# Bugs And Risk Findings

Review date: 2026-05-11

Scope: application-owned Elixir/Phoenix code, templates, config, deployment manifests, scripts, and dependency manifests. Vendored code and bundled third-party MIB data were not reviewed as first-party code.

Validation run:

- `mix credo --strict`: passed, no issues.
- `mix deps.audit`: passed, no vulnerabilities found.
- `mix hex.audit`: passed, no retired packages found.
- `npm audit --prefix e2e --audit-level=low`: passed, 0 vulnerabilities.

## Medium

### 6. CSP is duplicated and weakened by inline scripts

- Category: OWASP A05 Security Misconfiguration / A03 Injection defense in depth
- Evidence: `lib/towerops_web/router.ex:21`, `lib/towerops_web/plugs/security_headers.ex:20`, `lib/towerops_web/components/layouts/root.html.heex:35`, `lib/towerops_web/components/layouts/root.html.heex:71`, `lib/towerops_web/components/layouts/root.html.heex:80`
- Problem: CSP is set in both the browser pipeline and endpoint-level security plug, with different directives. The effective behavior depends on header overwrite order. The policy also requires `'unsafe-inline'` because templates include inline scripts, reducing CSP's value against XSS.
- Fix: centralize CSP construction in one plug. Move inline scripts into `assets/js/app.js` or LiveView hooks and remove `'unsafe-inline'` where possible. Consider nonces only for unavoidable inline bootstrapping.
- Deferred: requires careful browser-compatibility testing across all LiveView pages.