Security: 6 low-severity findings in the message handlers and event strategies #1020

CodeRabbit's historical security scan of this repository (scan e8c825ec-84c1-4a90-b646-61791714baf8, revision bc22677aba, generated 2026-11-01) reported this. It is an AI-generated finding, not a confirmed vulnerability: reachability is not established by the scan, and the report itself says so. Triage before treating it as exploitable.

F-018 — authorization bypass (low)

src/handlers/event-strategies/vanish-event-strategy.ts:22-26

The vanished-state check and ordinary event insertion are separate operations, without synchronization shared with vanish processing. A publication that passes the check can insert after vanish has deleted the author's existing events, leaving an active, deliverable event despite successful completion of the author's vanish request.

Evidence

• Source/control: A valid, otherwise admissible …

Suggested fix. Use the same database-backed per-author lock for publication and vanish operations across workers. Hold it through the vanished-state check and event write, or through the vanish deletion and flag update, so an admitted write cannot escape deletion.

F-025 — authorization bypass (low)

src/handlers/event-message-handler.ts:643-645

An admission lookup can cache an obsolete positive result after a concurrent leave has revoked membership and invalidated the existing cache entry. Subsequent publications trust that result without checking membership, extending publication authority for up to 300 seconds after departure.

Evidence

• Source/control: Concurrent signed publication and authenticated leave requests from an …

Suggested fix. Coordinate revocation and cache fills across workers with a membership generation and an atomic conditional cache write, or an equivalent shared mechanism. Ensure a completed leave prevents pending lookups based on earlier membership from installing usable positive entries.

F-028 — authorization bypass (low)

src/handlers/count-message-handler.ts:45-46

COUNT authorization checks only filters explicitly naming restricted event kinds. Omitting kinds bypasses ownership checks while the database still counts restricted events, exposing their existence and communication metadata.

COUNT authorization checks only filters that explicitly name restricted kinds. A filter without kinds can still match protected events, so its aggregate reveals their …

Suggested fix. Treat filters without kinds as potentially matching restricted events and require ownership scoping, following isReconciliationAuthorized. Alternatively, enforce the caller's restricted-event visibility directly in the count query.

Treat omitted kinds as potentially matching restricted events and require the same authenticated author-or-recipient scoping used by reconciliation. Alternatively, …

F-029 — authorization bypass (low)

src/handlers/event-message-handler.ts:213-213

Metadata side effects run even when the submitted profile did not replace the current stored profile. Replaying an older signed profile without a NIP-05 identifier can therefore delete the author's current verification record and block later publications.

Evidence

• Source/control: An older, validly signed, unprotected kind-0 profile belonging to the victim and lacking a NIP-05 identifier.
• …

Suggested fix. Propagate whether metadata became current and skip verification changes for rejected or no-op replacements. Bind verification updates and deletions to the current profile version so delayed operations cannot modify newer security state.

F-038 — denial of service (low)

src/handlers/event-strategies/delete-event-strategy.ts:25-25

Every matching deletion tag creates a new array containing all previously collected IDs. An admitted event with thousands of repeated valid tags therefore causes quadratic copying synchronously on the worker, delaying unrelated clients even when none of the referenced events exists.

Evidence

• Source/control: The tags array of a client-signed kind-5 WebSocket EVENT.
• Sink/decision: The …

Suggested fix. Collect valid IDs in a single pass using a mutable array or Set, and deduplicate targets before querying. Apply a practical deletion-target limit if the supported batch size also needs an explicit bound.

F-039 — authorization bypass (low)

src/handlers/event-message-handler.ts:847-859

When verification of changed metadata encounters a request error, the replacement identifier and domain inherit the previous identifier's successful verification timestamp. Publication then treats the replacement domain as verified, allowing an author excluded by a domain-policy change to regain access without proving ownership at an allowed domain.

Evidence

• Source/control: The nip05 …

Suggested fix. Preserve successful verification after a request error only when the canonical identifier and domain are unchanged. For a changed identity, clear the successful timestamp until that identity verifies successfully.

These are grouped by area so one reviewer can judge them together; split any that turn out to need separate work.