Blue Orchid

At Blue Orchid, I work on an AI platform built with TypeScript, Cloudflare Workers, D1, and R2. My security work covers MCP OAuth, rich-text input, agent approvals, and request limits.

Software engineer

The problem

The API runs on Cloudflare Workers, uses D1 for state, and stores files in R2. People connect accounts and use AI agents with outside tools, so I focused on the points where a sign-in, a document, or a tool response could gain more access than it should.

MCP OAuth and access scope

I built an MCP OAuth pilot that checks who issued a token, which service it is for, and whether the person still belongs to the organization. OAuth users can access a limited set of read-only tools. Existing sign-in paths stayed available while the new flow was introduced.

OAuth callback safety

An OAuth callback should not trust a value the browser can edit. I replaced unsigned callback state with a one-time record in D1, checked that it belonged to the right connection, and used it before exchanging the authorization code. This prevents replay without breaking valid sign-ins.

DOMPurify at the editor boundary

Pasted HTML is untrusted input. I used DOMPurify to clean it before the editor reads it and blocked a second clipboard format that could have skipped the check. People can still paste normal formatting, links, and tables.

Untrusted agent output

An agent may read text from tools or earlier conversations, but that text should not approve a new action. I changed the approval flow so tool output and saved previews are treated as data. A person can still confirm an action by typing the required approval.

Large requests and webhooks

I added size limits that stop oversized MCP, webhook, and API requests before they are parsed or handled. For larger capture data, I changed the reader to process it in chunks and reject excess data before anything reaches R2 or updates a checkpoint. The limit counts actual bytes, so an incorrect header cannot bypass it.

Finding and fixing vulnerable packages

I added checks to pull requests and a weekly scan for known vulnerabilities in JavaScript and Python packages. Later I expanded the checks to include packages pulled in indirectly, development dependencies, and failed scans. I upgraded affected MCP, build, and PDF packages and kept findings visible until they were fixed.

VPS releases

I made sure a patched Python package was used by both the application requirements and the VPS deployment command. I also pinned the command-line tool used for database operations and checked it for vulnerabilities before giving it credentials. I recorded the test results and the production checks that still remained.

Next workKPPAY ↗

Have a problem worth digging into? Let's talk.