Building a GitHub App That Reviews Its Own Code: Lessons in Security Hardening

Short summary

The author built a GitHub App for automated PR review and discovered three security vulnerabilities during an internal audit: authentication that failed open when the auth service was unreachable, a Content-Length header bypass allowing oversized payloads, and a rate limiter that leaked memory under sustained traffic. Each fix is explained in detail — fail-closed authentication, stream-based size validation, and time-based eviction. Test coverage improved from 62% to 76%.

• •Authentication failed open: exceptions during token validation let requests through — fixed with fail-closed pattern
• •Content-Length bypass: header value was trusted instead of actual bytes received — fixed by validating stream size
• •Rate limiter memory leak: per-IP counters never evicted — fixed with time-based eviction policy

Generated with AI, which can make mistakes.