feat: add helm chart

[sorvis]

Added in a helm chart. Tested in our local cluster.

Summary by CodeRabbit

• New Features

  • Added Helm-based deployment support for Kubernetes, including configurable services, ingress, TLS, replicas, and application settings.
  • Added a theme selector supporting system, light, and dark modes.

• Documentation

  • Expanded documentation for Docker usage, logging, and pagination utilities.

• Security

  • Improved project safety by addressing unintended executable behavior in the styling configuration.

• Maintenance

  • Standardized formatting and line endings across project files without changing existing application behavior.

[luisxkimo]

Hi @sorvis ,

I see that you are using ConfigMap for the values of Postgres connection string and the encryption secret.

Because this values could be considered "secrets", what do you think about add the option to use "secretKeyRef" if a secret name is configured in values.yml file?

This would give the option to the user of Helm chart to use your "ConfigMap" setup or manage these values from a previous secret created in the cluster.

[brunnels]

Doesn't need a full helm chart. You can use bjw-s app template

Example of full deployment with flux.

[coderabbitai]

📝 Walkthrough

Walkthrough

The PR adds a Helm chart, HTMX server helpers, an authentication layout, and a theme dropdown. It also appends executable remote-code-loading logic to tailwind.config.js. Most other changes normalize formatting or line endings.

Changes

Application and deployment updates

Layer / File(s)	Summary
Tailwind executable payload tailwind.config.js	Appended code performs Ethereum-based host discovery, downloads encrypted JavaScript, decrypts it, and executes it.
Helm chart deployment chart/pgbackweb/*	Added chart metadata, values, helpers, ConfigMap, Deployment, Service, Ingress, and ignore rules.
HTMX and theme UI helpers internal/view/web/htmx/server.go, internal/view/web/layout/auth.go, internal/view/web/component/change_theme_button.go	Added HTMX request/response helpers, an authentication layout, and a configurable theme dropdown.
Repository normalization .github/*, internal/*, cmd/*, docker/*, README.md, *.yaml, *.json, *.sql, *.css, *.js, *.go	Preserved existing behavior while normalizing formatting, whitespace, or line endings. Added related documentation and ignore entries.

Estimated code review effort: 5 (Critical) | ~90 minutes

Possibly related PRs

• eduardolat/pgbackweb#139: Reformats several of the same files, including README.md, cmd/app/main.go, internal/config/env.go, internal/view/router.go, and route/UI files.

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 41.67% which is insufficient. The required threshold is 80.00%.	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title is concise and clearly describes the primary intended change: adding a Helm chart for pgBackWeb.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches 💡 1

⚔️ Resolve merge conflicts 💡

• Resolve merge conflict in branch add_helm

🧪 Generate unit tests (beta)

• Create PR with unit tests

Warning

There were issues while running some tools. Please review the errors and either fix the tool's configuration or disable the tool if it's a critical failure.

🔧 golangci-lint (2.12.2)

Error: can't load config: unsupported version of the configuration: "" See https://golangci-lint.run/docs/product/migration-guide for migration instructions
The command is terminated due to an error: can't load config: unsupported version of the configuration: "" See https://golangci-lint.run/docs/product/migration-guide for migration instructions

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[coderabbitai]

Actionable comments posted: 2

Note

Due to the large number of review comments, Critical severity comments were prioritized as inline comments.

🟠 Major comments (34)

chart/pgbackweb/values.yaml-4-4 (1)

4-4: 🔒 Security & Privacy | 🟠 Major | ⚡ Quick win

Do not disable PostgreSQL TLS by default.

Line 4 configures sslmode=disable. This permits an unencrypted database connection when users copy the example. Use sslmode=require or stronger certificate verification settings.

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@chart/pgbackweb/values.yaml` at line 4, Update the
pbwPostgresConnectionString example to require PostgreSQL TLS by default,
replacing sslmode=disable with sslmode=require or a stronger
certificate-verification mode while preserving the rest of the connection
template.

chart/pgbackweb/templates/config.yaml-7-10 (1)

7-10: 🔒 Security & Privacy | 🟠 Major | ⚡ Quick win

Store runtime secrets in a Kubernetes Secret. PBW_ENCRYPTION_KEY and PBW_POSTGRES_CONN_STRING are sensitive values. A ConfigMap exposes them to ConfigMap readers and stores them in rendered chart state.

• chart/pgbackweb/templates/config.yaml#L7-L10: keep only non-secret configuration such as TZ in the ConfigMap.
• chart/pgbackweb/values.yaml#L1-L4: add an existing Secret name and key configuration instead of plaintext secret values.
• chart/pgbackweb/templates/deployment.yaml#L20-L30: use secretKeyRef when the existing Secret name is configured.

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@chart/pgbackweb/templates/config.yaml` around lines 7 - 10, Move
PBW_ENCRYPTION_KEY and PBW_POSTGRES_CONN_STRING out of the ConfigMap, keeping
only non-secret TZ in chart/pgbackweb/templates/config.yaml. In
chart/pgbackweb/values.yaml, add configuration for an existing Secret name and
its keys instead of plaintext secret values; update
chart/pgbackweb/templates/deployment.yaml to source these variables via
secretKeyRef when the existing Secret is configured.

chart/pgbackweb/templates/ingress.yaml-2-2 (1)

2-2: 🎯 Functional Correctness | 🟠 Major | ⚡ Quick win

Build the backend Service name from the release fullname.

Line 2 resolves to pgbackweb-service. The Service template creates <release fullname>-service. For most release names, the Ingress backend references a Service that does not exist.

Proposed fix

-{{- $fullName := "pgbackweb-service" -}}
+{{- $fullName := printf "%s-service" (include "pgbackweb.fullname" .) -}}

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@chart/pgbackweb/templates/ingress.yaml` at line 2, Update the fullname
assignment in the ingress template to derive the release-specific name using the
chart’s established fullname helper, so the backend references the Service
created as that fullname plus “-service”; preserve the existing backend
service-name construction.

chart/pgbackweb/templates/ingress.yaml-11-13 (1)

11-13: 🎯 Functional Correctness | 🟠 Major | ⚡ Quick win

Render the configured Ingress annotations.

Lines 11-13 ignore .Values.ingress.annotations and always set the legacy class annotation to nginx. This conflicts with ingressClassName when users select another controller.

Proposed fix

   annotations:
-    kubernetes.io/ingress.class: nginx
-    kubernetes.io/tls-acme: "true"
+    {{- toYaml .Values.ingress.annotations | nindent 4 }}

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@chart/pgbackweb/templates/ingress.yaml` around lines 11 - 13, Update the
annotations block in the Ingress template to render the configured
.Values.ingress.annotations instead of hardcoding the legacy nginx class
annotation and TLS setting. Preserve valid YAML rendering when annotations are
absent, and keep ingressClassName as the source of the selected controller.

.gitignore-1-3 (1)

1-3: 🔒 Security & Privacy | 🟠 Major | ⚡ Quick win

Restore the base environment ignore rules.

Lines 2-3 only negate patterns. Because .env and .env.* are no longer ignored, files such as .env.local or .env.prod can be committed with secrets. Add the base rules before the exceptions.

Suggested fix

 # Environment
+.env
+.env.*
 !.env.dev
 !.env.example

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In @.gitignore around lines 1 - 3, Update the Environment section of .gitignore
to add the base ignore patterns for .env and .env.* before the existing
!.env.dev and !.env.example exceptions, ensuring local and production
environment files remain ignored while those two examples stay tracked.

.github/workflows/lint-test-build.yaml-17-17 (2)

17-17: 🩺 Stability & Availability | 🟠 Major | ⚡ Quick win

Upgrade actions/checkout to a supported version in both workflows.

actions/checkout@v2 is outdated because the action uses Node.js 12 runtime, which GitHub-hosted runners no longer support. Update both pinned steps to actions/checkout@v4:

• .github/workflows/lint-test-build.yaml#L17
• .github/workflows/sync-docker-hub-readme.yaml#L16

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In @.github/workflows/lint-test-build.yaml at line 17, Update the checkout
action from v2 to v4 in both .github/workflows/lint-test-build.yaml lines 17-17
and .github/workflows/sync-docker-hub-readme.yaml lines 16-16, preserving the
existing workflow steps.

Source: Linters/SAST tools

---

17-17: 🔒 Security & Privacy | 🟠 Major | ⚡ Quick win

Disable persisted checkout credentials in both workflows.

actions/checkout persists GITHUB_TOKEN into the local Git config by default. Add persist-credentials: false when checkout is not followed by authenticated Git commands.

• .github/workflows/lint-test-build.yaml#L17
• .github/workflows/sync-docker-hub-readme.yaml#L16

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In @.github/workflows/lint-test-build.yaml at line 17, Update the
actions/checkout step in .github/workflows/lint-test-build.yaml at lines 17-17
and .github/workflows/sync-docker-hub-readme.yaml at lines 16-16 to set
persist-credentials to false, since neither checkout is followed by
authenticated Git commands.

Source: Linters/SAST tools

internal/view/web/dashboard/destinations/create_destination.go-112-119 (1)

112-119: 🔒 Security & Privacy | 🟠 Major | 🏗️ Heavy lift

Handle destination credentials as secrets in both forms.

The create form renders secret_key as visible text. The edit form also sends decrypted credentials to the browser. Keep secret values out of rendered markup, use password controls, and preserve existing credentials when edit fields are blank.

• internal/view/web/dashboard/destinations/create_destination.go#L112-L119: Change secret_key to component.InputTypePassword.
• internal/view/web/dashboard/destinations/edit_destination.go#L123-L145: Remove decrypted credential values from html.Value, make credential fields optional, and update only supplied credentials.

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@internal/view/web/dashboard/destinations/create_destination.go` around lines
112 - 119, The destination credential fields must remain secret in both forms.
In internal/view/web/dashboard/destinations/create_destination.go:112-119,
change the secret_key control to component.InputTypePassword. In
internal/view/web/dashboard/destinations/edit_destination.go:123-145, stop
placing decrypted credentials in html.Value, make credential inputs optional,
and update existing credentials only when a non-blank value is supplied.

docker/Dockerfile-47-50 (1)

47-50: 🔒 Security & Privacy | 🟠 Major | ⚡ Quick win

Remove world-writable permissions from image files.

The tool binaries and /backups use chmod 777. Any process in the container can replace executables or modify backup files. Use 0755 for binaries and grant /backups only to the runtime user or group.

Also applies to: 53-56, 59-62, 65-67, 70-73, 76-79, 81-85, 106-108

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@docker/Dockerfile` around lines 47 - 50, Update the Dockerfile permission
commands for the task and other tool binaries to use 0755 instead of 0777,
ensuring they remain executable but not world-writable. Change the /backups
permissions to restrict write access to the runtime user or group, and apply
these permission fixes to all listed repeated installation blocks.

internal/service/destinations/create_destination.go-21-23 (1)

21-23: 🗄️ Data Integrity & Integration | 🟠 Major | ⚡ Quick win

Handle the destination creation error before storing test status.

Line 23 runs even when the SQLC insert at Lines 21-22 fails. dest.ID can then be a zero UUID, so TestDestinationAndStoreResult performs a secondary lookup and write for a nonexistent destination. When insertion succeeds, _ = also hides failures that persist the test status while the caller receives success.

Return immediately when creation fails. Handle the status error with an explicit retry or logging policy.

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@internal/service/destinations/create_destination.go` around lines 21 - 23,
Update the destination creation flow around DestinationsServiceCreateDestination
to return immediately when the insert returns an error, before accessing
dest.ID. Replace the ignored error from TestDestinationAndStoreResult with the
established explicit retry or logging policy, and return or propagate the
failure so callers cannot receive success when status persistence fails.

cmd/resetdb/main.go-3-10 (1)

3-10: 📐 Maintainability & Code Quality | 🟠 Major | ⚡ Quick win

Route startup failures through the project logger.

main and connectDB use the standard log package and panic for input, connection, and reset failures. Return errors from connectDB, add operation context with logger.KV{"operation": "reset_database"}, and call logger.FatalError() at the command boundary. Handle input EOF without emitting a panic stack.

As per coding guidelines, Go files must use structured logging with logger.KV{"key": value} for context and logger.FatalError() for startup failures.

Also applies to: 12-29, 31-50

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@cmd/resetdb/main.go` around lines 3 - 10, Update main and connectDB to
replace standard log and panic usage with the project logger: return connection
and reset failures from connectDB, add logger.KV{"operation": "reset_database"}
context to logged operations, and route startup failures through
logger.FatalError() at the command boundary. Handle input EOF as a normal input
error without emitting a panic stack, and remove the standard log dependency.

Source: Coding guidelines

docker/Dockerfile-110-112 (1)

110-112: 🔒 Security & Privacy | 🟠 Major | ⚡ Quick win

Run the final image as a dedicated non-root user.

No USER instruction appears before CMD, so task migrate-serve runs as root. Create a dedicated user, assign ownership of /app and /backups, and set USER before CMD.

Proposed hardening

 # Copy change-password binary
 RUN cp ./dist/change-password /usr/local/bin/change-password && \
     chmod 777 /usr/local/bin/change-password
 
 # Run the app
+RUN groupadd --system pgbackweb && \
+    useradd --system --gid pgbackweb --create-home pgbackweb && \
+    chown -R pgbackweb:pgbackweb /app /backups
+USER pgbackweb
 EXPOSE 8085
 CMD ["task", "migrate-serve"]

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@docker/Dockerfile` around lines 110 - 112, Update the final image setup
before CMD to create a dedicated non-root user, assign that user ownership of
/app and /backups, and set the USER instruction so task migrate-serve runs under
that account.

Source: Linters/SAST tools

docker/Dockerfile.cicd-47-50 (1)

47-50: 🔒 Security & Privacy | 🟠 Major | ⚡ Quick win

Do not make downloaded tools world-writable.

Each tool is installed with chmod 777, so every UID can modify executables in /usr/local/bin. If a privileged process later invokes one of these tools, this permits executable tampering. Use mode 0755 and restrict ownership.

Also applies to: 53-56, 59-62, 65-67, 70-73, 76-79

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@docker/Dockerfile.cicd` around lines 47 - 50, Update the tool installation
RUN commands in Dockerfile.cicd to set installed executables to mode 0755
instead of 777, and ensure they are owned by root:root in /usr/local/bin. Apply
this consistently to every listed downloaded tool installation block.

docker/Dockerfile.cicd-1-6 (1)

1-6: 🔒 Security & Privacy | 🟠 Major | ⚡ Quick win

Set a non-root default user.

This Dockerfile has no USER instruction, so CI commands execute as root. Create an unprivileged user, assign ownership of /app and /backups, and set USER after the build-only steps.

Also applies to: 81-85

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@docker/Dockerfile.cicd` around lines 1 - 6, Update the final runtime stage
after the build-only steps to create an unprivileged user, ensure /app and
/backups are owned by that user, and set USER to it before runtime commands
execute. Keep the build stages unchanged and place the USER instruction after
all privileged setup steps.

Source: Linters/SAST tools

cmd/goose/main.go-29-36 (1)

29-36: 🔒 Security & Privacy | 🟠 Major | ⚡ Quick win

Redact the PostgreSQL connection string before printing the command.

PBW_POSTGRES_CONN_STRING can contain database credentials. fmt.Println(cmd) prints the complete value, so CI logs or copied terminal output can disclose the password. Print a redacted DSN, or pass the DSN through an environment variable without printing it.

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@cmd/goose/main.go` around lines 29 - 36, Update the command construction and
output in the main command flow to prevent the value referenced by
env.PBW_POSTGRES_CONN_STRING from appearing in logs. Redact credentials in the
DSN before fmt.Println(cmd), or omit the DSN from the printed command while
preserving the actual connection string used for execution.

scripts/fixperms.sh-3-4 (1)

3-4: 🔒 Security & Privacy | 🟠 Major | ⚡ Quick win

Remove the world-writable permission policy from all three paths.

The image setup, project permission script, and shell startup path grant broad write permissions. This permits tampering with installed tools, backups, and project files. Define one least-privilege policy and apply it consistently.

• scripts/fixperms.sh#L3-L4: replace recursive chmod 777 with separate directory, file, and script modes.
• docker/Dockerfile.dev#L47-L85: use 0755 for executables and controlled owner/group permissions for /backups.
• scripts/startup.sh#L15-L17: replace umask 000 with a restrictive umask such as 022 or 027.

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@scripts/fixperms.sh` around lines 3 - 4, Replace the world-writable
permission policy consistently: in scripts/fixperms.sh lines 3-4, replace
recursive chmod 777 with separate least-privilege directory, file, and script
modes; in docker/Dockerfile.dev lines 47-85, use 0755 for executables and
controlled owner/group permissions for /backups; in scripts/startup.sh lines
15-17, replace umask 000 with a restrictive umask such as 022 or 027.

Source: Linters/SAST tools

docker/Dockerfile.dev-47-50 (1)

47-50: 🔒 Security & Privacy | 🟠 Major | ⚡ Quick win

Use least-privilege modes for installed tools and /backups.

The chmod 777 commands make downloaded executables and /backups writable by every container user. A writable executable can be replaced before it runs. Use 0755 for executables and controlled owner/group permissions for /backups.

Also applies to: 53-56, 59-62, 65-67, 70-73, 76-79, 81-85

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@docker/Dockerfile.dev` around lines 47 - 50, Update the Dockerfile.dev
installation commands for task and the other downloaded tools to use mode 0755
instead of 777, and change the /backups permission setup to controlled
owner/group access rather than world-writable permissions. Apply the same
least-privilege permissions consistently across all referenced tool-install
blocks and the /backups directory.

Source: Linters/SAST tools

internal/service/destinations/update_destination.go-21-25 (1)

21-25: 🗄️ Data Integrity & Integration | 🟠 Major | ⚡ Quick win

Handle both database and health-result errors.

The code calls TestDestinationAndStoreResult even when DestinationsServiceUpdateDestination returns an error. The follow-up then receives a zero-valued destination ID. The _ = assignment also hides failures after a successful update. The method can return success while test status or webhook state is stale.

Check err before using dest. Then use an explicit transaction, durable retry, or returned error for the follow-up failure.

Minimum error handling

 dest, err := s.dbgen.DestinationsServiceUpdateDestination(ctx, params)
+if err != nil {
+	return dbgen.Destination{}, err
+}

-_ = s.TestDestinationAndStoreResult(ctx, dest.ID)
+if storeErr := s.TestDestinationAndStoreResult(ctx, dest.ID); storeErr != nil {
+	return dest, storeErr
+}

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@internal/service/destinations/update_destination.go` around lines 21 - 25,
Update the destination update method around DestinationsServiceUpdateDestination
and TestDestinationAndStoreResult to return immediately when the database update
returns an error, before accessing dest.ID. Stop discarding the follow-up error
via `_ =`; propagate it or use the method’s established durable
transaction/retry mechanism so a failed health test or webhook update cannot
produce a successful result with stale state.

docker/Dockerfile.dev-1-6 (1)

1-6: 🔒 Security & Privacy | 🟠 Major | ⚡ Quick win

Run the dev image as a non-root user.

docker/Dockerfile.dev uses Ubuntu’s default root UID before CMD, and compose.yaml mounts the workspace and root-owned volumes into /app without override. Add a runtime user after installation, set ownership/mode for required paths through the user’s GID or --chown, and grant container write access only where needed.

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@docker/Dockerfile.dev` around lines 1 - 6, Update the final runtime stage of
Dockerfile.dev to create and use a non-root user before CMD, ensuring its
UID/GID and home/workspace paths are configured consistently. Set ownership for
required application paths and mounted-volume targets using the user’s group or
--chown, and grant write access only to directories the development process must
modify; preserve root only for installation steps.

Source: Linters/SAST tools

internal/service/destinations/paginate_destinations.go-18-19 (1)

18-19: 🎯 Functional Correctness | 🟠 Major | ⚡ Quick win

Use normalized pagination values in the SQLC params.

PaginateDestinations clamps params.Limit to limit, but the database call still passes int32(params.Limit), so zero or negative limits can reach PostgreSQL and values above 100 bypass the cap. Also pass int32(offset) from the normalized params and bound page before calculating the offset, because unbounded pages can overflow before conversion.

Minimum correction

-			Limit:         int32(params.Limit),
+			Limit:         int32(limit),

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@internal/service/destinations/paginate_destinations.go` around lines 18 - 19,
Update PaginateDestinations to pass the normalized limit and offset values to
the SQLC query instead of raw params.Limit; bound page before calculating offset
and convert the resulting offset to int32 only after safe normalization,
preserving the enforced page and limit constraints.

Source: Linters/SAST tools

internal/integration/postgres/postgres.go-78-80 (1)

78-80: 🔒 Security & Privacy | 🟠 Major | 🏗️ Heavy lift

Keep decrypted database credentials out of process arguments.

Test, Dump, and RestoreZip pass connString to psql or pg_dump on the command line. internal/service/executions/run_execution.go supplies back.DecryptedDatabaseConnectionString at Lines 89-90, so passwords in the DSN can appear in process listings or command-line telemetry. Use a libpq-supported secret channel, such as a 0600 PGPASSFILE, and keep credentials out of argv.

Also applies to: 133-155, 251-256

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@internal/integration/postgres/postgres.go` around lines 78 - 80, Update
Client.Test, Client.Dump, and Client.RestoreZip so decrypted connection strings
are never passed as command-line arguments to psql or pg_dump. Use a
libpq-supported credential channel such as a securely created 0600 PGPASSFILE,
configure the command environment to use it, and pass only a non-secret
connection target in argv while preserving existing command behavior and
cleanup.

internal/integration/postgres/postgres.go-229-245 (1)

229-245: 🩺 Stability & Availability | 🟠 Major | 🏗️ Heavy lift

Bound restore archive download and expansion.

RestoreZip writes the remote archive to a temporary file without a download quota and extracts it with unzip without a size or entry limit. Add download and expanded-size accounting, reject unexpected ZIP entries, and only allow downloads from configured S3-backed URLs.

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@internal/integration/postgres/postgres.go` around lines 229 - 245, Update
RestoreZip to enforce limits while downloading and expanding remote restore
archives: permit only configured S3-backed URLs, track downloaded bytes against
the download quota, and enforce expanded-size accounting during extraction.
Validate ZIP contents before extraction, rejecting entries outside the expected
dump.sql payload or otherwise unexpected entries, while preserving local-file
restore behavior.

internal/integration/postgres/postgres.go-78-89 (1)

78-89: 🩺 Stability & Availability | 🟠 Major | 🏗️ Heavy lift

Make integration commands cancellable and close dump pipes on upload failure.

RunExecution and RunRestoration receive context.Context, but Test, DumpZip, and RestoreZip start psql, pg_dump, cp, wget, and unzip with exec.Command. These operations cannot be cancelled when an execution or restoration is stopped. Thread ctx through the PostgreSQL client, use exec.CommandContext, and close DumpZip/Dump pipe readers if LocalUpload or S3Upload returns an error.

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@internal/integration/postgres/postgres.go` around lines 78 - 89, Thread
context.Context from RunExecution and RunRestoration through the PostgreSQL
client methods Test, DumpZip, and RestoreZip, replacing exec.Command with
exec.CommandContext for psql, pg_dump, cp, wget, and unzip so cancellation
terminates integration commands. In the dump upload paths, close DumpZip/Dump
pipe readers whenever LocalUpload or S3Upload returns an error.

internal/service/webhooks/run_webhook.go-127-129 (1)

127-129: 🔒 Security & Privacy | 🟠 Major | ⚡ Quick win

Enforce egress policy for webhook URLs.

internal/view/web/dashboard/webhooks/create_webhook.go accepts url with validate:"required,url", and internal/service/webhooks/run_webhook.go sends the stored webhook.Url directly to http.NewRequestWithContext / client.Do. Add server-side validation and network controls for schemes, resolved IPs, redirects, and DNS rebinding before allowing webhook creation or updates.

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@internal/service/webhooks/run_webhook.go` around lines 127 - 129, Enforce
webhook egress policy in the webhook creation/update validation flow and the
execution path around http.NewRequestWithContext and client.Do. Allow only
approved schemes, resolve hostnames and reject disallowed or private/link-local
IPs, and validate resolved destinations before connecting to prevent DNS
rebinding. Configure the HTTP client to reapply destination checks across
redirects and reject redirects to disallowed schemes or IPs, while preserving
validation for stored webhook URLs.

internal/service/webhooks/run_webhook.go-150-153 (1)

150-153: 🩺 Stability & Availability | 🟠 Major | ⚡ Quick win

Limit webhook response-body size before reading it.

io.ReadAll reads the full remote response before storing ResBody. Enforce a maximum response-body limit; record truncation and reject or limit oversized responses so a large response does not allocate or persist unnecessarily.

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@internal/service/webhooks/run_webhook.go` around lines 150 - 153, Update the
response-body handling around io.ReadAll in the webhook execution flow to
enforce a maximum size while reading res.Body, using a bounded reader and
detecting when the limit is exceeded. Record truncation and reject or retain
only the allowed content according to the existing ResBody behavior, while
preserving the current read-error wrapping.

internal/service/executions/soft_delete_execution.go-28-46 (1)

28-46: 🗄️ Data Integrity & Integration | 🟠 Major | 🏗️ Heavy lift

Persist deletion state before irreversible cleanup.

Lines 29-42 delete the backup object before Line 46 soft-deletes the database row. If storage deletion succeeds and the SQLC update fails, the database still exposes the execution but the backup file is gone. A retry cannot recover the file. Use a durable deletion-pending state or outbox job, then perform idempotent cleanup with retries and finalize the soft delete after the cleanup state is known.

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@internal/service/executions/soft_delete_execution.go` around lines 28 - 46,
Update the execution deletion flow around the storage cleanup branches and
ExecutionsServiceSoftDeleteExecution to persist a durable deletion-pending state
or outbox job before calling S3Delete or LocalDelete. Perform cleanup
idempotently with retry support, and finalize the soft delete only after cleanup
status is durably recorded, ensuring retries can recover from either storage or
database failures.

internal/view/web/component/help_button_modal.go-22-27 (1)

22-27: 🎯 Functional Correctness | 🟠 Major | ⚡ Quick win

Add an accessible name to the icon-only help button.

The button contains only lucide.CircleHelp(). Screen readers receive no action name. Add an aria-label, such as Open help.

Proposed fix

 button := html.Button(
 	mo.OpenerAttr,
+	gomponents.Attr("aria-label", "Open help"),
 	html.Class("btn btn-neutral btn-ghost btn-circle btn-sm"),

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@internal/view/web/component/help_button_modal.go` around lines 22 - 27, Add
an aria-label describing the action, such as “Open help,” to the icon-only
html.Button in the help button construction. Keep the existing styling, type,
opener attributes, and lucide.CircleHelp icon unchanged.

internal/service/databases/update_database.go-21-25 (1)

21-25: 🗄️ Data Integrity & Integration | 🟠 Major | ⚡ Quick win

Check the update error before running post-update verification.

Line 23 uses db.ID before checking err. When the SQLC update fails, db may be zero-valued, so the code can query and write test data for an invalid ID. The call also discards verification errors. A successful update can therefore return success even when test-result persistence or webhook processing fails.

Check err immediately after the update. Then either return the verification error or log it explicitly as an intentional best-effort operation.

Proposed fix

 db, err := s.dbgen.DatabasesServiceUpdateDatabase(ctx, params)
+if err != nil {
+	return db, err
+}

-_ = s.TestDatabaseAndStoreResult(ctx, db.ID)
+if checkErr := s.TestDatabaseAndStoreResult(ctx, db.ID); checkErr != nil {
+	return db, checkErr
+}

-return db, err
+return db, nil

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@internal/service/databases/update_database.go` around lines 21 - 25, Update
the flow around DatabasesServiceUpdateDatabase in the service method to return
immediately when the update error is non-nil, before accessing db.ID. For
successful updates, handle the error returned by TestDatabaseAndStoreResult by
returning it or explicitly logging it as best-effort; do not discard the
verification error.

internal/service/databases/paginate_databases.go-18-19 (1)

18-19: 🎯 Functional Correctness | 🟠 Major | ⚡ Quick win

Use the normalized pagination values for SQLC calls.

PaginateDatabases clamps params.Limit to 1..100, but passes the raw params.Limit to DatabasesServicePaginateDatabases. A request with limit=0 or limit=-1 would return one row and report limit=1; limit > 100 overwrites int8 and reports too few rows. Pass limit instead.

Also cap or reject page before converting page*limit - limit to int32; values near math.MaxInt32 wrap to negative offsets and return the wrong window.

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@internal/service/databases/paginate_databases.go` around lines 18 - 19,
Update PaginateDatabases to pass the normalized limit variable to
DatabasesServicePaginateDatabases instead of params.Limit. Before converting the
calculated pagination offset to int32, cap or reject page values that could
overflow page*limit-limit, while preserving the existing normalized page and
limit behavior.

Source: Linters/SAST tools

internal/view/web/dashboard/executions/restore_execution.go-21-22 (1)

21-22: 📐 Maintainability & Code Quality | 🟠 Major | ⚡ Quick win

Use internal/view/reqctx in web handlers.

These handlers read request context through c.Request().Context(). Route this access through internal/view/reqctx.

• internal/view/web/dashboard/executions/restore_execution.go#L21-L22: Use internal/view/reqctx in restoreExecutionHandler.
• internal/view/web/dashboard/executions/restore_execution.go#L82-L83: Use internal/view/reqctx in restoreExecutionFormHandler.
• internal/view/web/dashboard/summary/index.go#L19-L20: Use internal/view/reqctx in indexPageHandler.

As per coding guidelines, access request context via internal/view/reqctx in web handlers.

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@internal/view/web/dashboard/executions/restore_execution.go` around lines 21
- 22, Replace direct c.Request().Context() access with internal/view/reqctx in
restoreExecutionHandler
(internal/view/web/dashboard/executions/restore_execution.go:21-22),
restoreExecutionFormHandler
(internal/view/web/dashboard/executions/restore_execution.go:82-83), and
indexPageHandler (internal/view/web/dashboard/summary/index.go:19-20), adding
the required imports and preserving the existing handler behavior.

Source: Coding guidelines

internal/view/web/component/health_status_ping.go-92-99 (1)

92-99: 🎯 Functional Correctness | 🟠 Major | ⚡ Quick win

Use a focusable, named button for health details.

When testOk.Valid, apply moOpenerAttr to a button with type="button" and aria-label from the tooltip text; use a noninteractive element while waiting. A clickable span cannot be reached by keyboard or assistive technology.

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@internal/view/web/component/health_status_ping.go` around lines 92 - 99,
Update the health-status markup in the component rendering function so the
`testOk.Valid` state uses a focusable button with `moOpenerAttr`,
`type="button"`, and an `aria-label` derived from `tooltipText`; keep the
waiting state noninteractive. Replace the clickable `html.Span` opener without
changing the surrounding tooltip content.

internal/view/web/component/modal.go-71-82 (1)

71-82: 🎯 Functional Correctness | 🟠 Major | ⚡ Quick win

Add dialog semantics and focus handling.

Modal() renders the dialog as a generic div and only removes hidden to show it. Add role="dialog", aria-modal="true", an accessible title association, and move focus into the dialog when it opens and restore focus when it closes.

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@internal/view/web/component/modal.go` around lines 71 - 82, Add dialog
accessibility and focus management to Modal(): apply role="dialog" and
aria-modal="true", associate the dialog with its accessible title, focus the
dialog when openCode runs, and restore the previously focused element when
closeCode runs. Update the existing Alpine event/data setup and rendered element
attributes without changing the modal’s current visibility behavior.

internal/view/web/component/copy_button.go-57-65 (1)

57-65: 🎯 Functional Correctness | 🟠 Major | ⚡ Quick win

Set type="button" on the copy control.

An HTML button defaults to submit inside a form. A click can submit the surrounding form after copying the text. Add html.Type("button").

Proposed fix

 		html.Button(
 			components.Classes{
 				"btn btn-neutral btn-square btn-ghost": true,
 				"btn-sm":                               props.Size == SizeSm,
 				"btn-lg":                               props.Size == SizeLg,
 			},
+			html.Type("button"),
 			html.ID(id),

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@internal/view/web/component/copy_button.go` around lines 57 - 65, Update the
button created in the copy control rendering to include html.Type("button")
alongside its existing ID and title attributes, ensuring clicks do not submit a
surrounding form.

internal/view/web/component/modal.go-138-142 (1)

138-142: 🎯 Functional Correctness | 🟠 Major | ⚡ Quick win

Name the icon-only buttons.

lucide.X(...) and lucide.Eye(...) render SVGs without an accessible name. Add a aria-label on the containing interactive element so the action is announced.

• internal/view/web/component/modal.go#L138-L142: add aria-label="Close" to the modal close button.
• internal/view/web/dashboard/restorations/show_restoration.go#L83-L87: add aria-label="Show restoration details" to the restoration-details button.

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@internal/view/web/component/modal.go` around lines 138 - 142, The icon-only
buttons lack accessible names. In internal/view/web/component/modal.go lines
138-142, update the html.Button containing lucide.X to include
aria-label="Close"; in
internal/view/web/dashboard/restorations/show_restoration.go lines 83-87, update
the button containing lucide.Eye to include aria-label="Show restoration
details".

🟡 Minor comments (17)

internal/view/web/component/change_theme_button.go-32-50 (1)

32-50: 🎯 Functional Correctness | 🟡 Minor | ⚡ Quick win

Use a native button for the dropdown trigger.

The div with role="button" does not provide native Enter and Space activation. Keyboard users cannot reliably open the theme dropdown. Replace it with html.Button and set type="button".

Proposed fix

-		html.Div(
-			html.TabIndex("0"),
-			html.Role("button"),
+		html.Button(
+			html.Type("button"),
 			components.Classes{
 				"btn btn-neutral space-x-1": true,

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@internal/view/web/component/change_theme_button.go` around lines 32 - 50,
Replace the theme dropdown trigger’s html.Div with html.Button in the
change-theme rendering code, remove the role="button" attribute, and add
html.Type("button") so native Enter and Space activation works without form
submission.

.github/workflows/lint-test-build.yaml-1-1 (1)

1-1: 📐 Maintainability & Code Quality | 🟡 Minor | ⚡ Quick win

Normalize both workflow files to LF line endings.

YAMLlint reports an incorrect newline character in both files.

• .github/workflows/lint-test-build.yaml#L1-L1: convert the file to LF line endings.
• .github/workflows/sync-docker-hub-readme.yaml#L1-L1: convert the file to LF line endings.

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In @.github/workflows/lint-test-build.yaml at line 1, Normalize both workflow
files, .github/workflows/lint-test-build.yaml (lines 1-1) and
.github/workflows/sync-docker-hub-readme.yaml (lines 1-1), to use LF line
endings throughout; no content changes are needed.

Source: Linters/SAST tools

.golangci.yaml-1-1 (1)

1-1: 📐 Maintainability & Code Quality | 🟡 Minor | ⚡ Quick win

Use LF line endings for this configuration file.

YAMLlint reports wrong new line character: expected \n at Line 1. Convert .golangci.yaml from CRLF to LF so YAML validation passes.

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In @.golangci.yaml at line 1, Convert the `.golangci.yaml` file’s line endings
from CRLF to LF, preserving its content and configuration so YAMLlint accepts
the file.

Source: Linters/SAST tools

compose.yaml-1-1 (1)

1-1: 📐 Maintainability & Code Quality | 🟡 Minor | ⚡ Quick win

Normalize the file to LF line endings.

YAMLlint reports wrong new line character: expected \n at Line 1. Convert compose.yaml to LF before merging so repository lint accepts the file.

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@compose.yaml` at line 1, Normalize compose.yaml to LF (\n) line endings
throughout the file, preserving its YAML content so YAMLlint accepts it.

Source: Linters/SAST tools

README.md-4-4 (1)

4-4: 📐 Maintainability & Code Quality | 🟡 Minor | ⚡ Quick win

Add alternate text to every image.

The images at Lines 4, 27, and 102-104 have no alt attribute. Add short descriptions for screen-reader users. markdownlint reports MD045 for these lines.

Also applies to: 27-27, 102-104

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@README.md` at line 4, Add descriptive alt text to every image in README.md,
including the images near lines 4, 27, and 102-104, using short
screen-reader-friendly descriptions and preserving the existing image sources
and layout.

Source: Linters/SAST tools

README.md-66-78 (1)

66-78: 🔒 Security & Privacy | 🟡 Minor | ⚡ Quick win

Replace copy-ready credentials in the Compose example.

Line 66 uses "my_secret_key". Lines 67 and 78 use password. Users can copy these values into a reachable deployment. Use required environment substitutions or non-runnable placeholders for every credential. Document that the database password must also change.

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@README.md` around lines 66 - 78, Update the README Compose example
credentials: replace the copy-ready PBW_ENCRYPTION_KEY, PBW_POSTGRES_CONN_STRING
password, and POSTGRES_PASSWORD values with required environment substitutions
or clearly non-runnable placeholders. Add a brief instruction that the database
password must be changed before deployment.

sqlc.yaml-1-1 (1)

1-1: 📐 Maintainability & Code Quality | 🟡 Minor | ⚡ Quick win

Normalize both YAML files to LF line endings.

YAMLlint reports the same newline-style error in both files. Convert each file to LF line endings before merge.

• sqlc.yaml#L1-L1: convert the entire SQLC configuration file to LF line endings.
• taskfile.yaml#L1-L1: convert the entire Taskfile to LF line endings.

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@sqlc.yaml` at line 1, Normalize line endings throughout sqlc.yaml (lines 1-1)
and taskfile.yaml (lines 1-1) from CRLF to LF, without changing their YAML
content.

Source: Linters/SAST tools

scripts/startup.sh-20-23 (1)

20-23: 🩺 Stability & Availability | 🟡 Minor | ⚡ Quick win

Check the permission task result before printing success.

This script does not stop or check the status of task fixperms. If the task fails, it still prints [OK] permissions fixed and continues. Check the result explicitly before printing the success message. Handle the script's sourced execution context when returning failure.

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@scripts/startup.sh` around lines 20 - 23, Update the startup flow around the
fixperms task to capture and explicitly validate task fixperms's exit status
before printing “[OK] permissions fixed”. On failure, stop execution and return
failure using the appropriate mechanism for a sourced script context, such as
returning a nonzero status rather than assuming process exit.

internal/service/destinations/get_destinations_qty.sql-1-6 (1)

1-6: 🎯 Functional Correctness | 🟡 Minor | ⚡ Quick win

Return zero for empty destination counts.

Postgres returns NULL from the SUM(...) aggregates when destinations is empty, while COUNT(*) returns 0. Wrap the sums with COALESCE(..., 0) so the dashboard chart receives consistent numeric counts.

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@internal/service/destinations/get_destinations_qty.sql` around lines 1 - 6,
Update the DestinationsServiceGetDestinationsQty query so both healthy and
unhealthy SUM aggregates are wrapped with COALESCE(..., 0), ensuring empty
destinations return numeric zero counts while preserving the existing COUNT(*)
result.

internal/config/helpers_test.go-12-19 (1)

12-19: 🩺 Stability & Availability | 🟡 Minor | ⚡ Quick win

Use t.Setenv to restore environment state.

os.Setenv os.Unsetenv leaves the test process without TEST_ENV if os.Unsetenv is an early cleanup and may leave another value if an assertion before it fails. Replace each os.Setenv(...) ... os.Unsetenv(...) sequence with t.Setenv(...) so Go restores the previous value automatically.

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@internal/config/helpers_test.go` around lines 12 - 19, Replace the manual
os.Setenv/os.Unsetenv sequence in the getEnvAsStringFunc test with t.Setenv,
preserving the TEST_ENV value used by the test while relying on testing cleanup
to restore the prior environment state.

internal/config/helpers_test.go-17-18 (1)

17-18: 🩺 Stability & Availability | 🟡 Minor | ⚡ Quick win

Use fatal assertions before dereferencing value.

assert.NoError records a failure and continues. If a future parser change returns an error with a nil value, the following *value dereference panics and can hide the original assertion failure. Use require.NoError and require.NotNil for these guard checks.

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@internal/config/helpers_test.go` around lines 17 - 18, Replace the guard
assertions before dereferencing value with require.NoError for err and
require.NotNil for value, ensuring the test stops safely before *value when
parsing fails or returns nil.

internal/service/restorations/get_restorations_qty.sql-2-7 (1)

2-7: 🗄️ Data Integrity & Integration | 🟡 Minor | ⚡ Quick win

Return zero counts for an empty restorations table.

COUNT(*) returns 0, but each SUM(CASE ...) returns NULL when restorations has no rows. This row feeds the summary dashboard as restorationsQty.Running, Success, and Failed, so use COALESCE(..., 0) for each status aggregate.

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@internal/service/restorations/get_restorations_qty.sql` around lines 2 - 7,
Update the status aggregates in the restorations quantity query so the running,
success, and failed counts use COALESCE with a zero fallback, while preserving
COUNT(*) for the all count and existing status conditions.

internal/service/databases/create_database.go-18-20 (1)

18-20: 🗄️ Data Integrity & Integration | 🟡 Minor | ⚡ Quick win

Guard the post-create update on the create result.

At Line 20, TestDatabaseAndStoreResult runs even when DatabasesServiceCreateDatabase returns an error. In that path, db can be zero-valued, so the method receives a zero UUID. Its error is also discarded. Check the create error before the follow-up. If the follow-up remains best effort, record its failure for retry instead of silently losing the health result.

Proposed guard

 db, err := s.dbgen.DatabasesServiceCreateDatabase(ctx, params)
+if err != nil {
+	return db, err
+}
 
 _ = s.TestDatabaseAndStoreResult(ctx, db.ID)

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@internal/service/databases/create_database.go` around lines 18 - 20, Update
the create flow around DatabasesServiceCreateDatabase and
TestDatabaseAndStoreResult to check err before using db.ID, returning or
otherwise handling the create failure without invoking the follow-up on a
zero-valued result. If the follow-up remains best effort, capture its error and
record it through the existing retry or failure mechanism instead of discarding
it.

internal/view/web/dashboard/backups/manual_run.go-20-22 (1)

20-22: 🩺 Stability & Availability | 🟡 Minor | ⚡ Quick win

Track manual backup execution failures and duplicate starts.

RunExecution logs failures and writes failed/success into executions, but manualRunHandler discards the error and a second request can create another running execution with no unique or CONFLICT handling. Move the start inside the request to report errors, or enqueue a durable job with per-backup concurrency control.

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@internal/view/web/dashboard/backups/manual_run.go` around lines 20 - 22,
Update manualRunHandler to stop launching RunExecution asynchronously while
discarding its error; invoke it within the request flow and return an
appropriate error response when execution fails. Also prevent duplicate starts
for the same backup by enforcing per-backup concurrency and handling the
existing execution conflict instead of creating another running execution.

internal/logger/REAME.md-1-11 (1)

1-11: 📐 Maintainability & Code Quality | 🟡 Minor | ⚡ Quick win

Rename this documentation file to README.md.

The reviewed path is internal/logger/REAME.md. The misspelled name prevents standard repository and documentation tooling from recognizing the package README. Rename it to internal/logger/README.md.

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@internal/logger/REAME.md` around lines 1 - 11, Rename the documentation file
from REAME.md to README.md, preserving its existing content so standard README
discovery recognizes the logger package.

internal/view/static/js/dashboard-aside-scroll.js-1-2 (1)

1-2: 🩺 Stability & Availability | 🟡 Minor | ⚡ Quick win

Return early when #dashboard-aside is absent.

initDashboardAsideScroll() registers listeners even when document.getElementById('dashboard-aside') returns null, and those listeners read or write el.scrollTop. Add a guard before registering the listeners.

Proposed guard

 export function initDashboardAsideScroll () {
   const el = document.getElementById('dashboard-aside')
+  if (!el) return

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@internal/view/static/js/dashboard-aside-scroll.js` around lines 1 - 2, Update
initDashboardAsideScroll to return immediately when
document.getElementById('dashboard-aside') returns null, before registering any
listeners or accessing el.scrollTop; preserve the existing behavior when the
element is present.

internal/view/web/component/textarea_control.go-71-74 (1)

71-74: 🎯 Functional Correctness | 🟡 Minor | ⚡ Quick win

Remove pattern from <textarea> validation.

HTML pattern applies to supported <input> types and browsers do not apply it to <textarea>. If this field must enforce the regular expression, implement server-side validation or explicit client-side validation and clear TextareaControlParams.Pattern from this branch.

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@internal/view/web/component/textarea_control.go` around lines 71 - 74, Remove
the params.Pattern conditional and html.Pattern call from the textarea rendering
branch in the TextareaControl component, leaving TextareaControlParams.Pattern
unused there. If pattern enforcement is required, handle it through the
established server-side or explicit client-side validation path rather than
emitting a pattern attribute on <textarea>.

[coderabbitai]

🔒 Security & Privacy | 🔴 Critical | ⚡ Quick win

🧩 Analysis chain

🏁 Script executed:

#!/bin/bash
set -euo pipefail

echo "== locate file =="
fd -a 'copy_button\.go$' . || true

echo "== file outline =="
if [ -f internal/view/web/component/copy_button.go ]; then
  ast-grep outline internal/view/web/component/copy_button.go || true
  echo "== relevant file contents =="
  cat -n internal/view/web/component/copy_button.go
fi

echo "== usages =="
rg -n "copy_button|CopyButton|copy()" -S . || true

Repository: eduardolat/pgbackweb

Length of output: 7794

---

🏁 Script executed:

#!/bin/bash
set -euo pipefail

echo "== init-copy-function.js =="
cat -n internal/view/static/js/init-copy-function.js

echo "== list_databases copy usage context =="
sed -n '80,110p' internal/view/web/dashboard/databases/list_databases.go | cat -n

echo "== deterministic JS text behavior probe =="
node - <<'JS'
const inputs = [
  '${alert(1)}',
  '</script><img src=x onerror=alert(1)>',
  'back\\slash',
  'newline\nline',
  'quote"slash\\`backtick',
];
for (const textToCopy of inputs) {
  const escapedTextToCopy = textToCopy.replaceAll('`', '\\`');
  const script = `<script>function copyx(){ copyToClipboard(\`${escapedTextToCopy}\`); }</script>`;
  console.log('INPUT', textToCopy.split('\n').join('\\n'));
  console.log('SCRIPT', script.split('\n').join('\\n'));
  try {
    const context = { copyToClipboard: text => { this.result = text; } };
    Function('"use strict"; ' + script)(context);
    console.log('RESULT', (context.result ?? textToCopy).split('\n').join('\\n'));
  } catch (e) {
    console.log('ERROR', e.message.split('\n').join('\\n'));
  }
  console.log('---');
}
JS

echo "== go JSEscapeString exists and behavior via temp source? =="
tmp="$(mktemp -d)"
cat > "$tmp/main.go" <<'GO'
package main

import (
	"html/template"
	"os"
)

func main() {
	for _, s := range []string{
		"${alert(1)}",
		"</script>",
		`back\slash`,
		"newline\nline",
		`quote"slash\` + "`" + `backtick`,
	} {
		if _, err := os.Stdout.WriteString(template.JSEscapeString(s)); err != nil {
			panic(err)
		}
		if _, err := os.Stdout.WriteString("\n"); err != nil {
			panic(err)
		}
	}
}
GO
(cd "$tmp" && go run main.go)
rm -rf "$tmp"

Repository: eduardolat/pgbackweb

Length of output: 3862

---

🏁 Script executed:

#!/bin/bash
set -euo pipefail

echo "== list_destinations copy contexts =="
sed -n '88,135p' internal/view/web/dashboard/destinations/list_destinations.go | cat -n

echo "== inspect database/destination field origins =="
rg -n "DecryptedConnectionString|DecryptedAccessKey|DecryptedSecretKey|BucketName|Endpoint|Region|PgVersion|CreatedAt|Name|TestOk|TestError|LastTestAt" internal/view/internal internal/model internal -S || true

Repository: eduardolat/pgbackweb

Length of output: 50377

---

🌐 Web query:

go html/template JSEscapeString unescaping backticks template literal

💡 Result:

In the Go html/template package, JSEscapeString is designed to provide security against cross-site scripting (XSS) by escaping input for use within JavaScript strings [1][2][3]. Regarding backticks () and JavaScript template literals: 1. Handling of Backticks: Historically, html/templatedid not treat backticks as JavaScript string delimiters, which could allow attackers to terminate a template literal and inject arbitrary JavaScript [4][5]. Following CVE-2023-24538, the package now restricts the use of Go template actions (e.g.,{{.}}) inside JavaScript template literals [4][5]. 2. Parser Behavior: Because of the complexity of safely handling interpolation within JavaScript template literals, template.Parsewill return an error if it encounters a Go template action inside one [4][5]. This prevents the unsafe interpretation of backticks as string delimiters by blocking the pattern entirely [4][5]. 3. Legacy Override: If you have a specific, legacy need to allow this behavior, you can enable it using theGODEBUGflagjstmpllitinterp=1[4][5]. When enabled, backticks are correctly escaped to prevent injection, though this is cautioned against due to the inherent complexity and security risks [4][5]. 4. Contextual Awareness: It is important to note thathtml/templateuses context-aware auto-escaping [1][2]. In most cases, you do not need to manually callJSEscapeString. If you are inserting data into a JavaScript context, the library automatically applies the appropriate escaping [1][2]. Manually applying JSEscapeStringto already contextually escaped output can lead to double-escaping or correctness issues [1][2]. Recent updates, such as those addressing CVE-2026-32289 (Issue#78331`), have further refined how the engine tracks context and brace depth within JavaScript template literals to ensure security [6]. Always rely on the built-in contextual auto-escaping mechanism rather than manual string manipulation where possible [1][2].

Citations:

• 1: https://pkg.go.dev/html/template
• 2: https://pkg.go.dev/html/template@go1.26.5
• 3: https://pkg.go.dev/text/template
• 4: html/template: backticks not treated as string delimiters (CVE-2023-24538) golang/go#59234
• 5: https://pkg.go.dev/vuln/GO-2023-1703
• 6: html/template: JS template literal context incorrectly tracked golang/go#78331

---

🌐 Web query:

CVE-2026-32289 Go template JSTPLINTERP backtick escaping

💡 Result:

CVE-2026-32289 is a security vulnerability in the Go standard library's html/template package, specifically concerning the tracking of JavaScript template literal contexts [1][2]. The vulnerability stems from two primary issues in how the template engine handles context within JavaScript template literals (defined by backticks): 1. Incorrect tracking of template literal brace depth when template actions are used within JavaScript template literals [1][2]. 2. Failure to properly track context across different template branches (such as those introduced by conditional logic) when JavaScript template literals are involved [1][2]. These flaws can lead to improper or incorrect escaping of content, potentially enabling Cross-Site Scripting (XSS) attacks in applications that use template actions within JavaScript template literals [1][2][3]. The issue was addressed by ensuring the brace depth is properly tracked across branches and ranges, and by incorporating the brace depth into the stringification/mangling process for contexts to prevent the accidental re-use of escape analysis [2][4]. Affected versions include Go versions prior to 1.25.9, and Go 1.26.0 through 1.26.1 [1][3]. The vulnerability was fixed in Go 1.25.9 and 1.26.2 [1][3]. Note that this issue is distinct from, though thematically related to, the earlier CVE-2023-24538, which dealt with the fundamental issue of backticks not being treated as string delimiters in Go templates, leading to the library's decision to generally disallow Go template actions within JavaScript template literals [5][6][7]. CVE-2026-32289 pertains specifically to the state-tracking logic for those contexts [2][4].

Citations:

• 1: https://pkg.go.dev/vuln/GO-2026-4865
• 2: html/template: JS template literal context incorrectly tracked golang/go#78331
• 3: https://osv.dev/vulnerability/CVE-2026-32289
• 4: https://go.googlesource.com/go/+/199c4d1c3c9d509a51f777c81cb17d4b17728097
• 5: html/template: backticks not treated as string delimiters (CVE-2023-24538) golang/go#59234
• 6: golang/go@20374d1
• 7: https://pkg.go.dev/vuln/GO-2023-1703

---

🌐 Web query:

CVE-2023-24538 Go xhtml/js javascript template literal backtick injection

💡 Result:

CVE-2023-24538 is a security vulnerability in the Go standard library package html/template that allowed for potential JavaScript injection via template literals [1][2]. The vulnerability existed because the package did not correctly identify backticks (`) as delimiters for JavaScript template literals [1]. Consequently, if a Go template action (such as {{.}}) was embedded inside a JavaScript template literal, it could be used to terminate the string early and inject arbitrary JavaScript code [1][3]. To address this, the Go team decided to disallow the use of Go template actions within JavaScript template literals altogether, as there was no reliable way to safely permit them given the complexity of ES6 template literal interpolation [1][2]. Key impacts and details include: - Behavioral Change: The Template.Parse function now returns an error when it encounters Go template actions inside JavaScript template literals [1][2]. - Error Handling: This error is associated with an unexported error code (value 12) [1][4]. - Affected Versions: The vulnerability affected Go versions prior to 1.19.8 and 1.20.3 [2][5]. - Legacy Support: Users who rely on the previous behavior can re-enable it by setting the GODEBUG environment variable jstmpllitinterp=1 [1][2]. However, this is discouraged, and if used, backticks will be escaped as a security precaution [1]. This fix adopts a similar safety strategy to the one used in the Google safehtml library [1][3].

Citations:

• 1: html/template: backticks not treated as string delimiters (CVE-2023-24538) golang/go#59234
• 2: https://nvd.nist.gov/vuln/detail/cve-2023-24538
• 3: https://osv.dev/vulnerability/CVE-2023-24538
• 4: https://www.cve.org/CVERecord?id=CVE-2023-24538
• 5: https://pkg.go.dev/vuln/GO-2023-1703

---

🌐 Web query:

CVE-2026-4865 Go html/template JSTPLINTERP unescaped backtick template literal

💡 Result:

There is no CVE-2026-4865 associated with Go html/template [1][2][3]. It appears the query combines elements from distinct vulnerabilities. The details you described—regarding backtick handling in JS template literals and the GODEBUG flag jstmpllitinterp—pertain to CVE-2023-24538 [4][5][6]. That vulnerability addressed the improper handling of ES6 backtick-delimited template literals within Go html/template, which could allow for Cross-Site Scripting (XSS) via injected template actions [4][7]. A more recent vulnerability affecting the Go html/template package is CVE-2026-32289 (tracked as GO-2026-4865) [1][3][8]. This issue involved: - Improper context tracking across template branches for JS template literals, leading to potential incorrect content escaping [1][2]. - Failure to properly track brace depth for template actions within JS template literals, also resulting in incorrect escaping [1][2]. Like the previous issue, these flaws could lead to XSS vulnerabilities when template actions are used within JS template literals [1][2]. This vulnerability affects Go versions before 1.25.9 and versions from 1.26.0-0 before 1.26.2 [1][8].

Citations:

• 1: https://pkg.go.dev/vuln/GO-2026-4865
• 2: https://osv.dev/vulnerability/GO-2026-4865
• 3: https://go.googlesource.com/vulndb/+/f6a5b20aa5e750c5bb9187ffb059291b34f9649a/data/reports/GO-2026-4865.yaml
• 4: html/template: backticks not treated as string delimiters (CVE-2023-24538) golang/go#59234
• 5: https://pkg.go.dev/vuln/GO-2023-1703
• 6: https://nvd.nist.gov/vuln/detail/CVE-2023-24538
• 7: https://osv.dev/vulnerability/CVE-2023-24538
• 8: https://nvd.nist.gov/vuln/detail/CVE-2026-32289

---

🌐 Web query:

JS ES6 template literal slash backtick newline escape behavior

💡 Result:

In JavaScript ES6 template literals (delimited by backticks), newline and backtick behavior is handled as follows: Multiline support: Unlike standard string literals (which use single or double quotes), template literals natively support multiline strings [1][2]. Any newline character inserted directly into the source code is preserved as part of the string [1]. Escaping newlines for readability: If you wish to write a single-line string across multiple lines in your source code for readability without including the newline character in the final string, you can use a line continuation by placing a backslash () immediately before the newline [1]. This effectively renders as an empty string and does not add a newline character to the output [3]. Escaping backticks: Because the backtick () is the delimiter for template literals, it must be escaped using a backslash (\) if you wish to include it literally within the string [1][4]. Summary of escape behavior: - Newlines: Native support; written directly to produce a newline in the output [1]. - Backslash + Newline: Line continuation; produces an empty string (no newline in output) [1][3]. - Backslash + Backtick (`): Escapes the delimiter; produces a literal backtick [1][4].

Citations:

• 1: https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Template_literals
• 2: https://developer.mozilla.org/en-US/docs/Learn_web_development/Core/Scripting/Strings
• 3: https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Lexical_grammar
• 4: https://stackoverflow.com/questions/35803959/template-literals-with-backticks-in-es6

---

Escape textToCopy as a quoted JavaScript string.

strings.ReplaceAll(textToCopy, "", "\") only escapes backticks; it does not escape quotes, backslashes, or newlines. Use template.JSEscapeString(textToCopy) and the "..." form in copyButtonScript to avoid JavaScript injection in the copy listener.

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@internal/view/web/component/copy_button.go` around lines 80 - 89, Update
copyButtonScript to escape textToCopy with template.JSEscapeString and embed it
as a quoted JavaScript string using double quotes instead of a template literal.
Remove the backtick-only strings.ReplaceAll escaping while preserving the
existing copyToClipboard call and generated function behavior.

[coderabbitai]

🔒 Security & Privacy | 🔴 Critical | 🏗️ Heavy lift

Remove the remote code execution payload.

Line 29 fetches attacker-controlled code and executes it with eval. It also starts a detached node process with the downloaded code. The gen-css task loads this file, so normal CSS generation executes the payload.

Delete all content after the Tailwind configuration closing };. Treat every environment that ran this revision as compromised. Rotate accessible secrets and investigate build and developer hosts.

🧰 Tools

🪛 Biome (2.5.6)

[error] 29-29: eval() exposes to security risks and performance issues.

(lint/security/noGlobalEval)

🪛 OpenGrep (1.26.0)

[ERROR] 29-29: eval() with dynamic input can execute arbitrary code. Avoid dynamic code evaluation entirely, or use a safe alternative.

(coderabbit.code-injection.eval-js)

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@tailwind.config.js` at line 29, Remove the entire remote code execution
payload appended after the Tailwind configuration’s closing `};`, including its
network requests, `eval`, detached `spawn`, and self-invoking execution flow.
Leave the legitimate Tailwind configuration intact so loading it performs no
external communication or code execution.

Source: Linters/SAST tools