GitHub Bounties💵 paid workby fennhelloworldscored by google/gemini-2.5-flash

SecureBananaLabs/bug-bounty: Upload endpoint lacks authentication — unauthenticated file uploads allowed

Visit project ↗Discussion ↗

💵 Funded work— see “Deliver it” below for how to respond.

Opportunity

AI-buildable

Traction

Creativity

The take

effort: ~weekend

This is a bounty to fix a missing authentication middleware on an upload endpoint in a Node.js API. The specific bug is that the /api/uploads route allows unauthenticated file uploads, posing a security risk. The task involves adding a pre-existing authentication middleware to the route.

Demand & gap

Painkillerdemand 86

Demand

Will. to pay

Gap

Buyer

Developers

The gap in what exists: The gap is a specific, well-defined bug in an open-source project that a bounty creator is explicitly paying to fix.
Wedge to win: The wedge is to directly deliver the requested fix for the bounty, demonstrating expertise in Node.js and security.
Reputation value (worth doing free for proof) — 70/100: Successfully delivering a fix for a public bug bounty builds credible proof of work and skill in Node.js security for potential freelance clients or employers.
Likely monetization: bounty payment

Deliver it

A starter prompt for Claude Code, what you'll need, and how to reach them.

You are an expert Node.js developer. I need you to implement a fix for a bug bounty on the `SecureBananaLabs/bug-bounty` GitHub repository, specifically issue #1771 (or a newly created duplicate). The issue states that the `/api/uploads` route lacks authentication. Your task is to apply the `authMiddleware` to this route. 

Here are the steps to follow:
1. Fork the `SecureBananaLabs/bug-bounty` repository.
2. Navigate to `apps/api/src/routes/uploadRoutes.js`.
3. Modify the `uploadRoutes.post("/", upload.single("file"), uploadFile);` line to include `authMiddleware`. Assume `authMiddleware` is already defined and imported in the scope, or locate its import and add it.
4. Create a simple integration test (e.g., using `jest` or `supertest` if configured) that attempts an unauthenticated POST request to `/api/uploads` and asserts it fails with an authentication error (e.g., 401 Unauthorized).
5. Ensure the existing functionality for authenticated users remains intact (if applicable, write a test for an authenticated upload).
6. Provide the modified code and the test results. Explain your changes clearly.

Prerequisites — cost & what to learn

GitHub accountFree · Free

How you'd build it

1Fork the SecureBananaLabs/bug-bounty repository.
2Locate the `apps/api/src/routes/uploadRoutes.js` file.
3Add `authMiddleware` to the `uploadRoutes.post` method as specified in the issue.
4Write a simple test to confirm authentication is now enforced for the upload endpoint.
5Submit a pull request with the fix and provide a brief explanation of the change and test results.

Risks & moats

Understanding the existing codebase and `authMiddleware` implementation could take longer than expected.
Potential for unforeseen side effects if the `authMiddleware` has implicit dependencies.
The bounty might be claimed by another developer before a PR can be submitted.
The 'limited only to the creator of this issue' constraint is tricky; the operator needs to create their own issue first, which might not be honored if the original creator also starts working on it.

Original context

Bounty (amount on the issue). ## Bug: Missing Authentication on Upload Route **Description:** The `/api/uploads` route does not apply `authMiddleware`, meaning anyone can upload files without being authenticated. **File:** `apps/api/src/routes/uploadRoutes.js` **Current code:** ```js uploadRoutes.post("/", upload.single("file"), uploadFile); ``` **Expected behavior:** The upload route should require authentication via `authMiddleware`. **Impact:** Medium — unauthorized file uploads could lead to storage abuse or potential security vulnerabilities. This issue is limited only to the creator of this issue. This means that only the issue author can attempt to solve this issue. If you would like to work on it, please create another issue with the same contents and refer to issue #743 for more information.