feat: security fixes, performance optimizations, accessibility improvements, and cleanup

[rajashekar]

Summary

This PR brings together a comprehensive set of improvements across security, performance, accessibility, and code quality from the rajashekar/foliolab fork.

🛡️ Security Fixes

• SSRF protection in RSS parser — Custom DNS lookup to block private/local IPs and prevent DNS rebinding attacks
• XSS prevention — Sanitized portfolio HTML generation and secured Vercel OAuth callback
• Secure request IDs — Replaced Math.random() with crypto.randomUUID()
• Log redaction — Sensitive data (tokens, keys) masked in request/error logs
• Input sanitization — Added security.ts utility with safeJsonStringify and redactSensitiveData

⚡ Performance Optimizations

• Project analyzer — Replaced array .includes()/.some() with pre-compiled RegExp and Set for O(1) lookups
• README cleaner — Extracted regex patterns to module scope to avoid per-call recompilation
• Framework detection — O(1) file lookups with Sets
• Select items page — Optimized filtering and grouping logic
• GitHub API — Reused Octokit instances, lazy-loaded repo details

🎨 Accessibility & UX

• ARIA labels on all icon-only buttons across portfolio preview, data sources, and repo select pages
• Clearable search in repository selection
• FAQ accordion component
• Form label associations for screen readers
• Empty state improvements in repo selection

🧹 Cleanup

• Removed orphaned files (pr_body.md, duplicate images/favicon.svg, bot-generated .jules/ notes)
• Removed conflicting pnpm-lock.yaml (project uses npm)
• Fixed broken CONTRIBUTING.md
• Updated .gitignore to prevent future lockfile conflicts

🧪 Tests

• Added tests for security utilities, GitLab README extraction, RSS conversion, error responses, project analyzer summary, and portfolio XSS prevention

[Copilot]

Pull request overview

This PR expands FolioLab from a GitHub-only portfolio builder into a multi-source portfolio tool (GitHub/GitLab/Bitbucket/RSS/Medium/freeform), while adding several security hardenings, performance optimizations, and accessibility improvements across the app.

Changes:

• Adds multi-source schemas, storage APIs, server endpoints, and new UI pages to import and select portfolio items from multiple providers.
• Introduces security utilities (safe JSON embedding + log redaction) and hardens external fetching (RSS SSRF protections) plus XSS defenses in portfolio generation and OAuth callback.
• Improves performance via OpenAI client reuse, GitHub API pagination batching, and project-analyzer/readme-cleaner optimizations.

Reviewed changes

Copilot reviewed 46 out of 49 changed files in this pull request and generated 10 comments.

Show a summary per file

File	Description
tests/security.test.ts	Adds tests for safe JSON embedding + sensitive-data redaction utilities.
tests/portfolio-security.test.ts	Adds regression test ensuring javascript: links are neutralized in generated portfolio HTML.
tests/portfolio-generation.test.ts	Updates portfolio generation tests to use shared generator utilities and tests helper functions.
tests/gitlab.test.ts	Adds tests for GitLab README title extraction.
tests/github-integration.test.ts	Updates OAuth-state test to use crypto.randomUUID() when available.
shared/schema.ts	Adds multi-source Zod schemas and a discriminated union PortfolioItem type.
server/vite.ts	Tightens Vite server option typings (as const).
server/routes/sources.ts	Adds rate-limited multi-source API routes (RSS/Medium/GitLab/Bitbucket/freeform + summary generation).
server/routes/health.ts	Adds health/readiness/liveness endpoints.
server/routes/github.ts	Standardizes error responses and validates repository ID input.
server/routes/deploy.ts	Moves portfolio HTML generation to a shared module; uses safe JSON embedding for Vercel OAuth callback messaging.
server/lib/security.ts	Introduces safeJsonStringify and redactSensitiveData.
server/lib/rss.ts	Adds RSS parsing with custom DNS lookup + private IP blocking to mitigate SSRF/DNS rebinding.
server/lib/readme-cleaner.ts	Hoists regexes/patterns to module scope to avoid recompilation overhead.
server/lib/project-analyzer.ts	Improves framework/config detection performance via regexes/sets; exports detectFrameworks.
server/lib/portfolio-generator.ts	Centralizes portfolio HTML generation + HTML/url sanitization helpers.
server/lib/openai.ts	Adds LLM config constants, intelligent truncation, and a singleton OpenAI client.
server/lib/medium.ts	Adds Medium RSS integration + username parsing and validation.
server/lib/logger.ts	Adds a structured logger implementation (currently standalone).
server/lib/gitlab.ts	Adds GitLab API integration and README title enrichment.
server/lib/github.ts	Adds pagination helper, Octokit error typing, repo batching controls, and readme retrieval improvements.
server/lib/error-responses.ts	Adds standardized API error response shape + shared error codes.
server/lib/bitbucket.ts	Adds Bitbucket API integration and README/title enrichment.
server/index.ts	Adds env validation, request IDs, security headers, CORS logic updates, redacted API logging, and server timeouts.
package.json	Adds dependencies (axios, rss-parser, express-rate-limit) and updates toolchain versions.
images/favicon.svg	Removes an orphaned/duplicate favicon asset.
client/src/pages/source-selection.tsx	Adds UI to choose which sources to import from (start of multi-source wizard flow).
client/src/pages/select-items.tsx	Adds UI to select portfolio items across sources (grouped + filterable).
client/src/pages/repo-select.tsx	Adds “clear search” UX + accessibility labels and a link to add other sources.
client/src/pages/portfolio-preview.tsx	Adds ARIA labels to icon-only actions for accessibility.
client/src/pages/home.tsx	Updates landing page copy and introduces an FAQ accordion + multi-source entrypoint.
client/src/lib/wizard-state.ts	Adds localStorage-backed wizard state management for multi-step multi-source flow.
client/src/lib/storage.ts	Extends storage to support multi-source items + additional credentials/config storage.
client/src/App.tsx	Wires new routes for multi-source flow pages.
MULTI_SOURCE_FEATURE.md	Adds documentation for the multi-source feature architecture and flow.
CONTRIBUTING.md	Updates contributor instructions (tests/build).
ANALYSIS/portfolio_selection_flow_analysis.md	Adds internal analysis documentation of the selection flow.
ANALYSIS/flow_diagrams.md	Adds internal flow diagrams for the selection flow.
ANALYSIS/code_locations_reference.md	Adds internal “where to find code” reference.
ANALYSIS/START_HERE.md	Adds internal onboarding guide for the multi-source selection flow work.
ANALYSIS/README.md	Adds internal documentation index for analysis docs.
ANALYSIS/EXECUTIVE_SUMMARY.md	Adds internal executive summary of selection-flow gaps and next steps.
.gitignore	Ignores pnpm/yarn lockfiles to prevent lockfile conflicts.
.github/workflows/ci.yml	Adds CI workflow with typecheck/build/test steps (currently allows test failures).
.env.example	Documents new optional env vars for batching/logging/timeouts.

Comments suppressed due to low confidence (1)

server/index.ts:113

• This CORS middleware sets Access-Control-Allow-Origin: * in development while also setting Access-Control-Allow-Credentials: true. Browsers will reject credentialed requests with a wildcard origin. Consider echoing back the request origin (and setting Vary: Origin) when allowing credentials, or only setting Access-Control-Allow-Credentials when the origin is explicit.

// Add CORS headers
app.use((req, res, next) => {
  const requestOrigin = req.headers.origin;

  // Define allowed origins based on environment
  const allowedOrigins = process.env.NODE_ENV === 'production'
    ? [process.env.APP_URL].filter(Boolean)
    : ['http://localhost:5000', 'http://localhost:5173']; // Vite dev server

  // Check if request origin is allowed
  if (requestOrigin && allowedOrigins.includes(requestOrigin)) {
    res.setHeader('Access-Control-Allow-Origin', requestOrigin);
  } else if (process.env.NODE_ENV === 'development') {
    // In development, allow any origin for flexibility
    res.setHeader('Access-Control-Allow-Origin', '*');
  }
  // In production, if origin not allowed, don't set the header (request will be rejected)

  res.setHeader('Access-Control-Allow-Methods', 'GET, POST, PUT, DELETE, PATCH, OPTIONS');
  res.setHeader('Access-Control-Allow-Headers', 'Content-Type, Authorization');
  res.setHeader('Access-Control-Allow-Credentials', 'true');

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[soodoku]

@rajashekar i think this is a reasonable point.

[soodoku]

this file is a bit broken man. It may work but I doubt it will work consistently. One idea is that we do AST style parsing of the md. We can also do some basic regex for badges. Not sure how this integrates with the rest of the pipeline but we may need to look into it a bit more. Maybe LLM again.