BF-024-BF-045: Harden security and redaction flows

[baixiangcpp]

Summary:

• Moved Regex Tester evaluation into a time-boxed Web Worker path with execution timing, performance warnings, recovery messaging, and worker guard tests.
• Added a shared external-request confirmation component and gated YouTube, Vimeo, and Instagram media Preview/Download actions behind explicit confirmation with localized rights guidance.
• Hardened Log Scrubber and HAR Sanitizer redaction coverage, summaries, and review warnings without persisting raw payloads.
• Added Markdown, HTML, SVG, and Open Graph preview sanitization regressions and tightened HTML-to-Markdown image sanitization.
• Added .well-known/security.txt, generated /security.txt redirect support, GitHub security policy, and aligned Contact/Trust Center reporting links.

Issues:

• Closes [P1] BF-024: Add catastrophic backtracking guardrails and performance diagnostics to Regex Tester #145
• Closes [P1] BF-027: Add explicit pre-request confirmation and stronger rights guidance to external-request media tools #152
• Closes [P1] BF-028: Harden Log Scrubber coverage for common secret and PII patterns #154
• Closes [P1] BF-029: Default HAR Sanitizer to aggressive redaction of headers, cookies, query strings, bodies, and response content #156
• Closes [P1] BF-030: Add sanitization test suite for Markdown, HTML, SVG, and Open Graph preview tools #158
• Refs [P1] BF-035: Move heavy image, SVG, compression, PDF, and regex work off the main thread #177
• Closes [P1] BF-045: Add security.txt and a clearer public vulnerability reporting path #192

Implementation details:

• Routing/static: added public/.well-known/security.txt, generator-owned /security.txt redirect, and refreshed sitemap lastmod for Contact and Trust Center.
• Metadata/content: localized BF-045 reporting guidance and BF-024/BF-028/BF-029/BF-027 UI copy across en, zh-CN, zh-TW, ja, ko, de, and fr.
• Storage/privacy: no new payload storage; redaction fixtures avoid committing literal secret-shaped tokens; HAR/log outputs remain in component state only.
• UI: added regex timing/warning UI, external confirmation panels, log/HAR summary panels, manual review warnings, and clearer vulnerability reporting cards/links.
• Tests: added worker, redaction, sanitizer, external-request, security reporting, and policy guard coverage.

Privacy review:

• Confirmed no tool input, output, files, logs, HAR content, tokens, prompts, or generated output are stored by default.
• Confirmed no new external request runs without explicit user confirmation.
• Confirmed analytics behavior was not changed and no sensitive data is introduced into analytics.
• Confirmed localStorage/sessionStorage/IndexedDB/cache usage was reviewed for changed code; no new storage paths were added.

SEO review:

• Canonical behavior unchanged.
• Sitemap lastmod refreshed for edited localized Contact and Trust Center pages.
• Noindex behavior unchanged.
• Hreflang behavior unchanged.

Accessibility review:

• External-request confirmation uses an explicit checkbox and reachable action-proximate content.
• Regex diagnostics use text labels and non-color-only warning content.
• Trust Center and Contact links retain visible focus classes or existing link/button semantics.

Tests:

• Targeted checks run:
  • npm run test -- tests/unit/regex-tester-utils.test.ts tests/unit/regex-test-task.test.ts tests/guards/regex-worker-guard.test.ts tests/component/external-request-media-tools.test.tsx tests/guards/external-request-confirmation-guard.test.ts tests/unit/log-scrubber-utils.test.ts tests/unit/har-viewer-sanitizer-utils.test.ts tests/unit/preview-sanitization-regression.test.tsx tests/guards/preview-sanitization-guard.test.ts tests/guards/security-reporting-path.test.ts tests/guards/tool-action-consistency-guard.test.ts tests/guards/phase2-developer-workbench-pages.test.tsx tests/unit/html-to-markdown-utils.test.ts tests/unit/open-graph-utils.test.ts tests/unit/svg-optimizer-sanitizer.test.ts tests/unit/markdown-preview-safe-export.test.tsx
  • npm run test -- tests/guards/feature-tool-module-boundaries.test.ts tests/guards/sensitive-storage-audit.test.ts tests/guards/sensitive-tool-persistence-policy.test.ts tests/guards/external-request-taxonomy.test.ts
  • npm run test -- tests/guards/security-reporting-path.test.ts tests/guards/legacy-routes.test.ts tests/guards/bf-p0-seo-routing.test.ts
  • npm run test -- tests/unit/log-scrubber-utils.test.ts tests/guards/security-reporting-path.test.ts
  • npm run lint -- .github/SECURITY.md public/.well-known/security.txt public/_redirects 'src/app/[lang]/contact/page.tsx' 'src/app/[lang]/trust-center/page.tsx' src/core/security/sanitize.ts src/core/utils/log-scrubber-utils.ts src/features/tool-shell/external-request-confirmation.tsx src/features/tools/har-viewer-sanitizer/page.tsx src/features/tools/har-viewer-sanitizer/utils.ts src/features/tools/html-to-markdown/utils.ts src/features/tools/instagram-photo-downloader/page.tsx src/features/tools/log-scrubber/page.tsx src/features/tools/regex-tester/page.tsx src/features/tools/regex-tester/utils.ts src/features/tools/regex-tester/regex-test-task.ts src/features/tools/regex-tester/regex-test-worker.ts src/features/tools/vimeo-thumbnail-grabber/page.tsx src/features/tools/youtube-thumbnail-grabber/page.tsx tests/component/external-request-media-tools.test.tsx tests/guards/external-request-confirmation-guard.test.ts tests/guards/preview-sanitization-guard.test.ts tests/guards/regex-worker-guard.test.ts tests/guards/security-reporting-path.test.ts tests/guards/tool-action-consistency-guard.test.ts tests/unit/har-viewer-sanitizer-utils.test.ts tests/unit/log-scrubber-utils.test.ts tests/unit/preview-sanitization-regression.test.tsx tests/unit/regex-test-task.test.ts tests/unit/regex-tester-utils.test.ts tests/unit/html-to-markdown-utils.test.ts tests/unit/open-graph-utils.test.ts tests/unit/svg-optimizer-sanitizer.test.ts tests/unit/markdown-preview-safe-export.test.tsx
• Batch-level checks run:
  • npm run check:i18n
  • npm run check:types
  • npm run generate:sitemap-lastmod
  • npm run generate:legacy-routes
  • npm run validate
• Full CI:
  • Not run locally beyond npm run validate; remote PR checks will run once and will be used before merge.

[cloudflare-workers-and-pages]

Deploying byteflow with    Cloudflare Pages

Latest commit:	1dc9452
Status:	✅  Deploy successful!
Preview URL:	https://d8391435.byteflow-c58.pages.dev
Branch Preview URL:	https://codex-bf-p1-security-redacti.byteflow-c58.pages.dev

View logs