fix: verified correctness and safety fixes

[izadoesdev]

Depends on #672 and #673 (stacked on codex/test-quality).

Every item here was reproduced as a failing test or live repro first, then fixed, then re-verified. Items that could not be reproduced as real bugs were deliberately skipped (see below).

Fixed

1. IPv6 visitors silently lost geo enrichment (apps/basket/src/utils/ip-geo.ts)
The hand-rolled ipv6Regex only matched the fully-expanded 8-group form, so real addresses (2a00:1450:4009:81f::200e, 2001:db8::1, ::ffff:8.8.8.8) failed validation and getGeo short-circuited to reason: "invalid_or_local_ip". Silent data loss, no error. Replaced both regexes with node:net.isIP (stdlib, zero cost). Repro'd before, test added, green after.

2. Audit CSV exports mangled in Excel (packages/services/src/audit.ts)
No UTF-8 BOM (non-ASCII actor names mis-decoded) and \n instead of RFC 4180 \r\n. Now emits BOM + CRLF; regression pinned.

3. Two sanitizeString implementations had silently diverged (packages/validation vs apps/basket)
Same name, same signature, different output: basket loop-strips nested tags (<scr<script>ipt> -> iptalert(1)), validation single-passed (scrscriptiptalert(1)/script). Ported the loop into validation so both are identical; two stale tests that pinned the weaker behavior updated.

4. IP allowlist helper failed open (apps/basket/src/utils/origin-ip-validation.ts)
isValidIpFromSettings("", ["203.0.113.5"]) returned true. Not exploitable through the current caller (which guards with trustedIp &&), but the helper is re-exported from hooks/auth.ts as a public surface. Now denies empty/whitespace IPs when an allowlist is configured, while still allowing everything when no allowlist is set.

Deliberately not done (bug could not be reproduced)

• picoquery for the pixel query parser: the prototype-pollution bug is already fixed; I re-probed __proto__/constructor/prototype/case variants and the JSON properties path, all clean. Even 20,000-deep nesting neither crashes nor stalls. No reproducible bug means no swap.
• isbot: the hand-maintained bot list is deliberate and has better coverage than the libraries.
• Encryption HKDF + AAD: the missing AAD is real (ciphertext is portable between rows), but both changes break every existing ciphertext without a migration path. Needs a versioned multi-key decrypt plan and your sign-off, not a drive-by change.

Validation

check-types 35/35, lint clean, full turbo test suite green, basket 567/567 with live services.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
dashboard	Ready	Preview	Aug 26, 2026 9:30am
databuddy-status	Ready	Preview	Aug 26, 2026 9:30am

1 Skipped Deployment

Project	Deployment	Actions	Updated (UTC)
documentation	Skipped		Aug 26, 2026 9:30am

[greptile-apps]

Too many files changed for review (535 files, 100 file limit).

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on this repository. Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Repository UI

Review profile: ASSERTIVE

Plan: Pro Plus

Run ID: d75710c8-315f-47ef-9b4e-460f83d3ff6a

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[unkey-deploy]

The latest updates on your projects. Learn more about Unkey Deploy

Name	Status	Preview	Inspect	Updated (UTC)
links (preview)	Ready	Visit Preview	Inspect	Aug 26, 2026 9:29am