2050planet.com — Security Audit Report

**Date:** 29 April 2026
**Codebase audited:** `2050planet-app` (Next.js 14.2.18 + Supabase + Anthropic Haiku)
**Verdict:** 🟡 **YELLOW** — clean foundation, two critical gaps must be closed before public launch
**Time to GREEN:** ~90 minutes with the drop-in files in `/drop-in/`

---

Executive summary

The codebase is well-built. Modern Supabase SSR pattern, RLS enabled on all tables, service role key stays server-side, errors don't leak details to the client, gitignore correctly excludes `.env*`. The `dangerouslySetInnerHTML` in `ArticleLayout.tsx` is safe because the markdown pipeline uses `allowDangerousHtml: false` and the content is trusted (authored by you, not user-submitted).

But there are **two critical issues** that, on a public 2050planet.com launch, would cause real damage:

1. **The TERRA endpoint has no rate limiting.** A single attacker (or a curious teenager with a curl loop) can hammer `/api/terra` and run your Anthropic bill into thousands of dollars overnight.
2. **The free-message limit is trivially bypassable.** The server only counts user messages in the *current request payload*, not historically. Anyone who clears cookies or sends fresh `messages: [oneMessage]` arrays gets unlimited free TERRA forever. This breaks both the cost model AND the sign-in incentive.

Plus three high-severity gaps in headers/CORS that will fail securityheaders.com.

All issues are fixed by the drop-in files in this package.

---

Findings by severity

🔴 CRITICAL

C1. No rate limiting on `/api/terra`

C2. Free-message limit bypassable

---

🔴 HIGH

H1. Missing CSP, HSTS, Permissions-Policy headers

H2. No origin/referer check on `/api/terra`

H3. `poweredByHeader` not disabled

---

🟡 MEDIUM

M1. Prompt injection can break TERRA brand identity

M2. `profiles` UPDATE policy missing `WITH CHECK` clause

M3. No bot detection on auth flow

M4. Image hostnames overly permissive

---

🟡 LOW

L1. Missing security.txt

L2. Children's data — UAE PDPL note

L3. No `/api/terra` request size limit explicit

---

🟢 GOOD (already done correctly)

✅ `.env.local` correctly gitignored
✅ Service role key only used in `lib/supabase/server.ts` `createServiceClient()`
✅ Service role key never appears in any client component
✅ Errors return generic messages, not stack traces
✅ TERRA route has basic input validation (length, role shape)
✅ RLS enabled on `terra_usage` and `profiles`
✅ Owner-scoped policies on `terra_usage` and `profiles`
✅ `auto-create profile` trigger uses `security definer` correctly
✅ Markdown pipeline uses `allowDangerousHtml: false` (the `dangerouslySetInnerHTML` in `ArticleLayout.tsx` is safe)
✅ Middleware refreshes session on every request
✅ Next.js 14.2.18 (recent, no known critical CVEs as of audit date — but run `npm audit` before launch)

---

Pre-launch dependency check

Run before deploy:
```bash
npm audit --audit-level=high
```
If any HIGH/CRITICAL CVEs appear, fix before launch.

Specifically watch for:
- `@anthropic-ai/sdk` — keep on latest
- `next` — patch updates ship security fixes; stay on 14.2.x latest
- `@supabase/ssr` and `@supabase/supabase-js` — same

---

Files in this package

```
2050planet-security/
├── AUDIT-REPORT.md (this file)
├── PRE-LAUNCH-CHECKLIST.md (the day-of-launch tickbox)
├── THREAT-MODEL.md (filled in for 2050planet specifically)
└── drop-in/
├── next.config.js (REPLACE existing)
├── lib/
│ ├── rate-limit.ts (NEW — Upstash rate limiter)
│ └── terra-guards.ts (NEW — prompt injection defence)
├── app/
│ ├── api/terra/route.ts (REPLACE existing — adds rate limit + persistent free counter + origin check + prompt injection guards)
│ └── .well-known/security.txt/route.ts (NEW)
└── supabase/migrations/
└── 0002_security_hardening.sql (RUN in Supabase SQL editor)
```

---

Apply order (do all six in sequence)

1. Replace `next.config.js` with drop-in version
2. Create `lib/rate-limit.ts` and `lib/terra-guards.ts`
3. Replace `app/api/terra/route.ts` with drop-in version
4. Add `app/.well-known/security.txt/route.ts`
5. Run `supabase/migrations/0002_security_hardening.sql` in Supabase SQL editor
6. Add three new env vars to Vercel: `UPSTASH_REDIS_REST_URL`, `UPSTASH_REDIS_REST_TOKEN`, `ALLOWED_ORIGINS`

Then: `npm run build` locally → deploy to Vercel preview → run the `PRE-LAUNCH-CHECKLIST.md` against the preview URL → ship.