Public surface security sweep — 2026-04-25

Trigger: Operator-requested sweep. Kristerpher reported "lots of traffic" and asked for an inventory of what is publicly reachable and whether any of it should be auth-gated. Sweep start: 2026-04-25T11:40:00Z (UTC) Sweep end: 2026-04-25T12:15:00Z (UTC) Method: Unauthenticated HTTP probes (curl), source-code review, git history check, search-engine indexing check (site: queries), GitHub repo visibility check.

Executive summary

1 CRITICAL, 1 HIGH, 1 MEDIUM filed. Key finding: a file containing live Alpaca trading credentials (backend/.apisecretes) is sitting on the operator workstation — untracked, not gitignored, one git add . away from being committed to GitHub. Revoke those keys immediately. Separately, the Heroku direct-to-origin bypass on staging (tracked as #252) is actively exploitable — confirmed reachable with full unauthenticated API response. Production JS bundle serves a full source map anonymously. All CF Access-gated surfaces are correctly gated.

Immediate action required: Revoke backend/.apisecretes credentials via Alpaca dashboard. See #377.

Surface inventory

Surfaces probed

Paths probed on raxx.app (public SPA)

All sensitive paths (/.env, /.git/config, /.git/HEAD, /config.json, /docker-compose.yml, /admin, /swagger, /docs) return HTTP 200 with the React SPA index.html — this is the standard SPA catch-all behavior (Cloudflare Pages serves index.html for all unmatched paths). Confirmed: actual file content is the React app shell, not real env files or git objects. No real data leakage at these paths.

/robots.txt returns User-agent: * / Disallow: — the wildcard allow means all paths are crawlable. No sensitive paths are being inadvertently blocked or disclosed.

/manifest.json returns default CRA boilerplate (see MEDIUM finding below).

Endpoints confirmed reachable via Heroku direct URL (bypassing CF Access)

All tested on raxx-api-staging-1a19fb3873b9.herokuapp.com — all return HTTP 200 anonymously:

Middleware check: backend_v2/api/middleware/ contains no Cloudflare header check. Issue #252 (CF-Connecting-IP enforcement) is confirmed unimplemented.

Search engine indexing

site:raxx.app, site:console.raxx.app, site:vault.raxx.app, site:api.raxx.app, site:getraxx.com — all returned zero results. No indexed paths found in search engines.

GitHub repository visibility

MooseQuest/TradeMasterAPI — confirmed private. Repo has not been made public.

Heroku metrics/diagnostics endpoints

/_metrics, /metrics, /__health on staging direct URL — all return HTTP 404. No exposed Heroku metrics endpoints.

Findings

CRITICAL

CRIT-1 — Live Alpaca trading credentials in un-gitignored file on operator workstation (filed #377)

Surface: Operator workstation / repository root Tool: Manual — git status output showed ?? backend/.apisecretes

Finding. File backend/.apisecretes contains two sets of Alpaca credentials: one with key prefix AK and BASE_URL=https://api.alpaca.markets (live trading endpoint), and one with key prefix PK (paper trading). Neither set is in git history. The file is not covered by any .gitignore pattern (git check-ignore returns exit code 1; .gitignore covers .env, .env.*, and specific secret extensions but not .apisecretes).

Risk. A single git add . or git add backend/ commits live trading credentials to GitHub where they would be searchable and immediately usable to place live orders, access account balances, and potentially move funds. The file has been on disk since 2023-03-17 per mtime; key material may still be active.

Remediation. 1. Operator action now: revoke the AK-prefixed key via Alpaca dashboard. Rotate the PK-prefixed key. 2. Add backend/.apisecretes or *.apisecretes to .gitignore (feature-developer, one-line change). 3. After rotation, delete or zero out the file. 4. Run gitleaks detect --source=. --report-format=json after cleanup to confirm no history entry.

Routing: Credential revocation → operator. gitignore fix → feature-developer. Rotation confirmation → sre-agent.

HIGH

HIGH-1 — Heroku direct-to-origin bypass: full API accessible without CF Access (existing #252 — verified active)

Surface: raxx-api-staging-1a19fb3873b9.herokuapp.com Status: Previously filed as #252 (2026-04-24, severity:high). This sweep confirms it is actively exploitable. #252 updated to ready-for-dev and verification comment added.

Finding. All API endpoints on staging are reachable via the Heroku canonical URL with zero authentication. CF Access on api-staging.raxx.app (correctly) blocks anonymous access, but Heroku's *.herokuapp.com URL bypasses CF Access entirely. No CF-Connecting-IP middleware exists in backend_v2/api/middleware/ (confirmed by source code search).

Confirmed accessible anonymously: /api/system/status (full system fingerprint), /api/trading/account (account structure + missing env var list), /api/trading/positions, /api/trading/orders, /api/symbols, /api/notifications, /api/settings, /api/compare-quotes.

Risk. Anyone who discovers or guesses the Heroku URL can: - Enumerate all API endpoints and response structures without auth - Determine exact env vars that are missing (aids credential-stuffing + env-injection attacks) - Retrieve system fingerprint (kernel version, patch level, OS, app version) for CVE targeting - When Alpaca credentials are pushed to staging (blocked by this gap per M4 in 2026-04-24 review), retrieve real paper account data

Elevated traffic reported by operator on 2026-04-25 is consistent with scanning activity against the Heroku URL. CF WAF rate limiting does not apply to direct Heroku hits.

Remediation. Implement CF-Connecting-IP header check in backend_v2/api/middleware/ per the scope in #252. Reject requests without this header (except /health for liveness probes). The fix is code, not infra — unblocked and ready.

Routing: Code fix → feature-developer. See #252.

HIGH-2 — Production JS source map publicly accessible — exposes full React source tree (filed #378)

Surface: https://raxx.app/static/js/main.2efb100a.js.map

Finding. The production React bundle at raxx.app includes a sourceMappingURL directive. The referenced .map file is publicly accessible (HTTP 200, anonymous). It contains 929 source files including the full un-minified source of all application JS: all component files, all API client files, featureFlags.js, sentryInit.js.

Exposed via source map: - All internal API endpoint patterns (/api/trading/account, /api/historical-data, /api/backtest, etc.) extractable from api/*.js files - Feature flag names (live_mode_ring, options_chain) and the baked-in value REACT_APP_FLAGS=live_mode_ring,options_chain - Sentry telemetry configuration structure and all env var names used - Internal component hierarchy and error-handling paths

No hardcoded secrets or live credentials found in source map content. Risk is reconnaissance, not direct exploitation.

Remediation. Set GENERATE_SOURCEMAP=false in Cloudflare Pages build environment. Long-term: upload source maps to Sentry at build time via sentry-cli upload-sourcemaps and exclude from public bundle.

Routing: Code fix → feature-developer (Antlers/frontend).

MEDIUM

MED-1 — raxx.app manifest.json reveals CRA boilerplate app identity (filed #379)

Surface: https://raxx.app/manifest.json

Finding. Returns default Create React App boilerplate (name: Create React App Sample, short_name: React App). Also: index.html title is TradeMaster API - Algorithmic Trading Platform — discloses both the product name and its function. Both confirm CRA/React stack to any visitor.

Risk. Technology stack confirmation. Minor on its own; compounds with source map exposure (#378) and system/status fingerprinting to build a complete attack profile.

Remediation. Update frontend/trademaster_ui/public/manifest.json name and short_name to Raxx brand. Update index.html title to drop the technology-tier disclosure.

Routing: Code fix → feature-developer (Antlers/frontend).

LOW (batched — no issues filed)

INFO (no issues filed)

Issue summary

Total new issues filed: 3 (#377 CRITICAL, #378 HIGH, #379 MEDIUM) Existing issues updated: 1 (#252 — verified active, labels updated)

On the elevated traffic

The operator's "lots of traffic" observation is consistent with two possible sources:

1. Automated scanning of the Heroku direct URL. The URL raxx-api-staging-1a19fb3873b9.herokuapp.com is referenced in plain text in .github/workflows/deploy.yml in the (private) repo, but could also be discovered by Shodan-style Heroku scanning. Since it bypasses CF WAF + CF Access, any scanner hitting it goes directly to the Heroku dyno and is counted in Heroku metrics.

2. Cloudflare Bot Management traffic on raxx.app. The public SPA at raxx.app has no bot protection (no Disallow: in robots.txt, no Cloudflare Bot Fight Mode confirmed). Crawlers indexing the SPA are common and visible in traffic metrics.

Recommendation: implement #252 (CF-Connecting-IP middleware) immediately. This both closes the bypass and will reduce dyno utilization from scanner traffic.

What this sweep did NOT check

• Cloudflare Access log review for unusual login patterns (requires CF API access — not available in this sweep)
• Infisical audit log for service-token reads outside expected cadence
• Heroku platform audit log for config var changes
• Per-PR Cloudflare Pages preview aliases beyond the known raxx-app.pages.dev name (no CF API token available)
• Dynamic application security testing (Burp / OWASP ZAP) — not in scope per release-readiness-policy.md
• Heroku internal services / Postgres direct access