From 3cefb08e45d7f75ba6c6bf0581cdf208b31a0191 Mon Sep 17 00:00:00 2001
From: Siebren Bakker <aevum@decess.us>
Date: Wed, 1 Jul 2026 12:03:57 -0500
Subject: [PATCH] Fix CodeQL security alerts

Add missing permissions block to validate-release workflow (medium severity).

Remove exception detail from healthz endpoint to prevent information disclosure (medium severity).

Add CodeQL workflow to scan PRs to dev and main for Python, JavaScript, and GitHub Actions.
---
 .github/workflows/codeql.yaml           | 42 +++++++++++++++++++++++++
 .github/workflows/validate-release.yaml |  2 ++
 config/urls.py                          |  4 +--
 3 files changed, 46 insertions(+), 2 deletions(-)
 create mode 100644 .github/workflows/codeql.yaml

diff --git a/.github/workflows/codeql.yaml b/.github/workflows/codeql.yaml
new file mode 100644
index 0000000..336c645
--- /dev/null
+++ b/.github/workflows/codeql.yaml
@@ -0,0 +1,42 @@
+name: CodeQL
+
+on:
+  pull_request:
+    branches:
+      - dev
+      - main
+  push:
+    branches:
+      - dev
+      - main
+
+jobs:
+  analyze:
+    name: Analyze
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      security-events: write
+      actions: read
+
+    strategy:
+      fail-fast: false
+      matrix:
+        language: ['python', 'javascript', 'actions']
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+
+      - name: Initialize CodeQL
+        uses: github/codeql-action/init@1a818fd5f97ed0ee9a823421bd5b171add01227f # v4.36.2
+        with:
+          languages: ${{ matrix.language }}
+
+      - name: Autobuild
+        uses: github/codeql-action/autobuild@1a818fd5f97ed0ee9a823421bd5b171add01227f # v4.36.2
+
+      - name: Perform CodeQL Analysis
+        uses: github/codeql-action/analyze@1a818fd5f97ed0ee9a823421bd5b171add01227f # v4.36.2
+        with:
+          category: "/language:${{ matrix.language }}"
diff --git a/.github/workflows/validate-release.yaml b/.github/workflows/validate-release.yaml
index ec030ae..30bc372 100644
--- a/.github/workflows/validate-release.yaml
+++ b/.github/workflows/validate-release.yaml
@@ -9,6 +9,8 @@ jobs:
   validate:
     name: Validate version and changelog
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
     steps:
       - name: Checkout PR branch
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
diff --git a/config/urls.py b/config/urls.py
index 24ccf49..86053fd 100644
--- a/config/urls.py
+++ b/config/urls.py
@@ -33,8 +33,8 @@ def healthz(request):
     try:
         connection.ensure_connection()
         return JsonResponse({"status": "ok"})
-    except Exception as e:
-        return JsonResponse({"status": "error", "detail": str(e)}, status=503)
+    except Exception:
+        return JsonResponse({"status": "error"}, status=503)
 
 urlpatterns = [
     path("healthz/", healthz, name="healthz"),