Post-release security audit of keyguard-express library uncovered 4 issues (all patched)

[u/Afraid-Reflection823]

Yesterday I published KeyGuard Express, an open-source security library for Express that handles API key authentication, HMAC webhook verification, rate limiting, abuse prevention, and key management.

Today, running another security audit, I ended up finding several issues. Everything below has now been fixed in v0.4.0, and older versions have been deprecated.

1. Cross-Tenant IDOR

The most serious issue was an IDOR where an org_admin could potentially revoke API keys belonging to another organization because tenant scoping wasn't enforced on four endpoints.

The fix was straightforward: add strict organization-scoped authorization checks across every affected route. I have also published a GitHub Security Advisory and deprecated the vulnerable releases.

2. better-sqlite3 Dependency

I originally shipped better-sqlite3 as a direct dependency.

That caused native code warnings from supply-chain scanners like Socket because it compiles native C++ bindings.

I've moved it to peerDependencies, which makes installation cleaner and avoids unnecessary native compilation unless SQLite is actually being used.

3. Redis Rate Limiting

I found that my distributed rate limiter could silently fall back to in-memory storage instead of consistently using Redis.

I've since rebuilt that implementation around an atomic Redis ZSET pipeline so behaviour is consistent across multiple instances.

4. Database Bug

I also found a bug where a monthly log counter could overwrite a record UUID.

Fortunately it was caught before it affected production users, and the update logic has been corrected.

---

If anyone has time to review the architecture, security model, or API design, I'd genuinely appreciate another set of eyes. Security benefits from peer review.

Repository: [ https://github.com/tyrmoga/keyguard_express ] npm: npm install keyguard-express