Date: 2026-09-02
Auditor: athena-external-calls-audit swarm worker
Scope: Full codebase — backend (Java/Spring Boot), frontend (Angular/TypeScript), ops (Helm/nginx), config files
Verdict: ✅ CLEAN — No client/audit data is transmitted to any external third party.
Every search below was run against the live HEAD of the repository.
| Search target | Command / grep pattern |
|---|---|
| Java HTTP clients | RestTemplate\|WebClient\|HttpClient\|OkHttpClient\|HttpURLConnection across backend/src/ |
| AI/LLM SDKs | openai\|anthropic\|gpt\|claude\|gemini\|huggingface\|cohere\|langchain (case-insensitive) across backend/src/ |
| Analytics/telemetry | sentry\|rollbar\|datadog\|newrelic\|bugsnag\|mixpanel\|segment\|amplitude\|analytics\|telemetry (case-insensitive) across backend/src/ |
| External CDNs | unpkg\|cdnjs\|jsdelivr\|googleapis\|gstatic\|cloudflare\|fontawesome across all source files |
| Frontend HTTP calls | fetch(\|axios\|XMLHttpRequest\|HttpClient across frontend/athena-web/src/ |
| External URLs in configs | application*.yml, environment*.ts read in full |
| Hardcoded URLs | http[s]*:// across all source files (excluding namespace IDs, test files, docs) |
| Git history | PDF.js / unpkg / CDN commit search |
| pom.xml | Full read — all runtime dependencies enumerated |
| package.json | Full read — all runtime and devDependencies enumerated |
Result: NONE.
No RestTemplate, WebClient, HttpClient, OkHttpClient, or HttpURLConnection bean or usage was found anywhere in backend/src/main/java/.
The backend makes zero outbound network calls. All data processing (XAF XML parsing, Excel parsing, PDF generation, reconciliation analysis) is entirely in-process.
Evidence:
$ grep -rn "RestTemplate|WebClient|HttpClient|OkHttpClient|HttpURLConnection" \
--include="*.java" backend/src/
(no output)
Result: NONE.
No OpenAI, Anthropic, Google AI, Hugging Face, Cohere, LangChain, or any other LLM SDK dependency or import exists.
Evidence — pom.xml runtime dependencies (complete list):
spring-boot-starter-web — Spring MVCspring-boot-starter-data-jpa — JPA/Hibernateflyway-core + flyway-database-postgresql — DB migrationspostgresql — JDBC driverspring-boot-starter-validation — Bean Validationspring-security-crypto — password hashing onlyspring-boot-starter-actuator — health/info endpointsjakarta.xml.bind-api + jaxb-runtime — XAF XML unmarshalling (local)poi-ooxml 5.3.0 — Excel (.xlsx) parsing (local)pdfbox 3.0.8 — PDF generation (local)lombok — compile-time code generationZero cloud/AI/analytics SDKs present.
Result: NONE.
No Sentry, Rollbar, Datadog, New Relic, Bugsnag, Mixpanel, Segment, or Amplitude integration found in any Java source file or dependency.
Evidence:
$ grep -rn "sentry|rollbar|datadog|newrelic|mixpanel|segment|amplitude|telemetry" \
--include="*.java" -i backend/src/
(no output)
Result: NONE that make network calls.
The only URL strings found in Java source:
| File | URL string | Purpose |
|---|---|---|
| config/WebConfig.java:21 | http://localhost:4200 | CORS allowlist for local dev — no outbound call |
| xaf/service/XafParser.java:91-93 | http://xml.org/sax/features/..., http://apache.org/xml/features/... | SAX parser feature name constants — strings used as enum-style identifiers, not as network endpoints |
| xaf/dto/package-info.java:8 | http://www.auditfiles.nl/XAF/3.2 | JAXB XML namespace identifier — not a network call |
Importantly: XafParser.java:91-93 explicitly disables external entity resolution (XXE prevention):
// backend/src/main/java/nl/glorylabs/athena/xaf/service/XafParser.java:91-93
factory.setFeature("http://xml.org/sax/features/external-general-entities", false);
factory.setFeature("http://xml.org/sax/features/external-parameter-entities", false);
factory.setFeature("http://apache.org/xml/features/disallow-doctype-decl", true);
These are security hardening directives that prevent the XML parser from making outbound network calls when processing uploaded XAF files.
All application*.yml files examined in full:
application.yml — configures Spring datasource (env-injected credentials), Flyway, file upload limits, actuator endpoints (health and info only in production). No external service URLs.application-staging.yml — PostgreSQL driver and Flyway enable flag. No external URLs.application-local.yml — local jdbc:postgresql://localhost:5432/athena. No external URLs.application-test.yml — test configuration. No external URLs.Result: ALL calls target the application's own backend.
Every HttpClient call in every service goes to ${environment.apiBaseUrl}, which resolves to:
http://localhost:8096 (own backend)https://athena.staging.glorylabs.nl (own backend)Services and their call targets:
| Service file | Endpoints called |
|---|---|
| shared/services/auth.service.ts | ${apiBaseUrl}/api/auth/* |
| shared/services/dossier.service.ts | ${apiBaseUrl}/api/customers/*, ${apiBaseUrl}/api/dossiers/* |
| shared/services/analysis.service.ts | ${apiBaseUrl}/api/analysis/*, ${apiBaseUrl}/api/documents/* |
| shared/services/admin.service.ts | ${apiBaseUrl}/api/admin/* |
| shared/services/upload-link.service.ts | ${apiBaseUrl}/api/analysis/*/upload-link, ${apiBaseUrl}/api/public/upload/* |
No service calls any external host.
Result: NONE.
index.html contains no <script src="..."> or <link href="..."> tags pointing to external hosts. Complete content:
<!doctype html>
<html lang="en">
<head>
<meta charset="utf-8">
<title>AthenaWeb</title>
<base href="/">
<meta name="viewport" content="width=device-width, initial-scale=1">
<link rel="icon" type="image/x-icon" href="favicon.ico">
</head>
<body>
<app-root></app-root>
</body>
</html>
Evidence (CDN scan):
$ grep -rn "unpkg|cdnjs|jsdelivr|googleapis|gstatic|cloudflare|bootstrapcdn|fontawesome|hotjar|gtag|fbq" \
--include="*.html" --include="*.ts" frontend/
(no output)
Result: NONE.
package.json runtime dependencies (complete list):
@angular/common, @angular/compiler, @angular/core, @angular/forms, @angular/platform-browser, @angular/router — Angular frameworkrxjs — reactive extensionstslib — TypeScript runtime helpersdevDependencies: @angular/build, @angular/cli, @angular/compiler-cli, jsdom, prettier, typescript, vitest
No Google Analytics, Mixpanel, Segment, Amplitude, Sentry, LogRocket, Hotjar, Intercom, or any other third-party tracking/telemetry package.
The task noted that a worker briefly loaded a PDF.js worker script from unpkg.com. Verification result: no such reference exists anywhere in the current codebase.
pdfjs-dist or pdf.js package in package.jsonGlobalWorkerOptions.workerSrc, pdfjsLib, or any pdf.js API in any TypeScript/HTML fileunpkg.com, cdnjs.com, or jsdelivr.net URL in any source filegit log --all -p filtered for unpkg|cdnjs|jsdelivr|pdfjs) returned zero matchesPDF reports are generated server-side by Apache PDFBox and downloaded as a binary blob via ${apiBaseUrl}/api/analysis/{id}/report/pdf — no client-side PDF rendering library is used.
The nginx config in ops/helm/athena/templates/frontend-configmap.yaml sets this CSP header:
Content-Security-Policy: "default-src 'self' http: https: data: blob: 'unsafe-inline' 'unsafe-eval'"
Note: This CSP allows the browser to connect to any https:// host. This is broader than necessary given that the Angular app only calls its own backend. The CSP is not a current data-leakage vector (the app makes no external calls), but it could reduce the blast radius of a future XSS attack if tightened.
Recommendation (out of scope for this audit — no data leakage today): Tighten the CSP to connect-src 'self' to explicitly restrict outbound connections to the same origin. Raise as a separate hardening ticket.
All /api traffic is proxied to the backend Kubernetes Service (http://athena-backend:8080) within the cluster. No external routing.
The Helm pod template sets prometheus.io/scrape: "true" and prometheus.io/path: "/actuator/prometheus". This is in-cluster Prometheus scraping (same namespace). The backend only exposes health and info actuator endpoints in production config — the Prometheus metrics endpoint (/actuator/prometheus) is not enabled in staging/production application.yml (only the wildcard "*" is enabled in application-local.yml). This is not an external data-leakage vector.
| Category | Finding | Status | |---|---|---| | Backend outbound HTTP calls | None | ✅ CLEAN | | AI/LLM provider SDK or REST calls | None | ✅ CLEAN | | Analytics / telemetry SDKs | None | ✅ CLEAN | | Error tracking services | None | ✅ CLEAN | | External CDN references (scripts/styles) | None | ✅ CLEAN | | Frontend HTTP calls to external hosts | None — all calls go to own backend | ✅ CLEAN | | PDF.js / unpkg.com reference | Not present anywhere in codebase or git history | ✅ CLEAN | | External URLs in application config | None — DB and own-domain URLs only | ✅ CLEAN | | XXE protection in XML parser | External entity resolution explicitly disabled | ✅ SECURE | | CSP header | Permissive (allows any https: host) — no current leakage but suboptimal | ⚠️ NOTE |
No code fix was required. No client audit data (XAF transactions, financial figures, or any business data) is transmitted to any external party under any code path.
Reacties