[buttercode101]

P0-3 hardening, no merge/deploy requested.

1. Timing-safe CRON_SECRET (LOW)

• New server/secretCompare.js: timingSafeEqualString hashes both sides to fixed-length sha256 digests before crypto.timingSafeEqual (length-mismatch safe, no length leak) and isBearerAuthorized.
• server/index.js /api/cleanup and server/siteConfig.js canonicalHost now use it instead of plain !==.

2. /api/report/:id IDOR hardening

• Read the existing flow first: this endpoint only ever returned freeViewOf (free preview); the full paid report is only via POST /api/unlock-analysis (reference+email grant check). public/index.html resume flow calls /api/report/:id with NO credentials and depends on the free preview, so requiring full auth would break the demo/resume flow.
• Minimal check consistent with the grant model: no credential -> free preview only (paid fields stripped, unchanged behaviour); with x-payment-reference (+ optional x-receipt-email, same credential as /api/credits) -> full report only if the grant exists, email matches, and grant.unlocked already includes this id; otherwise the same generic 404 as a missing report (no existence/unlock-state leak). Rejects traversal-style ids (400).
• New server/p0Hardening.test.js: timing-safe helper cases + report endpoint cases (free-only unauthenticated, bogus/not-unlocked/wrong-email = identical 404 to missing, full report after unlock-analysis, traversal rejected).

3. OpenAPI sync

• Removed stale /api/upload and token-based /api/report. Documented actual routes: /api/health, /api/health/storage, /api/config, /api/demo/{key}, /api/events, /api/credits, /api/verify-payment, /api/analyze, /api/analyze-text, /api/report/{id}, /api/unlock-analysis, /api/cleanup.

Tests: env -u GH_TOKEN npm ci --ignore-scripts && npm test -> 136 pass / 0 fail (134 pre-existing + 2 new).

[vercel]

Deployment failed for project contract-cheq with the following error:

There is no GitHub account connected to this Vercel account.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
contractcheck-sa-v3	Ready	Preview	Nov 9, 2026 1:46pm UTC