Security Assessment

1. System Architecture

The pipeline report is served through a layered architecture with clearly separated responsibilities:

2. Network Security

2.1 No Open Inbound Ports

The Cloudflare tunnel works by making an outbound TCP connection from the local machine to Cloudflare's global network — identical in nature to a browser opening a tab. The local router/firewall has no port-forwarding rules and no inbound ports are opened. An attacker scanning the host's public IP address will find nothing.

2.2 Transport Encryption

All traffic between the remote user and Cloudflare's edge is encrypted with TLS 1.3 (HTTPS). The public URL (*.trycloudflare.com) is issued with a valid Cloudflare-managed certificate — no self-signed certificates, no certificate warnings.

3. Authentication

Flask uses HTTP Basic Authentication enforced on every route via a @login_required decorator. No page — including the /refresh endpoint — is accessible without valid credentials.

def login_required(f):
    @functools.wraps(f)
    def decorated(*args, **kwargs):
        auth = request.authorization
        if not auth or not _check_auth(auth.username, auth.password):
            return _require_auth()   # → HTTP 401
        return f(*args, **kwargs)
    return decorated

@app.route("/")
@login_required          # ← applied to every route
def index(): ...

4. What the Report HTML Contains

4.1 Embedded Data

The report HTML is a fully self-contained static file. It contains:

• KPI numbers (counts of raw vs. loaded records)
• Gap analysis tables (URLs / identifiers that failed to load, plus a reason label)
• Gap CSVs encoded as Base64 strings in data-b64 attributes — these are the "Download gaps CSV" buttons

The Base64 strings are not encrypted or obfuscated — they decode to exactly the same data shown in the visible table. Anyone who can view the HTML source can decode them. This is intentional and expected: the purpose of the report is to share this data.

4.2 JavaScript Audit

The report contains exactly two JavaScript functions. Neither makes any network request:

There is no fetch(), XMLHttpRequest, WebSocket, eval(), or dynamic script loading anywhere in the page.

5. Database Isolation

The PostgreSQL database is never reachable from a browser for two independent reasons:

1. Browser same-origin policy + CORS: A web page is prohibited by browser security from opening a TCP connection to localhost:5432. Even if malicious JavaScript were injected into the page, it could not connect to PostgreSQL — browsers only allow HTTP/HTTPS requests, not raw TCP.
2. Flask serves no DB-proxying endpoint: The Flask server has two routes — / (read file from disk) and /refresh (run batch_report.py, then redirect). Neither accepts user-supplied SQL or exposes query results as an API. The database credentials exist only in the .env file on disk, loaded at Python startup — they are never transmitted to the browser.

# The only routes in serve_report.py:
@app.route("/")           → reads pipeline_report.html from disk
@app.route("/refresh")    → runs batch_report.py, then redirects to /
# No /query, /api, /exec, or any other endpoint exists.

6. Known Limitations

7. Summary