[Security Hardening] Unstable express@5.2.1 dependency and leaked test artifacts

[Sujal411]

Issue Summary

During a security review, I identified two hardening opportunities in the repository:

1. Unstable Production Dependency

• File: pnpm-lock.yaml
• Issue: The production package packages/web depends on express@5.2.1.
• Risk: Express 5.x is an alpha/beta release and is not covered by Node.js LTS security patches. If a future CVE is discovered in Express 5.x, it will not be backported, forcing downstream users to run an unpatched version. Express 4.x is the stable LTS line and is recommended for production.

Evidence:

# In pnpm-lock.yaml under "packages/web:"
express:
  specifier: ^5.2.1
  version: 5.2.1

2. Leaked Preview Deployment URLs in Test Artifacts
Files: e2e-failures-nextjs-turbopack-vercel.json, e2e-diagnostics-nextjs-turbopack-vercel.json

Issue: These files contain hardcoded Vercel preview deployment URLs and authentication error pages.

Risk: Exposing internal infrastructure layout and authentication mechanisms aids attackers in reconnaissance. Similar exposure was exploited in CVE-2025-67846 (Mintlify platform) where predictable preview URLs led to security patch bypasses.

Evidence:

json
"errorMessage": "Failed to fetch manifest from https://example-nextjs-workflow-turbopack-*.labs.vercel.dev/.well-known/workflow/v1/manifest.json: 401 ..."
Suggested Remediation
Downgrade Express to LTS:

Replace express@^5.2.1 with express@^4.21.2 in the following package.json files:

packages/web/package.json

workbench/express/package.json

workbench/nest/package.json

Run pnpm install to update the lockfile.

Remove Test Artifacts from Version Control:

Delete e2e-*.json from the repository.

Add e2e-*.json to .gitignore.

Consider storing these logs as GitHub Actions artifacts instead of committing them.

Add Secret Scanning:

Integrate gitleaks or trivy into CI to prevent accidental exposure of internal URLs or tokens.