACED_API_KEY in API runtime environment.
For webhook callbacks, route contract uses SECURITY_VULNERABILITY_REPORTS_WEBHOOK_URL normalization behavior in service layer.

Validation

No automated tests were executed in this change set.

vercel · 2026-02-27T01:55:21Z

The latest updates on your projects. Learn more about Vercel for GitHub.

2 Skipped Deployments

Project	Deployment	Actions	Updated (UTC)
app	Skipped		Feb 28, 2026 3:25am
portal	Skipped		Feb 28, 2026 3:25am

chatgpt-codex-connector

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: eb7a64de99

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

apps/app/src/app/api/security/vulnerability-reports/route.ts

apps/app/src/app/api/security/vulnerability-reports/[id]/report/route.ts

chatgpt-codex-connector

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: d2df06e6b9

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

apps/app/src/app/api/security/vulnerability-reports/webhook/route.ts

apps/app/src/app/api/security/vulnerability-reports/route.ts

chatgpt-codex-connector

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 5e4c528f51

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

apps/app/src/app/api/security/vulnerability-reports/_api-proxy.ts

apps/api/src/security-vulnerability-reports/security-vulnerability-reports.service.ts

… Maced webhook reconciliation

apps/api/src/security-vulnerability-reports/security-vulnerability-reports.service.ts

chatgpt-codex-connector

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 6a1e273ab0

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

apps/app/src/app/api/security/vulnerability-reports/_api-proxy.ts

apps/api/src/security-vulnerability-reports/security-vulnerability-reports.service.ts

…eports-module

chatgpt-codex-connector

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 03d1d6d084

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

apps/app/src/app/api/security/vulnerability-reports/_api-proxy.ts

.../app/src/app/(app)/[orgId]/security/vulnerability-reports/hooks/use-vulnerability-reports.ts

apps/app/src/app/api/security/vulnerability-reports/webhook/route.ts

chatgpt-codex-connector

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: fd7d1df56e

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

apps/api/src/security-vulnerability-reports/security-vulnerability-reports.service.ts

chatgpt-codex-connector

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: a1e89d75a9

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

apps/api/src/security-vulnerability-reports/security-vulnerability-reports.service.ts

.../app/src/app/(app)/[orgId]/security/vulnerability-reports/hooks/use-vulnerability-reports.ts

chatgpt-codex-connector

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 7f2a0346fa

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

apps/api/src/security-vulnerability-reports/security-vulnerability-reports.service.ts

chatgpt-codex-connector

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: a6286c240d

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

chatgpt-codex-connector · 2026-02-28T03:30:59Z

apps/api/src/security-vulnerability-reports/security-vulnerability-reports.service.ts

+    } catch (error) {
+      this.logger.error(
+        `Unable to parse Maced get response for report ${id}`,
+        error instanceof Error ? error.message : String(error),
+      );


Preserve not-found errors when org ownership check fails

getReport wraps both JSON parsing and assertProviderOrganizationMatch(...) in the same try, then converts any thrown error into 502 Invalid response. When SECURITY_VULNERABILITY_REPORTS_ORG_ID_MAP is configured and a run belongs to a different provider org, assertProviderOrganizationMatch throws a 404, but this catch path masks it as a gateway failure; callers of getReport (including progress/report/pdf flows that call it first) will treat authorization misses as transient backend outages and may retry unnecessarily.

Useful? React with 👍 / 👎.

feat(app): add security vulnerability report module

eb7a64d

vercel bot temporarily deployed to Preview – portal February 27, 2026 01:55 Inactive

vercel bot had a problem deploying to Preview – app February 27, 2026 01:56 Failure

fix(app): stabilize shell tooltip and menu ids

fa690f4

vercel bot temporarily deployed to Preview – portal February 27, 2026 01:58 Inactive

chatgpt-codex-connector bot reviewed Feb 27, 2026

View reviewed changes

apps/app/src/app/api/security/vulnerability-reports/route.ts Outdated Show resolved Hide resolved

apps/app/src/app/api/security/vulnerability-reports/[id]/report/route.ts Outdated Show resolved Hide resolved

fix(app): wrap shell tooltips in provider for hydration

d2df06e

vercel bot temporarily deployed to Preview – portal February 27, 2026 01:59 Inactive

vercel bot had a problem deploying to Preview – app February 27, 2026 02:01 Failure

feat(security): add vulnerability reports checkout flow and report pages

3216d59

chatgpt-codex-connector bot reviewed Feb 27, 2026

View reviewed changes

apps/app/src/app/api/security/vulnerability-reports/webhook/route.ts Outdated Show resolved Hide resolved

apps/app/src/app/api/security/vulnerability-reports/route.ts Outdated Show resolved Hide resolved

feat(security): add vulnerability reports module and checkout flow

2f0546f

vercel bot temporarily deployed to Preview – portal February 27, 2026 02:34 Inactive

claudfuen changed the title ~~Add security vulnerability reports feature with API-backed queue~~ feat(security): add security vulnerability reports module and checkout lifecycle Feb 27, 2026

vercel bot had a problem deploying to Preview – app February 27, 2026 02:35 Failure

feat(security): gate security tab and routes behind feature flag

5e4c528

vercel bot temporarily deployed to Preview – portal February 27, 2026 02:35 Inactive

vercel bot had a problem deploying to Preview – app February 27, 2026 02:36 Failure

chatgpt-codex-connector bot reviewed Feb 27, 2026

View reviewed changes

apps/app/src/app/api/security/vulnerability-reports/_api-proxy.ts Outdated Show resolved Hide resolved

apps/api/src/security-vulnerability-reports/security-vulnerability-reports.service.ts Outdated Show resolved Hide resolved

feat(security): add vulnerability reports flow with mock checkout and…

6a1e273

… Maced webhook reconciliation

vercel bot had a problem deploying to Preview – app February 28, 2026 01:21 Failure

github-advanced-security bot found potential problems Feb 28, 2026

View reviewed changes

apps/api/src/security-vulnerability-reports/security-vulnerability-reports.service.ts Fixed Show fixed Hide fixed

vercel bot deployed to Preview – portal February 28, 2026 01:23 View deployment

chatgpt-codex-connector bot reviewed Feb 28, 2026

View reviewed changes

apps/app/src/app/api/security/vulnerability-reports/_api-proxy.ts Outdated Show resolved Hide resolved

apps/api/src/security-vulnerability-reports/security-vulnerability-reports.service.ts Show resolved Hide resolved

fix(security): address review feedback for vulnerability reports

c26dfbf

vercel bot temporarily deployed to Preview – portal February 28, 2026 02:01 Inactive

vercel bot had a problem deploying to Preview – app February 28, 2026 02:02 Failure

claudfuen added 2 commits February 27, 2026 21:03

Merge remote-tracking branch 'origin/main' into codex/security-vuln-r…

e406e2d

…eports-module

fix(app): correct vulnerability report api proxy imports

fbaf81a

vercel bot temporarily deployed to Preview – portal February 28, 2026 02:07 Inactive

vercel bot had a problem deploying to Preview – app February 28, 2026 02:08 Failure

chatgpt-codex-connector bot reviewed Feb 28, 2026

View reviewed changes

fix(app): resolve remaining vulnerability reports build type errors

e81bad9

vercel bot temporarily deployed to Preview – portal February 28, 2026 02:17 Inactive

fix(app): address latest vulnerability reports review feedback

b0504f8

vercel bot temporarily deployed to Preview – portal February 28, 2026 02:19 Inactive

vercel bot deployed to Preview – app February 28, 2026 02:21 View deployment

fix(app): sync active organization before vulnerability report token

fd7d1df

vercel bot temporarily deployed to Preview – portal February 28, 2026 02:25 Inactive

vercel bot deployed to Preview – app February 28, 2026 02:27 View deployment

chatgpt-codex-connector bot reviewed Feb 28, 2026

View reviewed changes

apps/api/src/security-vulnerability-reports/security-vulnerability-reports.service.ts Outdated Show resolved Hide resolved

apps/api/src/security-vulnerability-reports/security-vulnerability-reports.service.ts Outdated Show resolved Hide resolved

refactor(app): remove vuln-report proxy routes and call Nest directly

a1e89d7

vercel bot temporarily deployed to Preview – portal February 28, 2026 02:45 Inactive

vercel bot deployed to Preview – app February 28, 2026 02:48 View deployment

chatgpt-codex-connector bot reviewed Feb 28, 2026

View reviewed changes

apps/api/src/security-vulnerability-reports/security-vulnerability-reports.service.ts Show resolved Hide resolved

.../app/src/app/(app)/[orgId]/security/vulnerability-reports/hooks/use-vulnerability-reports.ts Outdated Show resolved Hide resolved

fix(api): stop forwarding comp org header to Maced

7f2a034

vercel bot temporarily deployed to Preview – portal February 28, 2026 02:54 Inactive

vercel bot temporarily deployed to Preview – app February 28, 2026 02:54 Inactive

chatgpt-codex-connector bot reviewed Feb 28, 2026

View reviewed changes

apps/api/src/security-vulnerability-reports/security-vulnerability-reports.service.ts Show resolved Hide resolved

apps/api/src/security-vulnerability-reports/security-vulnerability-reports.service.ts Outdated Show resolved Hide resolved

fix(security): harden webhook handling and preserve checkout metadata

4e21328

vercel bot temporarily deployed to Preview – portal February 28, 2026 03:03 Inactive

vercel bot deployed to Preview – app February 28, 2026 03:05 View deployment

feat(api): persist per-job webhook handshake for vuln reports

7130a1a

vercel bot temporarily deployed to Preview – portal February 28, 2026 03:25 Inactive

vercel bot temporarily deployed to Preview – app February 28, 2026 03:25 Inactive

feat(api): consume Maced-issued webhook tokens for vuln reports

a6286c2

vercel bot temporarily deployed to Preview – app February 28, 2026 03:25 Inactive

vercel bot temporarily deployed to Preview – portal February 28, 2026 03:25 Inactive

chatgpt-codex-connector bot reviewed Feb 28, 2026

View reviewed changes

Conversation

claudfuen commented Feb 27, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Why

What changed

1) Security product surface and workflow

2) App API proxy layer

3) Backend API module (Maced orchestration)

4) Type/model alignment

5) App-shell stabilization and rollout control

Scope

Runtime cost / safety note

Env / configuration notes

Validation

Uh oh!

vercel bot commented Feb 27, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

chatgpt-codex-connector bot left a comment

Choose a reason for hiding this comment

💡 Codex Review

Uh oh!

Uh oh!

Uh oh!

chatgpt-codex-connector bot left a comment

Choose a reason for hiding this comment

💡 Codex Review

Uh oh!

Uh oh!

Uh oh!

chatgpt-codex-connector bot left a comment

Choose a reason for hiding this comment

💡 Codex Review

Uh oh!

Uh oh!

Uh oh!

Uh oh!

chatgpt-codex-connector bot left a comment

Choose a reason for hiding this comment

💡 Codex Review

Uh oh!

Uh oh!

Uh oh!

chatgpt-codex-connector bot left a comment

Choose a reason for hiding this comment

💡 Codex Review

Uh oh!

Uh oh!

Uh oh!

Uh oh!

chatgpt-codex-connector bot left a comment

Choose a reason for hiding this comment

💡 Codex Review

Uh oh!

Uh oh!

Uh oh!

chatgpt-codex-connector bot left a comment

Choose a reason for hiding this comment

💡 Codex Review

Uh oh!

Uh oh!

Uh oh!

chatgpt-codex-connector bot left a comment

Choose a reason for hiding this comment

💡 Codex Review

Uh oh!

Uh oh!

Uh oh!

chatgpt-codex-connector bot left a comment

Choose a reason for hiding this comment

💡 Codex Review

Uh oh!

chatgpt-codex-connector bot Feb 28, 2026

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

claudfuen commented Feb 27, 2026 •

edited

Loading

vercel bot commented Feb 27, 2026 •

edited

Loading