Skip to content

fix(#218)#245

Open
anshul23102 wants to merge 1 commit into
Coder-s-OG-s:mainfrom
anshul23102:fix/218-webhook-error-leak
Open

fix(#218)#245
anshul23102 wants to merge 1 commit into
Coder-s-OG-s:mainfrom
anshul23102:fix/218-webhook-error-leak

Conversation

@anshul23102
Copy link
Copy Markdown
Contributor

@anshul23102 anshul23102 commented Jun 1, 2026

Summary

Returns a generic HTTP 500 response when a webhook INSERT fails instead of forwarding the raw Supabase error object to the caller.

Related Issue

Closes #218

Type of Change

  • Security fix

Root Cause

The webhook INSERT failure path returned the raw `PostgrestError` object (including `code`, `details`, and `hint` fields) directly in the HTTP 500 response body. Internal Postgres constraint names, table schema hints, and error codes were visible to any caller that could trigger a failed insertion.

What Changed

  • `src/app/api/webhooks/github/route.ts`: replaced the raw error forward with a `console.error` log (operator-visible in Vercel logs) and a generic `"Internal server error"` client response.

Testing

  • Triggering a duplicate INSERT now returns a generic 500 with no internal details
  • Server logs contain the full Supabase error for debugging
  • Existing CI checks pass

Checklist

  • No hardcoded secrets or credentials
  • Single focused change
  • No merge conflicts with main

…onse

Closes Coder-s-OG-s#218

The webhook INSERT failure path returned the raw PostgrestError object
directly to the caller, exposing code, message, details, and hint fields.
These fields can reveal internal table names, column names, and database
constraint identifiers to any caller that can reach the endpoint.

Replaced the error serialisation with a server-side console.error that
logs all four fields for ops visibility, and a generic client-facing
{ error: 'internal server error' } response with no schema details.
@vercel
Copy link
Copy Markdown
Contributor

vercel Bot commented Jun 1, 2026

@anshul23102 is attempting to deploy a commit to the codersogs-3057's projects Team on Vercel.

A member of the Team first needs to authorize it.

@github-actions
Copy link
Copy Markdown

github-actions Bot commented Jun 1, 2026

Hey @anshul23102

You have 4 open PRs right now. The limit is 3 at a time.

Please get your existing PRs merged or closed before opening new ones:

This PR will remain open but won't be reviewed until you're under the limit. See our Contributing Guidelines for details.

This was referenced Jun 1, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

[Security] Webhook INSERT failure leaks raw Supabase error fields (code, details, hint) in the HTTP 500 response body

1 participant