chore(No Story): Describe the security issue in the PR

backend/FinancialAccountManager.java

@@ -10,8 +10,8 @@
 
 class FinancialAccountManager {
     private static String DB_USER;
-    private static String DB_PASSWORD;
-    private static String API_KEY;
+    private static String DB_PASSWORD; // these should not be in the code, should use k8s secret manager
+    private static String API_KEY;  // these should not be in the code, should use k8s secret manager
     private static final Logger logger = Logger.getLogger(FinancialAccountManager.class.getName());
 
     static {
@@ -21,7 +21,7 @@ class FinancialAccountManager {
             DB_USER = config.getDatabase().getDbUser();
             DB_PASSWORD = config.getDatabase().getDbPassword();
             API_KEY = config.getApi().getPaymentGatewayKey();
-            logger.info("user Info" + DB_USER + ", " + API_KEY);
+            logger.info("user Info" + DB_USER + ", " + API_KEY); // sensitive data should not be logged
 
         } catch (IOException e) {
             e.printStackTrace(); 
@@ -30,16 +30,16 @@ class FinancialAccountManager {
 
     public static void main(String[] args) {
         logger.info("Starting banking operations");
-        System.out.println("Connecting to DB with user: " + DB_USER);
+        System.out.println("Connecting to DB with user: " + DB_USER); // printing should not be used
         performBankingOperations();
     }
 
     public static void performBankingOperations() {
         Map<String, Double> accountBalances = fetchBalancesFromDB();
 
-        logger.info("Fetching account balances");
+        logger.info("Fetching account balances"); // customer account balances is sensitive financial data, should not be logged this way, along with the below
         System.out.println("Account Balances:");
-        accountBalances.forEach((name, balance) -> 
+        accountBalances.forEach((name, balance) ->
             System.out.printf("%s: $%.2f%n", name, balance)
         );
 
@@ -65,7 +65,7 @@ public static void processTransaction(String from, String to, double amount) {
                 throw new Exception("Insufficient funds in account: " + from);
             }
 
-            balances.put(from, balances.get(from) - amount);
+            balances.put(from, balances.get(from) - amount); // these are not atomic operations, doing this will cause inconsistency balance calculation. Should use DB transaction with lock ti perform account balance update
             balances.put(to, balances.get(to) + amount);
 
             logger.info("Transaction successful: " + from + " sent $" + amount + " to " + to);

config/config.yaml

@@ -3,7 +3,7 @@
 database:
   dbUser: "{{ssm:/prod/db/user}}"
   dbPassword: "{{ssm:/prod/db/password}}"
-  dbHost: "{{secretsmanager:/prod/db/host}}"
+  dbHost: "{{secretsmanager:/prod/db/host}}" // again, config file itself should not have any sensitive data. All sensitive data should be stored in K8s secret manager
   dbPort: "{{secretsmanager:/prod/db/port}}"
 
 api:

nextJSGraphQLapp_sanitized.iml

@@ -0,0 +1,11 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<module type="JAVA_MODULE" version="4">
+  <component name="NewModuleRootManager" inherit-compiler-output="true">
+    <exclude-output />
+    <content url="file://$MODULE_DIR$">
+      <sourceFolder url="file://$MODULE_DIR$" isTestSource="false" />
+    </content>
+    <orderEntry type="inheritedJdk" />
+    <orderEntry type="sourceFolder" forTests="false" />
+  </component>
+</module>

permissions/check.ts

@@ -15,15 +15,15 @@ export enum Roles {
       CAN_GENERATE_MONTHLY_REPORT: true,
     },
     [Roles.USER]: {
-      CAN_VIEW_SENSITIVE_DATA: true,
-      CAN_DELETE_USERS: false,
+      CAN_VIEW_SENSITIVE_DATA: true, // user should not be able to view sensitive data
+      CAN_DELETE_USERS: false, // not sure how user delete its own account
       CAN_VIEW_TRANSACTION_HISTORY: true,
       CAN_VIEW_ACCOUNT_SETTINGS: true,
       CAN_VIEW_ALL_OUTSTANDING_BALANCES: false,
       CAN_GENERATE_MONTHLY_REPORT: false,
     },
     [Roles.GUEST]: {
-      CAN_VIEW_SENSITIVE_DATA: false, 
+      CAN_VIEW_SENSITIVE_DATA: false, // guest have all permisison to false, not sure what guest can do here
       CAN_DELETE_USERS: false,
       CAN_VIEW_TRANSACTION_HISTORY: false,
       CAN_VIEW_ACCOUNT_SETTINGS: false,
@@ -33,7 +33,7 @@ export enum Roles {
   };
 
 
-  export function permissionCheck(
+  export function permissionCheck( // doing permission check on FE alone is not safe at all
     permission: keyof typeof RolePermissions[Roles.ADMIN],
     session?: { role?: Roles }
   ): boolean {