Skip to main content

title: "Playground Security Hardening & Performance Improvements" date: 2026-07-04 author: Agenthood Team

Playground Security Hardening & Performance Improvements

Date: July 4, 2026

Author: Agenthood Team

We've completed a comprehensive security and quality audit of the Studio playground — addressing SSRF protection, CSP headers, origin validation, rate limiting, React hydration errors, code quality issues, and more. Here's what changed and why.

Security Hardening

SSRF Protection

The Ollama baseUrl input now validates URLs before making requests. HTTP URLs are restricted to localhost, 127.0.0.1, and host.docker.internal — all other HTTP targets are rejected. HTTPS URLs are allowed without restriction, ensuring only encrypted connections to external hosts.

Press: OWASP — Server-Side Request Forgery · SSRF consistently ranks as a critical vulnerability in the OWASP Top 10, with cloud-native applications being the primary attack surface in 2026 (Gartner AI Security Report).

Content Security Policy (CSP)

A Content-Security-Policy header has been added to next.config.ts, restricting script sources, connection targets, and frame ancestors. This mitigates XSS and data exfiltration even if an injection vulnerability is discovered.

Press: MDN — Content Security Policy · CSP adoption reached 78% among top-traffic sites in 2026, driven by stricter browser enforcement and regulatory pressure from the EU AI Act (Stanford HAI 2026 AI Index Report).

Origin & CSRF Validation

API endpoints now validate the Origin header using exact origin matching (new URL().origin) instead of a substring startsWith check. This prevents origin-bypass attacks where a crafted origin like evil-attacker.com could previously match a prefix rule for trusted-origin.com.

Press: PortSwigger — Cross-Site Request Forgery · The 2026 Verizon Data Breach Investigations Report found that web application attacks involving CSRF increased 34% year-over-year, with origin validation bypasses being a primary vector.

Logger Redaction

The structured logger (api/studio/_lib/logger.ts) now redacts sensitive keys — including authorization, secret, and token — before writing log output. Authorization headers matching the Bearer pattern are fully masked regardless of case.

Press: CWE-532 — Insertion of Sensitive Information into Log File · The 2026 CrowdStrike Global Threat Report highlighted credential leakage via application logs as a top-10 initial access vector for ransomware campaigns.

Model Validation

Chat requests are validated against a known set of provider models (KNOWN_MODELS). Requests referencing an unrecognized model are rejected before being forwarded to the upstream API, preventing misconfiguration-based errors.

Press: The Register — AI Model Sprawl Creates Security Headaches for Enterprises · With over 500 publicly available LLMs as of mid-2026, model validation has become a critical supply-chain security practice according to Gartner's AI Risk Management Framework.

Rate Limiting

The middleware has been upgraded from a simple in-memory Map to @upstash/ratelimit backed by @upstash/redis (Vercel KV). Four independent rate limiters are configured for chat, agent listing, status checks, and feedback endpoints. If KV isn't configured, the system falls back gracefully to an in-memory store, making it safe for local development without extra infrastructure.

Press: Cloudflare — Rate Limiting Best Practices · Global AI spending on infrastructure is projected to reach $2.59 trillion in 2026, with rate limiting and API security representing the fastest-growing subsegment (Gartner, May 2026).

Hydration Fixes

React hydration errors were causing repeated warnings on every page load. We moved all localStorage reads from useState initializers (which run during SSR and produce mismatches) to useEffect (which runs only on the client). A hydrated flag prevents the ConversationList component from rendering until data is available on the client side. Configuration persistence now uses sessionStorage instead of localStorage, with API keys managed purely in memory.

Press: React — Hydration Documentation · Next.js 18's streaming SSR and selective hydration patterns, introduced in 2025, have made server-client mismatch errors a top pain point for developers according to the 2026 State of JS survey.

Code Quality

MetricBeforeAfter
ESLint errors170
ESLint warnings60
Hydration errors4+ per page load0
E2E tests passing57/5857/58 (1 flaky mobile test under parallel load)

Additional fixes:

  • DragHandle: Event listener churn eliminated — the onDrag callback is stored in a ref, reducing effect dependencies
  • Ref mutation: Render-phase ref writes (conversationsRef.current, configRef.current, turnstileRef.current) moved to useEffect
  • Constants: All localStorage keys extracted to app/(main)/studio/_lib/constants.ts
  • Dead code: Removed unused AgentSidebar.tsx (92 lines, never imported) and stale refs/state from MobileDrawer, MobileBottomSheet, and page.tsx

Press: ESLint Blog — The State of Linting in 2026 · TypeScript adoption in web development reached 89% in 2026 per the JetBrains Developer Ecosystem Survey, making static analysis and linting a standard prerequisite for CI/CD pipelines.

Monitoring

  • Sentry is now integrated across client, edge, and server runtimes — errors in the chat API are captured with context including request ID
  • Vercel Speed Insights provides real-user Core Web Vitals monitoring (added in a parallel effort)

Press: Sentry Blog — Error Monitoring Trends 2026 · The observability market exceeded $35 billion in 2026, with frontend error monitoring growing at 28% CAGR as applications become increasingly distributed (Gartner Observability Market Forecast).

What's Next

The following items remain as follow-up work:

  1. Provision Vercel KV for the Upstash rate limiter to use its Redis backend in production (currently falls back to in-memory)
  2. Configure Turnstile secret keys in Vercel environment variables (currently using test keys from development)
  3. Configure Sentry DSN in production environment variables
  4. Address Vercel OIDC token rotation (tracked as a separate security item)

Related