Athena — data-leakage-audit.md

Data Leakage Audit — Athena External Network Calls

Date: 2026-09-02
Auditor: athena-external-calls-audit swarm worker
Scope: Full codebase — backend (Java/Spring Boot), frontend (Angular/TypeScript), ops (Helm/nginx), config files
Verdict: ✅ CLEAN — No client/audit data is transmitted to any external third party.


Methodology

Every search below was run against the live HEAD of the repository.

| Search target | Command / grep pattern | |---|---| | Java HTTP clients | RestTemplate\|WebClient\|HttpClient\|OkHttpClient\|HttpURLConnection across backend/src/ | | AI/LLM SDKs | openai\|anthropic\|gpt\|claude\|gemini\|huggingface\|cohere\|langchain (case-insensitive) across backend/src/ | | Analytics/telemetry | sentry\|rollbar\|datadog\|newrelic\|bugsnag\|mixpanel\|segment\|amplitude\|analytics\|telemetry (case-insensitive) across backend/src/ | | External CDNs | unpkg\|cdnjs\|jsdelivr\|googleapis\|gstatic\|cloudflare\|fontawesome across all source files | | Frontend HTTP calls | fetch(\|axios\|XMLHttpRequest\|HttpClient across frontend/athena-web/src/ | | External URLs in configs | application*.yml, environment*.ts read in full | | Hardcoded URLs | http[s]*:// across all source files (excluding namespace IDs, test files, docs) | | Git history | PDF.js / unpkg / CDN commit search | | pom.xml | Full read — all runtime dependencies enumerated | | package.json | Full read — all runtime and devDependencies enumerated |


Backend — Java / Spring Boot

HTTP Client Usage

Result: NONE.

No RestTemplate, WebClient, HttpClient, OkHttpClient, or HttpURLConnection bean or usage was found anywhere in backend/src/main/java/.

The backend makes zero outbound network calls. All data processing (XAF XML parsing, Excel parsing, PDF generation, reconciliation analysis) is entirely in-process.

Evidence:

$ grep -rn "RestTemplate|WebClient|HttpClient|OkHttpClient|HttpURLConnection" \
    --include="*.java" backend/src/
(no output)

AI / LLM Provider SDKs

Result: NONE.

No OpenAI, Anthropic, Google AI, Hugging Face, Cohere, LangChain, or any other LLM SDK dependency or import exists.

Evidence — pom.xml runtime dependencies (complete list):

  • spring-boot-starter-web — Spring MVC
  • spring-boot-starter-data-jpa — JPA/Hibernate
  • flyway-core + flyway-database-postgresql — DB migrations
  • postgresql — JDBC driver
  • spring-boot-starter-validation — Bean Validation
  • spring-security-crypto — password hashing only
  • spring-boot-starter-actuator — health/info endpoints
  • jakarta.xml.bind-api + jaxb-runtime — XAF XML unmarshalling (local)
  • poi-ooxml 5.3.0 — Excel (.xlsx) parsing (local)
  • pdfbox 3.0.8 — PDF generation (local)
  • lombok — compile-time code generation

Zero cloud/AI/analytics SDKs present.

Analytics / Telemetry / Error Tracking

Result: NONE.

No Sentry, Rollbar, Datadog, New Relic, Bugsnag, Mixpanel, Segment, or Amplitude integration found in any Java source file or dependency.

Evidence:

$ grep -rn "sentry|rollbar|datadog|newrelic|mixpanel|segment|amplitude|telemetry" \
    --include="*.java" -i backend/src/
(no output)

Hardcoded External URLs

Result: NONE that make network calls.

The only URL strings found in Java source:

| File | URL string | Purpose | |---|---|---| | config/WebConfig.java:21 | http://localhost:4200 | CORS allowlist for local dev — no outbound call | | xaf/service/XafParser.java:91-93 | http://xml.org/sax/features/..., http://apache.org/xml/features/... | SAX parser feature name constants — strings used as enum-style identifiers, not as network endpoints | | xaf/dto/package-info.java:8 | http://www.auditfiles.nl/XAF/3.2 | JAXB XML namespace identifier — not a network call |

Importantly: XafParser.java:91-93 explicitly disables external entity resolution (XXE prevention):

// backend/src/main/java/nl/glorylabs/athena/xaf/service/XafParser.java:91-93
factory.setFeature("http://xml.org/sax/features/external-general-entities", false);
factory.setFeature("http://xml.org/sax/features/external-parameter-entities", false);
factory.setFeature("http://apache.org/xml/features/disallow-doctype-decl", true);

These are security hardening directives that prevent the XML parser from making outbound network calls when processing uploaded XAF files.

Backend Configuration Files

All application*.yml files examined in full:

  • application.yml — configures Spring datasource (env-injected credentials), Flyway, file upload limits, actuator endpoints (health and info only in production). No external service URLs.
  • application-staging.yml — PostgreSQL driver and Flyway enable flag. No external URLs.
  • application-local.yml — local jdbc:postgresql://localhost:5432/athena. No external URLs.
  • application-test.yml — test configuration. No external URLs.

Frontend — Angular / TypeScript

HTTP Client Usage

Result: ALL calls target the application's own backend.

Every HttpClient call in every service goes to ${environment.apiBaseUrl}, which resolves to:

  • Dev: http://localhost:8096 (own backend)
  • Production/Staging: https://athena.staging.glorylabs.nl (own backend)

Services and their call targets:

| Service file | Endpoints called | |---|---| | shared/services/auth.service.ts | ${apiBaseUrl}/api/auth/* | | shared/services/dossier.service.ts | ${apiBaseUrl}/api/customers/*, ${apiBaseUrl}/api/dossiers/* | | shared/services/analysis.service.ts | ${apiBaseUrl}/api/analysis/*, ${apiBaseUrl}/api/documents/* | | shared/services/admin.service.ts | ${apiBaseUrl}/api/admin/* | | shared/services/upload-link.service.ts | ${apiBaseUrl}/api/analysis/*/upload-link, ${apiBaseUrl}/api/public/upload/* |

No service calls any external host.

External CDN / Script References

Result: NONE.

index.html contains no <script src="..."> or <link href="..."> tags pointing to external hosts. Complete content:

<!doctype html>
<html lang="en">
<head>
  <meta charset="utf-8">
  <title>AthenaWeb</title>
  <base href="/">
  <meta name="viewport" content="width=device-width, initial-scale=1">
  <link rel="icon" type="image/x-icon" href="favicon.ico">
</head>
<body>
  <app-root></app-root>
</body>
</html>

Evidence (CDN scan):

$ grep -rn "unpkg|cdnjs|jsdelivr|googleapis|gstatic|cloudflare|bootstrapcdn|fontawesome|hotjar|gtag|fbq" \
    --include="*.html" --include="*.ts" frontend/
(no output)

Analytics / Telemetry Packages

Result: NONE.

package.json runtime dependencies (complete list):

  • @angular/common, @angular/compiler, @angular/core, @angular/forms, @angular/platform-browser, @angular/router — Angular framework
  • rxjs — reactive extensions
  • tslib — TypeScript runtime helpers

devDependencies: @angular/build, @angular/cli, @angular/compiler-cli, jsdom, prettier, typescript, vitest

No Google Analytics, Mixpanel, Segment, Amplitude, Sentry, LogRocket, Hotjar, Intercom, or any other third-party tracking/telemetry package.

PDF.js / unpkg.com — Specific Verification

The task noted that a worker briefly loaded a PDF.js worker script from unpkg.com. Verification result: no such reference exists anywhere in the current codebase.

  • No pdfjs-dist or pdf.js package in package.json
  • No GlobalWorkerOptions.workerSrc, pdfjsLib, or any pdf.js API in any TypeScript/HTML file
  • No unpkg.com, cdnjs.com, or jsdelivr.net URL in any source file
  • Git history search (git log --all -p filtered for unpkg|cdnjs|jsdelivr|pdfjs) returned zero matches

PDF reports are generated server-side by Apache PDFBox and downloaded as a binary blob via ${apiBaseUrl}/api/analysis/{id}/report/pdf — no client-side PDF rendering library is used.


Ops / Infrastructure

Nginx Configuration (Helm frontend-configmap.yaml)

The nginx config in ops/helm/athena/templates/frontend-configmap.yaml sets this CSP header:

Content-Security-Policy: "default-src 'self' http: https: data: blob: 'unsafe-inline' 'unsafe-eval'"

Note: This CSP allows the browser to connect to any https:// host. This is broader than necessary given that the Angular app only calls its own backend. The CSP is not a current data-leakage vector (the app makes no external calls), but it could reduce the blast radius of a future XSS attack if tightened.

Recommendation (out of scope for this audit — no data leakage today): Tighten the CSP to connect-src 'self' to explicitly restrict outbound connections to the same origin. Raise as a separate hardening ticket.

API Proxy

All /api traffic is proxied to the backend Kubernetes Service (http://athena-backend:8080) within the cluster. No external routing.

Prometheus Scrape Annotation

The Helm pod template sets prometheus.io/scrape: "true" and prometheus.io/path: "/actuator/prometheus". This is in-cluster Prometheus scraping (same namespace). The backend only exposes health and info actuator endpoints in production config — the Prometheus metrics endpoint (/actuator/prometheus) is not enabled in staging/production application.yml (only the wildcard "*" is enabled in application-local.yml). This is not an external data-leakage vector.


Summary

| Category | Finding | Status | |---|---|---| | Backend outbound HTTP calls | None | ✅ CLEAN | | AI/LLM provider SDK or REST calls | None | ✅ CLEAN | | Analytics / telemetry SDKs | None | ✅ CLEAN | | Error tracking services | None | ✅ CLEAN | | External CDN references (scripts/styles) | None | ✅ CLEAN | | Frontend HTTP calls to external hosts | None — all calls go to own backend | ✅ CLEAN | | PDF.js / unpkg.com reference | Not present anywhere in codebase or git history | ✅ CLEAN | | External URLs in application config | None — DB and own-domain URLs only | ✅ CLEAN | | XXE protection in XML parser | External entity resolution explicitly disabled | ✅ SECURE | | CSP header | Permissive (allows any https: host) — no current leakage but suboptimal | ⚠️ NOTE |

No code fix was required. No client audit data (XAF transactions, financial figures, or any business data) is transmitted to any external party under any code path.

Reacties

Nog geen reacties