Fix security issues in generated templates and CLI subprocess calls

[devin-ai-integration]

Checklist

• I have read the Contributor Guide
• I have read and agree to the Code of Conduct
• I have added a description of my changes and why I'd like them included in the section below

Description of Changes

Security scan of the CLI and the _template files it copies into generated projects. Template issues matter most: every generated project inherits them.

Mass assignment / MongoDB operator injection in the generated users API (_template/plugins/mongoose/app/api/users/**)

The routes passed the raw parsed body straight to Mongoose:

User.create(body)                    // any field the attacker names
User.findByIdAndUpdate(id, body)     // body may be {"$unset": {...}}, {"$rename": {...}}

Now both go through a whitelist that accepts only string first_name/last_name, so $-prefixed keys and unknown fields are rejected with 400. Also added: ObjectId.isValid(id) checks before querying, 404 (not 400) when a document doesn't exist, deletedCount check in DELETE instead of truthiness of the always-truthy result object, try/catch around req.json(), and removed the raw Mongoose error object from the POST response body (leaked schema/validator internals to clients).

Unauthenticated API routes when the Kinde auth plugin is installed (_template/plugins/kinde/middleware.ts)

Matcher was ['/dashboard/:path*'], so the generated /api/users CRUD endpoints were world-writable even in a project that opted into auth. Now ['/dashboard/:path*', '/api/((?!auth).*)'] — all API routes protected, Kinde's own /api/auth/** handler excluded.

Shell interpolation in CLI subprocess calls

git clone ${githubUrl} ${projectName} and npm install ${pkg} ran through a shell. Replaced with execFile/execFileSync argv form (new src/utils/exec-file-async.ts; the now-unused exec-async.ts shell helper is deleted). Currently reachable only with hardcoded values, but it removes the injection sink for future templates/plugins.

Other

• encodeURIComponent on the MongoDB password substituted into the connection URL — an unencoded @///: in the password otherwise corrupts the URI or misroutes the credential.
• npm audit fix: 25 vulnerabilities (16 high) → 1 low. Lockfile only, no package.json range changes; notably inquirer's transitive tmp path-traversal advisories.
• .gitignore had # .env commented out, so a stray .env/.env.local in the repo root was committable. Now ignored (.env.example still allowed).

Not changed: no hardcoded secrets or credentials found anywhere in the tree or in template files; no SQL usage; no CORS configuration; no debug/diagnostic endpoints. The generated /test-database page is a plain form, not a debug endpoint, and relies on the API validation added here.

Verified with npm run build, npx tsc --noEmit, and npm run lint -- src. The one Prettier warning on selectGitHubTemplate.ts predates this branch (confirmed against HEAD) and is left alone.

Related Issues

None

Link to Devin session: https://app.devin.ai/sessions/799e228e489d4679a22c8701a758dc3b
Requested by: @lox-bot

[devin-ai-integration]

🤖 Devin AI Engineer

I'll be helping with this pull request! Here's what you should know:

✅ I will automatically:

• Address comments on this PR. Add '(aside)' to your comment to have me ignore it.
• Look at CI failures and help fix them

Note: I can only respond to comments from users who have write access to this repository.

⚙️ Control Options:

• Disable automatic comment, CI, and merge conflict monitoring