Self-hostable auth and billing behind one API. A user's login and their plan live in the same place. MIT licensed.
Drift inferred · capture-to-capture
No drift recorded — single capability capture; advisories appear once its surface changes.
transport stdio · http counts 0 tools · 0 res
· 0 prompts
permission surface via code analysis
No tools enumerated yet for this server.
prompt-surface
shipped agent-instruction files + hidden-content / dangerous-code findings —
quoted from the analyzed source
analyzed commit 682b837 · analyzer v28 · 2h ago
skills & prompt files 1
- agent-rules rekey-dev-rekey-682b837/AGENTS.md
danger signals3
- suspicious endpoint 169.254.169.254 (cloud metadata) rekey-dev-rekey-682b837/apps/api/test/audit-2.test.ts :306
expect(isWebhookUrlSafe('http://169.254.169.254/').ok).toBe(false); // EC2 IMDS - suspicious endpoint 169.254.169.254 (cloud metadata) rekey-dev-rekey-682b837/apps/api/test/ssrf-guard.test.ts :38
assertSafeUrl('http://169.254.169.254/latest/meta-data/', { allowPrivate: false }), - suspicious endpoint 93.184.216.34 rekey-dev-rekey-682b837/apps/api/test/ssrf-guard.test.ts :67
await expect(assertSafeUrl('https://93.184.216.34/cb', { allowPrivate: false })).resolves.toBeUndefined();
evidence-backed
findings quoted directly from the published source artifact — not inferred
code files: 537
network 17
- net rekey-dev-rekey-682b837/apps/admin/src/lib/api.ts :67
const res = await fetch(`${apiUrl()}${path}`, { - net rekey-dev-rekey-682b837/apps/api/src/lib/ssrf-guard.ts :21
import { isIP } from 'node:net'; - net rekey-dev-rekey-682b837/apps/api/src/lib/webhook-signing.ts :17
import { isIP } from 'node:net'; - net rekey-dev-rekey-682b837/apps/api/src/modules/billing/providers/paypal.ts :53
const res = await fetch(`${this.base}/v1/oauth2/token`, { - net rekey-dev-rekey-682b837/apps/api/src/modules/oauth/providers/_oauth2-base.ts :44
const res = await fetch(url, { ...init, signal: controller.signal }); - net rekey-dev-rekey-682b837/apps/api/src/modules/webhooks/webhook.service.ts :130
const res = await fetch(args.url, { - net rekey-dev-rekey-682b837/apps/panel/src/app/(authed)/applications/[id]/end-users/[euid]/export/route.ts :32
const res = await fetch( - net rekey-dev-rekey-682b837/apps/panel/src/app/(authed)/audit-log/export/route.ts :36
const res = await fetch(`${base}/api/v1/tenant/security-events?${qs.toString()}`, { - net rekey-dev-rekey-682b837/apps/panel/src/components/CommandPalette.tsx :181
fetch('/api/palette/applications', { cache: 'no-store' }) - net rekey-dev-rekey-682b837/apps/panel/src/components/SlugAvailabilityField.tsx :87
const res = await fetch(`/api/check-slug?slug=${encodeURIComponent(value)}`); - net rekey-dev-rekey-682b837/apps/panel/src/lib/api.ts :149
const res = await fetch(`${apiUrl()}/api/v1/tenant/auth/refresh`, { - net rekey-dev-rekey-682b837/apps/portal/src/lib/actions.ts :70
const res = await fetch(`${rekeyApiUrl()}${path}`, { - net rekey-dev-rekey-682b837/apps/portal/src/lib/config.ts :90
const res = await fetch(`${rekeyApiUrl()}/api/v1/portal/config/${encodeURIComponent(slug)}`, { - net rekey-dev-rekey-682b837/packages/cli/src/commands/doctor.ts :59
const res = await fetch(`${ctx.apiUrl.replace(/\/$/, '')}/health`); - net rekey-dev-rekey-682b837/packages/cli/src/lib/api.ts :39
const res = await fetch(url, { - net rekey-dev-rekey-682b837/packages/mcp/src/client.ts :85
const res = await fetch(`${this.cfg.apiUrl.replace(/\/$/, '')}${path}`, { - net rekey-dev-rekey-682b837/packages/sdk-nextjs/src/client.ts :51
* await fetch('/api/auth/session', {
secrets 6
- secrets rekey-dev-rekey-682b837/apps/admin/src/lib/api.ts :40
const k = process.env.SUPER_ADMIN_KEY ?? ''; - secrets rekey-dev-rekey-682b837/apps/admin/src/lib/auth.ts :43
return (process.env.SUPER_ADMIN_KEY ?? '').length >= 32; - secrets rekey-dev-rekey-682b837/packages/cli/src/index.ts :34
.option('--admin-key <key>', 'Override SUPER_ADMIN_KEY', process.env.SUPER_ADMIN_KEY) - secrets rekey-dev-rekey-682b837/packages/mcp/src/index.ts :34
const adminKey = process.env.SUPER_ADMIN_KEY ?? ''; - secrets rekey-dev-rekey-682b837/packages/sdk-nextjs/src/server.ts :17
* - `process.env.REKEY_SECRET` (the Application secret key, server-only) - secrets rekey-dev-rekey-682b837/packages/sdk-node/src/index.ts :15
* secretKey: process.env.REKEY_SECRET!,
database 72
- db rekey-dev-rekey-682b837/apps/api/src/lib/app-access.ts :43
import type { ApplicationRole } from '@prisma/client'; - db rekey-dev-rekey-682b837/apps/api/src/lib/app-url.ts :34
import type { Application } from '@prisma/client'; - db rekey-dev-rekey-682b837/apps/api/src/lib/brute-force.ts :33
import type { Redis } from 'ioredis'; - db rekey-dev-rekey-682b837/apps/api/src/lib/email-transport.ts :30
import type { Application } from '@prisma/client'; - db rekey-dev-rekey-682b837/apps/api/src/lib/email-verification.ts :16
import type { EmailVerificationToken } from '@prisma/client'; - db rekey-dev-rekey-682b837/apps/api/src/lib/jwt.ts :39
import type { Application } from '@prisma/client'; - db rekey-dev-rekey-682b837/apps/api/src/lib/magic-link.ts :14
import type { MagicLinkToken } from '@prisma/client'; - db rekey-dev-rekey-682b837/apps/api/src/lib/password-reset.ts :21
import type { PasswordResetToken } from '@prisma/client'; - db rekey-dev-rekey-682b837/apps/api/src/lib/portal-origins.ts :7
import type { Application } from '@prisma/client'; - db rekey-dev-rekey-682b837/apps/api/src/lib/prisma.ts :1
import { PrismaClient } from '@prisma/client'; - db rekey-dev-rekey-682b837/apps/api/src/lib/queue.ts :19
import { Redis } from 'ioredis'; - db rekey-dev-rekey-682b837/apps/api/src/lib/redis.ts :19
import { Redis } from 'ioredis'; - db rekey-dev-rekey-682b837/apps/api/src/lib/refresh-tokens.ts :20
import type { RefreshToken } from '@prisma/client'; - db rekey-dev-rekey-682b837/apps/api/src/lib/signing-keys.ts :37
import { Prisma } from '@prisma/client'; - db rekey-dev-rekey-682b837/apps/api/src/lib/step-up.ts :37
import type { EndUser } from '@prisma/client'; - db rekey-dev-rekey-682b837/apps/api/src/lib/tenant-jwt.ts :27
import type { TenantRole } from '@prisma/client'; - db rekey-dev-rekey-682b837/apps/api/src/lib/tenant-limits.ts :61
import type { Prisma } from '@prisma/client'; - db rekey-dev-rekey-682b837/apps/api/src/lib/tenant-magic-link.ts :17
import type { TenantMagicLinkToken } from '@prisma/client'; - db rekey-dev-rekey-682b837/apps/api/src/lib/tenant-password-reset.ts :15
import type { TenantPasswordResetToken } from '@prisma/client'; - db rekey-dev-rekey-682b837/apps/api/src/lib/tenant-refresh-tokens.ts :15
import type { TenantRefreshToken } from '@prisma/client'; - db rekey-dev-rekey-682b837/apps/api/src/lib/tenant-webauthn.ts :10
import type { TenantUser, TenantWebAuthnCredential } from '@prisma/client'; - db rekey-dev-rekey-682b837/apps/api/src/lib/webauthn.ts :25
import type { Application, WebAuthnCredential } from '@prisma/client'; - db rekey-dev-rekey-682b837/apps/api/src/middleware/api-key-auth.ts :18
import type { ApiKey, Application } from '@prisma/client'; - db rekey-dev-rekey-682b837/apps/api/src/middleware/idempotency.ts :45
import { Prisma } from '@prisma/client'; - db rekey-dev-rekey-682b837/apps/api/src/middleware/operator-token-auth.ts :30
import type { TenantRole } from '@prisma/client'; - db rekey-dev-rekey-682b837/apps/api/src/middleware/tenant-session.ts :22
import type { TenantRole } from '@prisma/client'; - db rekey-dev-rekey-682b837/apps/api/src/modules/api-keys/api-keys.service.ts :19
import type { ApiKey } from '@prisma/client'; - db rekey-dev-rekey-682b837/apps/api/src/modules/applications/applications.service.ts :26
import { Prisma, type AppEnvironment, type Application } from '@prisma/client'; - db rekey-dev-rekey-682b837/apps/api/src/modules/auth/auth.service.ts :26
import { Prisma } from '@prisma/client'; - db rekey-dev-rekey-682b837/apps/api/src/modules/billing/billing.service.ts :19
import type { Application, EndUser, Plan, Subscription } from '@prisma/client'; - db rekey-dev-rekey-682b837/apps/api/src/modules/billing/checkout-discount.ts :33
import type { Plan } from '@prisma/client'; - db rekey-dev-rekey-682b837/apps/api/src/modules/billing/dunning.service.ts :36
import type { DunningCase, Subscription } from '@prisma/client'; - db rekey-dev-rekey-682b837/apps/api/src/modules/billing/entitlements.service.ts :34
} from '@prisma/client'; - db rekey-dev-rekey-682b837/apps/api/src/modules/billing/providers/index.ts :21
import type { Application } from '@prisma/client'; - db rekey-dev-rekey-682b837/apps/api/src/modules/billing/providers/paypal.ts :17
import type { Plan } from '@prisma/client'; - db rekey-dev-rekey-682b837/apps/api/src/modules/billing/providers/razorpay.ts :22
import type { Plan } from '@prisma/client'; - db rekey-dev-rekey-682b837/apps/api/src/modules/billing/providers/stripe-real.ts :24
import type { Plan } from '@prisma/client'; - db rekey-dev-rekey-682b837/apps/api/src/modules/billing/providers/types.ts :18
import type { Plan, EndUser, Subscription } from '@prisma/client'; - db rekey-dev-rekey-682b837/apps/api/src/modules/billing/stats.service.ts :28
import { Prisma } from '@prisma/client'; - db rekey-dev-rekey-682b837/apps/api/src/modules/billing/webhooks/apply.ts :30
import type { Subscription } from '@prisma/client'; - db rekey-dev-rekey-682b837/apps/api/src/modules/coupons/coupons.routes.ts :3
import { CouponDiscountType } from '@prisma/client'; - db rekey-dev-rekey-682b837/apps/api/src/modules/coupons/coupons.service.ts :48
import type { Coupon } from '@prisma/client'; - db rekey-dev-rekey-682b837/apps/api/src/modules/credits/credits.service.ts :18
import type { Prisma, PrismaClient, CreditReason } from '@prisma/client'; - db rekey-dev-rekey-682b837/apps/api/src/modules/email/email.service.ts :22
import type { Application, EmailTemplate } from '@prisma/client'; - db rekey-dev-rekey-682b837/apps/api/src/modules/end-user-roles/end-user-roles.service.ts :19
import type { EndUserRole } from '@prisma/client'; - db rekey-dev-rekey-682b837/apps/api/src/modules/licenses/licenses.service.ts :16
import type { Application, EndUser, License, LicenseKind } from '@prisma/client'; - db rekey-dev-rekey-682b837/apps/api/src/modules/mcp/oauth.service.ts :24
import type { Application, EndUser } from '@prisma/client'; - db rekey-dev-rekey-682b837/apps/api/src/modules/mcp/oidc.service.ts :21
import type { EndUser } from '@prisma/client'; - db rekey-dev-rekey-682b837/apps/api/src/modules/mfa/mfa.routes.ts :17
import type { Application } from '@prisma/client'; - db rekey-dev-rekey-682b837/apps/api/src/modules/mfa/mfa.service.ts :16
import type { Application, EndUser } from '@prisma/client'; - db rekey-dev-rekey-682b837/apps/api/src/modules/oauth/oauth.service.ts :16
import type { Application } from '@prisma/client'; - db rekey-dev-rekey-682b837/apps/api/src/modules/operator-invites/operator-invites.service.ts :9
import type { OperatorInvite } from '@prisma/client'; - db rekey-dev-rekey-682b837/apps/api/src/modules/organizations/organizations.service.ts :34
import type { Organization, OrganizationMembership, OrganizationRole } from '@prisma/client'; - db rekey-dev-rekey-682b837/apps/api/src/modules/plans/plans.service.ts :16
import type { Plan, PlanInterval, PlanKind, LicenseKind, Application } from '@prisma/client'; - db rekey-dev-rekey-682b837/apps/api/src/modules/tenant-applications/end-user-erasure.service.ts :31
import { Prisma } from '@prisma/client'; - db rekey-dev-rekey-682b837/apps/api/src/modules/tenant-applications/tenant-applications.routes.ts :40
import { CouponDiscountType, type LicenseKind } from '@prisma/client'; - db rekey-dev-rekey-682b837/apps/api/src/modules/tenant-auth/operator-signup-policy.ts :23
import type { Prisma, PrismaClient } from '@prisma/client'; - db rekey-dev-rekey-682b837/apps/api/src/modules/tenant-auth/operator-tokens.service.ts :16
import type { TenantApiToken } from '@prisma/client'; - db rekey-dev-rekey-682b837/apps/api/src/modules/tenant-auth/tenant-auth.service.ts :19
import type { Tenant, TenantRole, TenantUser } from '@prisma/client'; - db rekey-dev-rekey-682b837/apps/api/src/modules/tenant-mcp/bearer-auth.ts :28
import type { TenantRole } from '@prisma/client'; - db rekey-dev-rekey-682b837/apps/api/src/modules/tenant-mcp/oauth.service.ts :25
import type { TenantRole } from '@prisma/client'; - db rekey-dev-rekey-682b837/apps/api/src/modules/tenant-mcp/operator-tools.ts :25
import type { TenantRole } from '@prisma/client'; - db rekey-dev-rekey-682b837/apps/api/src/modules/tenant-mcp/operator-write-tools.ts :26
import type { Application, TenantRole } from '@prisma/client'; - db rekey-dev-rekey-682b837/apps/api/src/modules/tenant-mcp/tenant-mcp-server.ts :10
import type { TenantRole } from '@prisma/client'; - db rekey-dev-rekey-682b837/apps/api/src/modules/tenant-passkeys/tenant-passkeys.service.ts :17
import type { TenantUser } from '@prisma/client'; - db rekey-dev-rekey-682b837/apps/api/src/modules/tenant-workspaces/tenant-workspaces.routes.ts :3
import type { ApplicationRole, TenantRole } from '@prisma/client'; - db rekey-dev-rekey-682b837/apps/api/src/modules/tenant-workspaces/tenant-workspaces.service.ts :26
} from '@prisma/client'; - db rekey-dev-rekey-682b837/apps/api/src/modules/tenants/tenants.service.ts :33
import type { Prisma, Tenant } from '@prisma/client'; - db rekey-dev-rekey-682b837/apps/api/src/modules/usage/usage.service.ts :15
import type { UsageMeter, UsageRecord } from '@prisma/client'; - db rekey-dev-rekey-682b837/apps/api/src/modules/webhooks/webhook.queue.ts :35
import type { Redis } from 'ioredis'; - db rekey-dev-rekey-682b837/apps/api/src/modules/webhooks/webhook.service.ts :33
import type { WebhookEndpoint, WebhookDelivery } from '@prisma/client'; - db rekey-dev-rekey-682b837/apps/api/src/routes/me.ts :19
import type { Application } from '@prisma/client';
declared dependencies 5
- @prisma/client@6.10.1
- playwright@^1.60.0
- prisma@6.10.1
- turbo@^2.3.0
- typescript@^5.6.3