fix: keep checked-in examples secure by default

[kang-heewon]

Outcome

• Checked-in Lambda and billing examples now boot through default HTTP security validation with security headers, explicit CORS, 1 MB body limit, and credential-free in-memory sliding-window rate limiting.
• Their READMEs explain the secure bootstrap posture and reserve bypasses for temporary migration/test fixtures.
• The first-success contract now rejects bypasses anywhere in either example tree and guards all four capabilities, the in-memory store, dependency, and docs rationale with negative tests.

Fixes #1640

Verification

• pnpm quick-start-lambda:smoke
• pnpm saas-billing-golden-path:smoke — 4/4 tests
• pnpm first-success:verify
• pnpm exec vitest run scripts/tests/first-success-verify.spec.ts --config vitest.config.ts --maxWorkers=1 — 25/25
• pnpm check — 24/25 passed, 1 not applicable
• pre-push — 234/234 tests and 233/233 typechecks
• pnpm changeset-required:check -- --base origin/trunk --head HEAD — no publishable changes

Review gates

• Correctness and regression — PASS. Both example smoke paths pass, contract verification rejects bypasses anywhere in either example tree, and negative tests cover missing or substituted security capabilities.
• API, security, compatibility, and release — PASS. No public exports changed, no credentials or secrets were added, and the changeset gate reports no publishable package changes.
• Maintainability and minimality — PASS. The change is limited to the two examples, their dependency importers, and the existing first-success contract and tests.
• Independent adversarial review — CLEAN after adding tree-wide bypass detection, credential-free store enforcement, documentation rationale, and environment-file variant coverage.

Residual risk

The in-memory rate limiter is process-local by design for zero-credential examples; production deployments needing cross-instance limits should replace the store.

Summary by CodeRabbit

• 새로운 기능

  • Quick Start Lambda 및 SaaS 결제 예제에 보안 헤더와 명시적 CORS 설정을 추가했습니다.
  • 요청 본문 크기를 1MB로 제한하고, API에 슬라이딩 윈도우 방식의 요청 속도 제한을 적용했습니다.
  • 헬스 체크 엔드포인트는 속도 제한에서 제외됩니다.

• 문서

  • 예제의 보안 설정과 검증 우회 사용 지침을 문서화했습니다.

• 테스트

  • 필수 보안 설정 누락 및 검증 우회 사례를 자동으로 확인하도록 검증 범위를 강화했습니다.

[coderabbitai]

Warning

Review limit reached

@kang-heewon, you've reached your PR review limit, so we couldn't start this review.

Next review available in: 39 minutes

Enable usage-based reviews in Billing to review now. Otherwise, wait until the next included review is available.
You're only billed for reviews past your plan's rate limits ($0.25/file).

How can I continue?

After more reviews become available, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews.

How do review limits work?

CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability.

For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window.

Please refer docs for additional details.

Review details

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Pro Plus

Run ID: 371107df-e6b0-4752-bfa3-d9b558f7d034

📥 Commits

Reviewing files that changed from the base of the PR and between 23b98a6 and bac8a35.

📒 Files selected for processing (2)

• scripts/first-success-verify.mts
• scripts/tests/first-success-verify.spec.ts

📝 Walkthrough

Walkthrough

두 공식 예제가 보안 헤더, 명시적 CORS, 1MB 본문 제한, 인메모리 sliding-window rate limit을 사용하도록 변경했습니다. 보안 검증 우회를 제거하고, first-success 검증과 테스트에 보안 구성 계약을 추가했습니다.

Changes

보안 HTTP 부트스트랩 계약

Layer / File(s)	Summary
예제 보안 부트스트랩 구성 examples/quick-start-lambda/..., examples/saas-billing-golden-path/...	두 예제에서 securityValidation: "off"를 제거했습니다. 보안 헤더, CORS, 1MB body limit, API rate limit을 등록했습니다. Rate limit은 IP 키와 credential-free SlidingWindowInMemoryStore를 사용하며, Quick Start에서는 /api/health를 제외합니다. README와 package.json도 구성에 맞게 갱신했습니다.
First-success 보안 검증 계약 scripts/first-success-verify.mts	두 예제의 bootstrap, package manifest, README를 검사하도록 계약을 확장했습니다. 필수 미들웨어, @croco/ratelimit-core 의존성, 인메모리 저장소, 보안 설명, 보안 검증 우회 패턴을 검사합니다.
검증 테스트와 보안 fixture scripts/tests/first-success-verify.spec.ts	보안 우회, 환경 변수 기반 비활성화, 미들웨어 누락, 잘못된 rate-limit store를 거부하는 테스트를 추가했습니다. 두 예제에서 공유하는 보안 bootstrap fixture와 관련 README 및 manifest 설정을 추가했습니다.

Estimated code review effort: 3 (Moderate) | ~25 minutes

Possibly related PRs

• croco-dev/framework#1116: 예제 앱에 필수 보안, CORS, body-limit, rate-limit 미들웨어를 적용한 변경과 직접 연결됩니다.
• croco-dev/framework#1330: scripts/first-success-verify.mts와 테스트에서 생성 예제의 보안 구성 검증을 확장한 변경과 연결됩니다.

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 0.00% which is insufficient. The required threshold is 80.00%.	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	제목은 checked-in 예제를 기본적으로 안전하게 유지하는 주요 변경 사항을 명확하게 설명합니다.
Linked Issues check	✅ Passed	두 예제에 필수 보안 미들웨어, 인메모리 rate limit 저장소, 문서 및 검증 로직이 추가되었고 보안 검증 우회가 제거되었습니다.
Out of Scope Changes check	✅ Passed	변경 사항은 연결된 이슈의 보안 bootstrap, 문서화 및 검증 범위에 포함되며 관련 없는 변경은 확인되지 않습니다.

✨ Finishing Touches 💡 1

📝 Generate docstrings 💡

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch fix/1640-secure-example-bootstrap

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[coderabbitai]

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@scripts/first-success-verify.mts`:
- Around line 795-814: Update scripts/first-success-verify.mts lines 795-814 to
validate that RateLimiter is constructed with new SlidingWindowInMemoryStore()
and that the same rateLimiter is passed to rateLimitHttpMiddleware({
rateLimiter, ... }), rather than checking those identifiers independently.
Update scripts/tests/first-success-verify.spec.ts lines 839-853 to make the
fixture create RateLimiter and pass it to rateLimitHttpMiddleware({ rateLimiter
}); adjust the missing-middleware replacement target to match the new syntax.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Pro Plus

Run ID: 3e024504-9048-4afe-9278-5c465ba0a5d8

📥 Commits

Reviewing files that changed from the base of the PR and between 7b5e9e4 and 23b98a6.

⛔ Files ignored due to path filters (1)

• pnpm-lock.yaml is excluded by !**/pnpm-lock.yaml

📒 Files selected for processing (8)

• examples/quick-start-lambda/README.md
• examples/quick-start-lambda/package.json
• examples/quick-start-lambda/src/app/bootstrap.ts
• examples/saas-billing-golden-path/README.md
• examples/saas-billing-golden-path/package.json
• examples/saas-billing-golden-path/src/app/bootstrap.ts
• scripts/first-success-verify.mts
• scripts/tests/first-success-verify.spec.ts

[github-actions]

📊 Benchmark Results

✅ All benchmarks passed

Benchmark	p75	Threshold	Baseline	vs Baseline	Status	Notes
CrocoApp constructor	9.1μs	30.0ms	8.2μs	+11.6%	✅	-
CrocoApp lambdaHandler (10 controllers)	352.0μs	50.0ms	258.4μs	+36.2%	❌	-
Lambda cold-start simulation	448.3μs	80.0ms	418.1μs	+7.2%	✅	-
Lambda cold-start with headers	399.5μs	80.0ms	369.7μs	+8.1%	✅	-
Lambda cold-start with binary body	368.5μs	80.0ms	339.1μs	+8.7%	✅	-
Lambda cold-start with query params	319.9μs	80.0ms	301.3μs	+6.2%	✅	-
Lambda cold-start with authorizer context	319.1μs	80.0ms	299.8μs	+6.4%	✅	-
Lambda cold-start realistic scenario	322.8μs	80.0ms	299.2μs	+7.9%	✅	-
EventBusConfig.start (10 handlers)	1.6μs	10.0ms	1.4μs	+13.3%	✅	-
EventPublisher.publishNow single event	1.9μs	2.0ms	1.7μs	+14.9%	✅	-
DefaultHandlerResolver.resolve × 10	0.1μs	5.0ms	0.1μs	+0.0%	✅	-
Container.get singleton (cold)	81.4μs	5.0ms	70.3μs	+15.9%	✅	-
Container.register × 50 components	3.4ms	10.0ms	3.2ms	+4.8%	✅	-
Container.validate (50 components)	3.9ms	20.0ms	3.4ms	+16.3%	✅	-
Container.get singleton (warm)	1.8μs	500.0μs	1.6μs	+7.3%	✅	-
TelemetryRuntime.init (lambda preset)	2.3μs	200.0ms	1.1ms	-99.8%	✅	-
lambdaPreset config creation	1.5μs	2.0ms	1.4μs	+4.3%	✅	-

_{Updated: 2026-08-01T14:06:03.112Z · Commit: 2221ed6}

[kang-heewon]

@coderabbitai resolve

[coderabbitai]

✅ Action performed

Comments resolved and changes approved.