[comp] Production Deploy

[github-actions]

This is an automated pull request to release the candidate branch into production, which will trigger a deployment.
It was created by the [Production PR] action.

---

Summary by cubic

Rebuilt penetration tests with a split-view UI, @maced/api-client backend (signed webhooks, issues/events), and a credit wallet with admin grants and audit logs. Also added SOC 3 to the Trust Portal, fixed progress counts, enabled Markdown/CSV evidence uploads, and removed legacy Stripe billing and GitHub OAuth forwarding.

• New Features

  • Split-view pentest UI with live findings and agent activity; inline create at /security/penetration-tests/new with a generic target URL placeholder.
  • Backend swap to @maced/api-client; added GET /v1/security-penetration-tests/:id/issues and .../:id/events; HMAC webhooks with raw-body capture on webhook routes; server-side filtering of vendor-internal events.
  • Pentest credits wallet (debit on create, refund on failure/cancel, audited); balance shown in UI; admin grant via POST /v1/admin/organizations/:orgId/pentest-credits.
  • Trust Portal: added SOC 3 (switches, statuses, labels, files).
  • Evidence uploads now accept Markdown and CSV.
  • Security nav gated by permissions only (feature flag removed).
  • Integrations catalog refreshed to 559 integrations (includes new entries and a slug rename to better-stack).
  • Fixed framework/requirement/control progress tracking.

• Migration

  • Run DB migrations: drop organization_billing and pentest_subscriptions; add pentest_credits, credit_refunded_at, completed_audit_at, and a non-negative balance check.
  • Remove env vars: STRIPE_PENTEST_SUBSCRIPTION_PRICE_ID, STRIPE_PENTEST_OVERAGE_PRICE_ID, STRIPE_PENTEST_WEBHOOK_SECRET. Keep MACED_API_KEY.
  • Jest config updated to load @maced/api-client; no other app config changes required.

^{Written for commit 2670b15. Summary will update on new commits. Review in cubic}

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
app (staging)	Ready	Preview, Comment	Apr 29, 2026 4:36pm
comp-framework-editor (staging)	Ready	Preview, Comment	Apr 29, 2026 4:36pm
portal (staging)	Ready	Preview, Comment	Apr 29, 2026 4:36pm

[cubic-dev-ai]

8 issues found across 72 files

Prompt for AI agents (unresolved issues)

Check if these issues are valid — if so, understand the root cause of each and fix them. If appropriate, use sub-agents to investigate and fix each issue separately.


<file name="apps/app/src/app/(app)/[orgId]/security/penetration-tests/_components/FindingDetail.tsx">

<violation number="1" location="apps/app/src/app/(app)/[orgId]/security/penetration-tests/_components/FindingDetail.tsx:239">
P2: `extractValidationSteps` is hardcoded to `[]`, so validation steps can never render and the non-empty branch is dead code.</violation>
</file>

<file name="apps/app/src/app/(app)/[orgId]/security/penetration-tests/_components/SplitView.tsx">

<violation number="1" location="apps/app/src/app/(app)/[orgId]/security/penetration-tests/_components/SplitView.tsx:77">
P2: The empty-state condition does not account for list fetch errors, so API failures are shown as an empty scans state.</violation>

<violation number="2" location="apps/app/src/app/(app)/[orgId]/security/penetration-tests/_components/SplitView.tsx:154">
P2: `aria-hidden` is applied to a container with focusable descendants; in create mode the run list can still be keyboard-focused despite being hidden from assistive tech.</violation>
</file>

<file name="apps/app/src/app/(app)/[orgId]/security/penetration-tests/_components/OverviewPane.tsx">

<violation number="1" location="apps/app/src/app/(app)/[orgId]/security/penetration-tests/_components/OverviewPane.tsx:140">
P2: Recent scan activity is filtered to completed runs only, so failed/cancelled recent scans are hidden from the "Recent scans" section.</violation>
</file>

<file name="apps/app/src/app/(app)/[orgId]/security/penetration-tests/_components/RunningDetail.tsx">

<violation number="1" location="apps/app/src/app/(app)/[orgId]/security/penetration-tests/_components/RunningDetail.tsx:139">
P2: The new-finding highlight baseline is initialized before issues finish loading, so the first fetched findings for a run can all be incorrectly marked as newly arrived.</violation>
</file>

<file name="apps/api/src/security-penetration-tests/security-penetration-tests.service.spec.ts">

<violation number="1" location="apps/api/src/security-penetration-tests/security-penetration-tests.service.spec.ts:612">
P1: Do not leave webhook HMAC validation and constructor-time API-key behavior untested; this removes coverage for a security-critical flow.</violation>
</file>

<file name="apps/api/src/security-penetration-tests/security-penetration-tests.service.ts">

<violation number="1" location="apps/api/src/security-penetration-tests/security-penetration-tests.service.ts:178">
P2: Do not include raw transport exception messages in the HTTP response body; this can leak internal infrastructure details.</violation>

<violation number="2" location="apps/api/src/security-penetration-tests/security-penetration-tests.service.ts:544">
P2: `completedAuditAt` is set before the audit entry is durably written, so transient audit-write failures can permanently suppress completion auditing.</violation>
</file>

_{Reply with feedback, questions, or to request a fix. Tag @cubic-dev-ai to re-run a review.}

[cubic-dev-ai]

P1: Do not leave webhook HMAC validation and constructor-time API-key behavior untested; this removes coverage for a security-critical flow.

Prompt for AI agents

Check if this issue is valid — if so, understand the root cause and fix it. At apps/api/src/security-penetration-tests/security-penetration-tests.service.spec.ts, line 612:

<comment>Do not leave webhook HMAC validation and constructor-time API-key behavior untested; this removes coverage for a security-critical flow.</comment>

<file context>
@@ -585,201 +609,11 @@ describe('SecurityPenetrationTestsService', () => {
-      'Maced API key not configured on server',
-    );
-  });
+  // TODO(phase-5): webhook tests removed — handleWebhook now verifies HMAC
+  // via @maced/api-client verifyMacedWebhook. Rewrite: valid signature → ok,
+  // invalid/missing signature → ForbiddenException, unknown run → warn+ok.
</file context>

[cubic-dev-ai]

P2: extractValidationSteps is hardcoded to [], so validation steps can never render and the non-empty branch is dead code.

Prompt for AI agents

Check if this issue is valid — if so, understand the root cause and fix it. At apps/app/src/app/(app)/[orgId]/security/penetration-tests/_components/FindingDetail.tsx, line 239:

<comment>`extractValidationSteps` is hardcoded to `[]`, so validation steps can never render and the non-empty branch is dead code.</comment>

<file context>
@@ -0,0 +1,240 @@
+// Validation-steps field isn't part of PentestIssue type (yet); parse if it
+// shows up on future payloads. For now returns empty.
+function extractValidationSteps(_issue: PentestIssue): string[] {
+  return [];
+}
</file context>

[cubic-dev-ai]

P2: The empty-state condition does not account for list fetch errors, so API failures are shown as an empty scans state.

Prompt for AI agents

Check if this issue is valid — if so, understand the root cause and fix it. At apps/app/src/app/(app)/[orgId]/security/penetration-tests/_components/SplitView.tsx, line 77:

<comment>The empty-state condition does not account for list fetch errors, so API failures are shown as an empty scans state.</comment>

<file context>
@@ -0,0 +1,255 @@
+
+  const showEmptyState =
+    !listLoading &&
+    reports.length === 0 &&
+    selectedRunId === null &&
+    mode !== 'create';
</file context>

[cubic-dev-ai]

P2: aria-hidden is applied to a container with focusable descendants; in create mode the run list can still be keyboard-focused despite being hidden from assistive tech.

Prompt for AI agents

Check if this issue is valid — if so, understand the root cause and fix it. At apps/app/src/app/(app)/[orgId]/security/penetration-tests/_components/SplitView.tsx, line 154:

<comment>`aria-hidden` is applied to a container with focusable descendants; in create mode the run list can still be keyboard-focused despite being hidden from assistive tech.</comment>

<file context>
@@ -0,0 +1,255 @@
+  return (
+    <div className="pt-tokens flex h-[calc(100vh-4rem)] min-h-0 -m-4 md:-m-6">
+      <div
+        aria-hidden={isCreateMode}
+        className={isCreateMode ? 'pointer-events-none opacity-45' : ''}
+      >
</file context>

Suggested change

	aria-hidden={isCreateMode}
	inert={isCreateMode}

[cubic-dev-ai]

P2: Recent scan activity is filtered to completed runs only, so failed/cancelled recent scans are hidden from the "Recent scans" section.

Prompt for AI agents

Check if this issue is valid — if so, understand the root cause and fix it. At apps/app/src/app/(app)/[orgId]/security/penetration-tests/_components/OverviewPane.tsx, line 140:

<comment>Recent scan activity is filtered to completed runs only, so failed/cancelled recent scans are hidden from the "Recent scans" section.</comment>

<file context>
@@ -0,0 +1,259 @@
+  const lastScan = mostRecent(completed);
+  const avgDuration = avgDurationMs(completed);
+  const scansLast30d = countWithin(completed, 30 * 24 * 60 * 60 * 1000);
+  const recentScans = sortByUpdatedDesc(completed).slice(0, 6);
+  const staleTargets = computeStaleTargets(completed, targets);
+
</file context>

[cubic-dev-ai]

P2: The new-finding highlight baseline is initialized before issues finish loading, so the first fetched findings for a run can all be incorrectly marked as newly arrived.

Prompt for AI agents

Check if this issue is valid — if so, understand the root cause and fix it. At apps/app/src/app/(app)/[orgId]/security/penetration-tests/_components/RunningDetail.tsx, line 139:

<comment>The new-finding highlight baseline is initialized before issues finish loading, so the first fetched findings for a run can all be incorrectly marked as newly arrived.</comment>

<file context>
@@ -0,0 +1,177 @@
+  // On run change: prime `seenRef` with the issues already present so
+  // they don't all flash as newly-arrived. Bypass the next "newly
+  // landed" pass entirely for this run change.
+  if (lastRunIdRef.current !== runId) {
+    seenRef.current = new Set(issues.map((i) => i.id));
+    lastRunIdRef.current = runId;
</file context>

[cubic-dev-ai]

P2: completedAuditAt is set before the audit entry is durably written, so transient audit-write failures can permanently suppress completion auditing.

Prompt for AI agents

Check if this issue is valid — if so, understand the root cause and fix it. At apps/api/src/security-penetration-tests/security-penetration-tests.service.ts, line 544:

<comment>`completedAuditAt` is set before the audit entry is durably written, so transient audit-write failures can permanently suppress completion auditing.</comment>

<file context>
@@ -314,149 +427,224 @@ export class SecurityPenetrationTestsService {
+        providerRunId: data.pentestId,
+        completedAuditAt: null,
+      },
+      data: { completedAuditAt: new Date() },
+    });
+    if (claimed.count === 0) {
</file context>

[cubic-dev-ai]

P2: Do not include raw transport exception messages in the HTTP response body; this can leak internal infrastructure details.

Prompt for AI agents

Check if this issue is valid — if so, understand the root cause and fix it. At apps/api/src/security-penetration-tests/security-penetration-tests.service.ts, line 178:

<comment>Do not include raw transport exception messages in the HTTP response body; this can leak internal infrastructure details.</comment>

<file context>
@@ -81,22 +107,81 @@ interface WebhookRequestMetadata {
+      );
+      throw new HttpException(
+        {
+          error: `Provider call failed (${context}): ${errMessage}`,
+          source: 'transport',
+        },
</file context>

Suggested change

	error: `Provider call failed (${context}): ${errMessage}`,
	error: `Provider call failed (${context})`,

[cubic-dev-ai]

1 issue found across 16 files (changes from recent commits).

Prompt for AI agents (unresolved issues)

Check if these issues are valid — if so, understand the root cause of each and fix them. If appropriate, use sub-agents to investigate and fix each issue separately.


<file name="apps/app/src/app/(app)/[orgId]/frameworks/[frameworkInstanceId]/requirements/[requirementKey]/components/table/RequirementControlsTable.tsx">

<violation number="1" location="apps/app/src/app/(app)/[orgId]/frameworks/[frameworkInstanceId]/requirements/[requirementKey]/components/table/RequirementControlsTable.tsx:163">
P2: Avoid recomputing `getRequirementArtifactCounts` inside each table row; it repeatedly scans tasks and sorts evidence submissions per row.</violation>
</file>

_{Reply with feedback, questions, or to request a fix. Tag @cubic-dev-ai to re-run a review.}

[cubic-dev-ai]

P2: Avoid recomputing getRequirementArtifactCounts inside each table row; it repeatedly scans tasks and sorts evidence submissions per row.

Prompt for AI agents

Check if this issue is valid — if so, understand the root cause and fix it. At apps/app/src/app/(app)/[orgId]/frameworks/[frameworkInstanceId]/requirements/[requirementKey]/components/table/RequirementControlsTable.tsx, line 163:

<comment>Avoid recomputing `getRequirementArtifactCounts` inside each table row; it repeatedly scans tasks and sorts evidence submissions per row.</comment>

<file context>
@@ -104,42 +118,69 @@ export function RequirementControlsTable({
+              // Use the shared aggregator so per-control counts (especially
+              // documents) honour the same 6-month freshness rule as
+              // getControlStatus / getControlProgressPercent below.
+              const counts = getRequirementArtifactCounts(
+                [control],
+                tasks,
</file context>

[claudfuen]

🎉 This PR is included in version 3.36.0 🎉

The release is available on GitHub release

Your semantic-release bot 📦🚀