Fix critical security vulnerabilities (IDOR, SSRF, XSS)

[mojoro]

Summary

Fixes 4 critical security vulnerabilities identified during a full codebase audit:

• IDOR in 5 server actions — toggleSaveJob, ignoreJob, unignoreJob, updateJobNotes, and createApplication verified profile ownership but mutated jobs using only where: { id: jobId }, allowing any authenticated user to modify another user's jobs. Fixed by scoping all mutations to profileId.
• SSRF in /api/jobs/extract — Server fetched any user-supplied URL with no validation beyond ^https?://. Added isPrivateHostname() to block private/reserved IP ranges (10.x, 172.16-31.x, 192.168.x, 169.254.x, 127.x), localhost, .local, and .internal.
• XSS via unsanitized markdown — JobDescription rendered scraped job descriptions (attacker-controlled content) without sanitization. Added rehype-sanitize to the Markdown renderer.
• API key exposure risk — openrouter.ts contained OPENROUTER_API_KEY but lacked a server-only guard. Added import "server-only" to fail the build if accidentally imported by a client component.

Also includes docs/audit-findings.md — a comprehensive 60-finding audit document covering security, performance, data syncing, redundancies, and inconsistencies, with exact file locations and fix instructions for future sessions.

Test plan

• Verify dashboard feed actions (save, ignore, unignore, notes) still work for the owning user
• Verify pipeline application creation works
• Verify job import via URL still works for public URLs
• Verify job import rejects http://localhost, http://169.254.169.254, http://10.0.0.1
• Verify job description markdown renders correctly (no broken formatting from sanitization)
• Verify pnpm tsc --noEmit passes
• Verify build succeeds on Vercel preview

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
shortlist	Ready	Preview, Comment	Mar 25, 2026 1:37pm