GitHub Bounties💵 paid workby pinehill99scored by google/gemini-2.5-flash

SecureBananaLabs/bug-bounty: registerUser access token can reference a different user id

Visit project ↗Discussion ↗

💵 Funded work— see “Deliver it” below for how to respond.

Opportunity

AI-buildable

Traction

Creativity

The take

effort: ~weekend

This is a bounty to fix a specific security bug in a `registerUser` function where the user ID returned and the JWT subject can mismatch due to separate `Date.now()` calls. The fix involves generating the ID once and ensuring consistency, along with adding a regression test. The scope is very narrow and clearly defined within `authService.js`.

Demand & gap

Painkillerdemand 92

Demand

Will. to pay

Gap

Buyer

Enterprise / orgs

The gap in what exists: This is a direct, funded security bug fix that needs to be implemented in an existing project, representing a clear unmet need for the project maintainers.
Wedge to win: The project needs this specific bug fixed and is offering a bounty; delivering a working, tested PR quickly is the wedge.
Reputation value (worth doing free for proof) — 60/100: A merged PR to a public bug bounty repository demonstrates security-conscious coding skills and attention to detail, which is valuable proof-of-work for developer and enterprise clients.
Likely monetization: fixed-price bounty

Deliver it

A starter prompt for Claude Code, what you'll need, and how to reach them.

You are an expert full-stack developer. Your task is to fix a security bug in a Node.js API and add a regression test. The bug is that `registerUser()` in `apps/api/src/services/authService.js` currently uses two separate `Date.now()` calls for the returned user `id` and the JWT `sub` claim. This can lead to a mismatch if time advances between calls. Implement a fix to ensure a single user ID is generated and used consistently for both the returned ID and the JWT `sub`. Develop a regression test within the existing API service test suite that explicitly forces the timestamp to advance between the ID generation and token signing, and then verifies that the JWT `sub` matches the user `id` returned by the registration API. The project uses standard Node.js, Express, and JWT. You can mock `Date.now()` for testing. Provide only the modified `authService.js` and the new/modified test file, along with instructions on how to run the new test.

Prerequisites — cost & what to learn

GitHub accountFree · Free✓ in your stack
Standard for any GitHub-based project.

How you'd build it

1Fork the SecureBananaLabs/bug-bounty repository.
2Locate `apps/api/src/services/authService.js` and modify the `registerUser` function to generate a single user ID and use it consistently for both the returned ID and the JWT `sub`.
3Implement a new test case in the API service tests that simulates time advancement between ID generation and token signing, then asserts that the returned user ID matches the JWT subject.
4Verify all existing tests pass alongside the new regression test.
5Open a pull request to the original repository addressing issue #2845.

Risks & moats

Understanding the existing codebase architecture in `SecureBananaLabs/bug-bounty` quickly might take some initial effort.
The regression test might require mocking or careful manipulation of system time, which can be tricky to implement reliably.
Ensuring the fix doesn't introduce other subtle authentication or ID generation bugs.
The bounty might be competitive, even with the author limitation, if others also create similar issues.

Original context

Bounty (amount on the issue). ## Bug `registerUser()` currently builds the returned `id` and the JWT `sub` with two separate `Date.now()` calls. If time advances between those calls, the API can return one user id while signing an access token for a different subject. Downstream authenticated requests would then identify a different user than the one returned by registration. ## Expected fix Generate the new user id once, return that id, and sign the access token with the same id as `sub`. Add a regression test that forces the timestamp to advance between calls and verifies the token subject matches the returned id. ## Scope This issue is limited to the registration response/token subject mismatch in `apps/api/src/services/authService.js` plus focused API service test coverage. This issue is limited only to the creator of this issue. This means that only the issue author can attempt to solve this issue. If you would like to work on it, please create another issue with the same contents and refer to issue #743 for more information. References #743.