Hacktoberfest 2026: the issues maintainers tagged for October, open and beginner-friendly. Browse Hacktoberfest issues

packages/stats/core/drizzle.config.ts disables TLS certificate verification for the stats MySQL connection

Open Beginner friendly
  • Is something wrong?
#59,886 1 comment 0 reactions 0 assignees View on GitHub

Maintainers usually reply within 1 day

Nobody has claimed this yet.

Assessment

Difficulty
2/5
Estimated time
1-3 hours
Newbie friendliness
66/100
Issue type
Bug
Clarity
Clearly specified
Activity status
Active
Tech stack
bun, mysql, typescript
Domain
databases, security

Research direction

Read packages/stats/core/drizzle.config.ts and the db:generate, db:push, and db:studio scripts in packages/stats/core/package.json. Confirm which CA the stats database uses, then run bun run --cwd packages/stats/core db:studio or db:generate with verification enabled. Done means the tooling verifies the database certificate and connects successfully.

Written by the indexing model from the issue text.

Description

Summary

packages/stats/core/drizzle.config.ts sets rejectUnauthorized: false in its MySQL ssl options (lines 16-18). The db:generate, db:push and db:studio scripts in packages/stats/core/package.json use this config, so the connection to the stats database skips server certificate verification whenever those scripts run.

Why it matters

A connection that skips certificate verification will accept any certificate presented by the server. Someone positioned on the network path between the machine running these scripts and the database could impersonate the database, read or alter the traffic, and capture the database credentials that the config reads from SST resources. Real-world exposure depends on where these scripts run and how the database is reached, which is why this is a hardening request rather than a confirmed exploit.

Suggested change

  • Remove rejectUnauthorized: false, so verification is on by default.
  • If the database uses a private or self-signed CA, configure that CA explicitly (for example, a ca value read from a resource), rather than disabling verification.

How to check

Confirm that the stats database presents a certificate issued by a CA the tooling trusts, then run bun run --cwd packages/stats/core db:studio or db:generate with verification enabled.

Notes

  • Found with static analysis; the connection was not exercised.
  • No CI job invokes this config directly, as far as the repository shows.
Dominant language
TypeScript
Stars
221k
Forks
29.6k
Avg merge
4h 55m
Merged PRs (30d)
500

Getting set up

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

More from anomalyco/opencode

All issues in anomalyco/opencode

Similar issues

More TypeScript issues

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.