fixed build errors

Author: Gerome-Elassaad

SECURITY.md

@@ -0,0 +1,130 @@
+# Security Policy
+
+## Supported Versions
+
+| Version | Supported          |
+| ------- | ------------------ |
+| 0.1.x   | :white_check_mark: |
+
+## Reporting a Vulnerability
+
+We take the security of CodinIT seriously. If you discover a security vulnerability, please follow these steps:
+
+### 🔒 Responsible Disclosure
+
+1. **DO NOT** open a public GitHub issue for security vulnerabilities
+2. Email us directly at: **[email protected]**
+3. Include detailed information about the vulnerability
+4. Allow us reasonable time to investigate and address the issue
+
+### 📋 What to Include
+
+When reporting a security vulnerability, please include:
+
+- **Description**: Clear description of the vulnerability
+- **Impact**: Potential impact and severity assessment
+- **Reproduction**: Step-by-step instructions to reproduce
+- **Environment**: Affected versions, browsers, or configurations
+- **Evidence**: Screenshots, logs, or proof-of-concept (if applicable)
+
+### ⏰ Response Timeline
+
+- **Initial Response**: Within 24 hours
+- **Investigation**: 1-7 days depending on complexity
+- **Fix Development**: 1-14 days depending on severity
+- **Disclosure**: After fix is deployed and verified
+
+### 🛡️ Security Measures
+
+Our application implements multiple security layers:
+
+#### Authentication & Authorization
+- **Supabase Auth**: Industry-standard authentication with JWT tokens
+- **Team-based Access Control**: Multi-tenant isolation
+- **Session Management**: Secure token rotation and expiration
+- **Rate Limiting**: Upstash Redis-based request throttling
+
+#### Data Protection
+- **Input Validation**: Comprehensive validation on all user inputs
+- **File Upload Security**: Type validation, size limits, and content scanning
+- **Sandbox Isolation**: E2B sandboxed execution environment
+- **No Persistent Storage**: Temporary file processing only
+
+#### API Security
+- **CORS Configuration**: Strict cross-origin resource sharing policies
+- **Request Validation**: Schema validation using Zod
+- **Error Handling**: Sanitized error responses without sensitive data
+- **Timeout Protection**: Request and execution timeout limits
+
+#### Code Generation Security
+- **Strict Constraints**: No external dependency injection
+- **File System Isolation**: Operations limited to uploaded files only
+- **Content Filtering**: Prohibited code pattern detection
+- **AST Validation**: Abstract syntax tree validation for safe code generation
+
+#### Infrastructure Security
+- **HTTPS Only**: All communications encrypted in transit
+- **Environment Variables**: Sensitive configuration secured
+- **Dependency Scanning**: Regular security updates and vulnerability scanning
+- **Monitoring**: Real-time security event monitoring
+
+### 🔍 Security Best Practices for Users
+
+When using CodinIT:
+
+1. **File Uploads**: Only upload files you own or have permission to process
+2. **Sensitive Data**: Never upload files containing credentials, API keys, or personal data
+3. **Code Review**: Always review generated code before deployment
+4. **Access Control**: Limit team access to necessary members only
+5. **API Keys**: Use dedicated API keys with minimal required permissions
+
+### 🚨 Known Security Considerations
+
+#### File Processing
+- Uploaded files are processed in isolated E2B sandboxes
+- Files are automatically deleted after processing
+- No persistent storage of user code or data
+
+#### Code Generation
+- Generated code is validated but should be reviewed before production use
+- AI-generated code may contain patterns requiring security review
+- External dependencies are explicitly prohibited in generated code
+
+#### Third-Party Integrations
+- **Supabase**: Handles authentication and user management
+- **E2B**: Provides isolated code execution environments
+- **Upstash**: Manages rate limiting and temporary data
+- **Vercel**: Hosts the application with security best practices
+
+### 📜 Compliance
+
+We are committed to maintaining compliance with:
+
+- **GDPR**: European data protection regulations
+- **SOC 2**: Security and availability controls
+- **Industry Standards**: Following OWASP security guidelines
+
+### 🔄 Security Updates
+
+- Security patches are prioritized and deployed immediately
+- Dependencies are regularly updated and scanned for vulnerabilities
+- Security advisories are published for critical issues
+
+### 📞 Contact Information
+
+For security-related inquiries:
+- **Email**: [email protected]
+- **Response Time**: Within 24 hours
+- **Encryption**: PGP key available upon request
+
+### 🏆 Security Recognition
+
+We appreciate responsible disclosure and may recognize security researchers who help improve our security posture:
+
+- Public acknowledgment (with permission)
+- Hall of fame listing
+- Potential monetary rewards for critical vulnerabilities (case-by-case basis)
+
+---
+
+For general questions or support, please use our regular support channels at [email protected]

components/ui/v0-ai-chat.tsx

@@ -12,7 +12,7 @@ import type { LLMModel, LLMModelConfig } from "@/lib/models"
 import type { TemplateId, TemplatesDataObject } from "@/lib/templates"
 import { Alert, AlertDescription, AlertTitle } from "@/components/ui/alert"
 import { FigmaImportModal } from "@/components/modals/figma-import-modal"
-import { ProjectUploadModal } from "@/components/modals/project-upload-modal"
+import { EnhancedProjectUploadModal } from "@/components/modals/project-upload-modal"
 import { ScreenshotCloneModal } from "@/components/modals/screenshot-clone-modal"
 import { countWords, isWithinWordLimit, getWordLimitMessage } from "@/lib/prompt-utils"
 import { TypingAnimation } from "@/components/typing-animation"
@@ -181,7 +181,8 @@ export function VercelV0Chat({
     setProgrammaticSubmitCounter(prev => prev + 1)
   }
 
-  const handleProjectUpload = (uploadedFiles: File[], instructions?: string) => {
+  const handleProjectUpload = (uploadedFiles: File[], analysis?: any, instructions?: string) => {
+    // TODO: Utilize the 'analysis' object if needed for prompt generation or other logic
     const prompt = `📁 **Project Analysis & Enhancement**\n\nAnalyze these ${uploadedFiles.length} uploaded files and provide comprehensive improvements. ${instructions ? `\n\nFocus areas: ${instructions}` : ""}`
     handleFileChange(uploadedFiles)
     handleInputChange({ target: { value: prompt } } as any)
@@ -417,7 +418,7 @@ export function VercelV0Chat({
           </div>
           <div className="rainbow-button-border">
             <div className="rainbow-button-content">
-              <ProjectUploadModal onUpload={handleProjectUpload} isLoading={isLoading} />
+              <EnhancedProjectUploadModal onUpload={handleProjectUpload} isLoading={isLoading} />
             </div>
           </div>
           <div className="rainbow-button-border">