# Deep Audit Report — WhatsApp Gateway Source

## Scope

The audit covers the Go backend, React/Vite frontend structure, authentication, authorization, API credentials, database migrations, outbound networking, webhook delivery, crawler/link-preview paths, AI data/log flow, dependency declarations, performance controls, and license enforcement architecture.

## Security findings fixed in secured.2

1. API keys no longer need to remain plaintext after creation/use.
2. Email verification tokens have explicit expiry and are hashed at rest.
3. Password reset tokens are hashed at rest and expire after one hour.
4. Password changes/resets invalidate existing JWT sessions through `TokenVersion`.
5. Forgot-password and resend-verification actions have dedicated database-backed throttling.
6. REST API query-string authentication is disabled by default.
7. Webhook secrets generated by the secured release are encrypted at rest.
8. Webhook delivery uses the shared SSRF-safe transport and has additive timestamp-bound V2 signatures.
9. Raw customer/AI response text was removed from normal AI logs.
10. Browser security headers were added globally.
11. Production preflight/build tooling and rollback documentation were added.
12. Added a minimal `/api/healthz` monitoring endpoint.

## Controls already present and retained

- JWT parser restricts algorithms to HS256.
- JWT lifetime defaults to 24 hours and is configurable.
- Authenticated requests re-check that the user still exists and is active.
- Passwords use bcrypt.
- Login throttling uses IP and username/IP controls.
- Production CORS rejects wildcard configuration.
- Request and multipart body limits exist.
- Crawler has dial-time public-IP validation and browser network restrictions.
- Application configuration secrets have AES-256-GCM secretbox support.
- Tenant/agent access is bounded by tenant ownership and user-agent assignment.
- REST API has a per-agent token-bucket limiter.
- MySQL connection pool limits are configurable.

## Architecture / maintenance findings

### Authorization

Authorization is currently distributed across `AuthMiddleware`, `CSRouteGuard`, `RequireTenantAdmin`, `RequireSuperAdmin`, workspace permissions, and `resolveAgent`. The existing agent resolution path checks tenant ownership and, for non-admin users, explicit agent assignment. This is materially safer than relying on frontend menu visibility. A future refactor should consolidate policy declarations without changing behavior.

### AI data protection

The runtime intentionally sends conversation history, relevant knowledge and the current customer message to the configured AI provider because those are required for the assistant to answer. The secured release does not silently remove those fields. Normal logs and simulation metadata were tightened so customer text is not unnecessarily duplicated into operational logs.

A future explicit data-policy layer should classify which fields may leave the server for each provider/tool and allow the operator to disable optional context fields.

### Performance

Connection pools, request limits, caches, background workers, retry delays and per-agent API rate limiting already exist. The next performance pass should use production metrics before changing concurrency or database indexes, because the WhatsApp workload is stateful and aggressive tuning can create duplicate sends or DB contention.

### Outbound network inventory

The remaining fixed integrations (AI providers, email, shipping, Meta, Google and Cloudflare) use configured vendor endpoints rather than arbitrary customer URLs. User-controlled crawler destinations already have stronger dedicated controls. The shared public HTTP guard now covers the identified arbitrary URL fetch paths.

## License architecture review

The source contains a remote license verification/heartbeat subsystem with machine binding, signed responses and offline grace. The buyer-provided certificate states `LIFETIME / UNLIMITED / FULL RIGHTS`, while the source package's own license/EULA text contains a five-device/update-support formulation. These are not silently treated as equivalent.

This secured release keeps entitlement enforcement unchanged. A future entitlement refactor should first reconcile the contractual documents and then introduce an explicit `LicenseProvider` interface so application functionality is not tightly coupled to an HTTP vendor service.

## Validation status

The code has been formatted with `gofmt`. The audit environment cannot complete the full backend build because the project declares Go 1.25.8 while the available compiler is Go 1.23.2 and the environment cannot download the required toolchain. The frontend dependency tree is also incomplete in the audit environment. Therefore the final build/test gate must be executed on the actual deployment/build machine using the exact declared toolchains.