muzick/AUDIT.md

Muzick — audit journal

Goal

Audit the muzick project at /home/kami/apps/muzick/, file Vikunja tasks for findings, and work on autonomous items.

Progress

2026-07-14 — Initial audit

Git: initialized, initial state committed (737bf19). Fixes committed in 42474c6.

Project structure: 196 files — TypeScript/Fastify backend, React/Vite frontend, BullMQ workers, PostgreSQL + Redis + Typesense.

Fixes applied

1. AGENTS.md tech stack: python/fastapi → fastify/typescript (was wrong)
2. CORS: Added @fastify/cors plugin to backend with env-based origin config
3. .env.example: Created with placeholder values (secrets were only in .env which is gitignored)
4. backend/src/index.ts: Removed dead code (empty file, server.ts is real entry point)

Tasks filed

• See Homelab infra project. Key items:
  • #109: pin Docker images (NEEDS FIX — minio:latest etc)
  • #110: N+1 queries in generators (PERFORMANCE)
  • #111: image proxy SSRF guard (SECURITY)

New critical issues found

1. No auth on any API — x-user-id header with hardcoded fallback UUID is the only identity
2. Admin routes unprotected — anyone can trigger scan/reindex/delete
3. Postgres password "password" hardcoded in docker-compose.yml
4. Typesense API key "muzick-key" hardcoded in docker-compose.yml
5. SOCKS proxy IP 192.168.1.104 exposed in .env and AGENTS.md
6. No tests for any worker service (1311-line enrichment.service.ts has 0 tests)
7. Frontend never typechecked in CI
8. No input validation on many routes (admin, library — as any casts)

Remaining autonomous work items

• #109 — Pin Docker images in docker-compose.yml — CAN DO