fix(security): suppress the CodeQL password-hash false positive on sha256Hex

[TheodoreSpeaks]

Summary

CodeQL fails #5963 (the v0.7.46 release PR) with 2 high-severity js/insufficient-password-hash alerts on packages/security/src/hash.ts:12 and :14. Both are false positives, but the check is required, so the release is blocked.

Why they appeared now. d362e6816e (setup wizard) added sha256Base64Url to this file. Touching it made every pre-existing taint path that ends here count as "new code changed by this pull request" — CodeQL's own summary hints at this ("Alerts not introduced by this pull request might have been detected because the code changes were too large"). The flagged lines are in sha256Hex, which was not modified, and neither were any of its callers.

Why they're false positives. Neither taint source is a human-chosen password:

Caller	What it passes
hashApiKey(plainKey)	An API key built from generateSecureToken(24) = randomBytes(24) — 192 bits. A fast digest is the correct construction for an indexed WHERE key_hash = $1 lookup; a slow KDF would run on every authenticated request and buy nothing against a keyspace that cannot be searched.
passwordSlot(encryptedPassword)	An already-encrypted value, hashed to an 8-char discriminator so deployment auth tokens invalidate when the password changes. Not credential storage.

User credentials never reach this helper — Better Auth owns them and applies its own KDF. I verified there is no other password-shaped caller.

Approach

Inline // lgtm[js/insufficient-password-hash] on the two flagged lines, matching the convention this repo already uses for the same class of judgement (uuidV5 in apps/sim/ee/workspace-forking/lib/remap/block-identity.ts suppresses js/weak-cryptographic-algorithm the same way; there are currently 0 open alerts for that rule, so the mechanism works).

The sha256Hex doc comment now states the invariant — high-entropy secrets and content digests only, genuine passwords go to Better Auth — so a future caller has the rule in front of them rather than inheriting a silent suppression.

sha256Base64Url is deliberately left unannotated even though it is the same primitive: it was not flagged, and a speculative suppression there would hide a real finding later.

Type of Change

• Bug fix (unblocks a failing required check)

Testing

packages/security suite passes (35 tests), bun run lint clean. No behavior change — comments only.

Checklist

• Code follows project style guidelines
• Self-reviewed my changes
• Tests added/updated and passing
• No new warnings introduced
• I confirm that I have read and agree to the terms outlined in the Contributor License Agreement (CLA)

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

1 Skipped Deployment

Project	Deployment	Actions	Updated (UTC)
docs	Skipped		Jul 27, 2026 9:07pm

[cursor]

PR Summary

Low Risk
Comment-only and suppression annotations; hashing logic is unchanged.

Overview
Unblocks a required CodeQL check that flagged sha256Hex with js/insufficient-password-hash on the hash.update calls (false positives from taint on high-entropy API keys and encrypted-password slots, not user passwords).

Adds inline // lgtm[js/insufficient-password-hash] on both hash.update paths in sha256Hex, matching the repo’s existing CodeQL suppression style. Expands the sha256Hex doc comment to state the invariant: fast SHA-256 is for high-entropy secrets and digests only; human passwords stay in Better Auth’s KDF. No runtime behavior change.

^{Reviewed by Cursor Bugbot for commit 491c318. Bugbot is set up for automated code reviews on this repo. Configure here.}

[greptile-apps]

Greptile Summary

This PR documents the intended non-password uses of sha256Hex and adds targeted CodeQL suppression annotations to its two input branches.

• Clarifies that human-chosen passwords require a slow KDF.
• Documents current high-entropy, encrypted-value, and content-digest use cases.
• Adds no runtime behavior changes.

Confidence Score: 5/5

The PR appears safe to merge because it changes only comments and accurately preserves the helper’s existing runtime behavior and usage contract.

The documented invariant matches current callers, and the inline annotations do not alter hashing inputs, outputs, control flow, or security boundaries.

Important Files Changed

Filename	Overview
packages/security/src/hash.ts	Adds accurate usage guidance and targeted static-analysis suppressions without changing hashing behavior.

_{Reviews (1): Last reviewed commit: "fix(security): suppress the CodeQL passw..." | Re-trigger Greptile}