Security context

Highlights

Auth Bypass: 2 prior fixes. Scrutinize any change in this area.

services/deepResearchService.ts: most-fixed (1 issue). Treat as high-risk during review.

1 high-severity fix in this history; regressions here are high-impact.

Recurring patterns

Auth Bypass: The authentication middleware used an incorrect secret (an external API key rather than the designated JWT secret) to decode and verify bearer tokens, effectively failing to validate token signatures properly.

Auth Bypass: Failure of the backing Redis store could prevent the consumption and single-use validation of tokens, leading to potential authentication bypasses; this required implementing an in-memory fallback.

Information Disclosure: Sharing mutable nested default query plan templates across concurrent requests allowed information to bleed between search queries, necessitating explicit deep-copy isolation.