fix: Various security patches

[driaug]

Description

Type of Change

• feat: New feature (MINOR version bump)
• fix: Bug fix (PATCH version bump)
• feat!: Breaking change - new feature (MAJOR version bump)
• fix!: Breaking change - bug fix (MAJOR version bump)
• docs: Documentation update (no version bump)
• chore: Maintenance/dependencies (no version bump)
• refactor: Code refactoring (no version bump)
• test: Adding tests (no version bump)
• perf: Performance improvement (PATCH version bump)

PR Title Format

Testing

Checklist

• PR title follows conventional commits format
• Code builds successfully
• Tests pass locally
• Documentation updated (if needed)

Related Issues

Closes #

[Copilot]

Pull request overview

This PR adds cache invalidation around project auth-affecting changes, canonicalizes domain handling, and limits stored webhook response bodies to reduce memory risk.

Changes:

• Adds ProjectService.invalidate and calls it after project disables, Stripe updates, project edits, and key regeneration.
• Canonicalizes domains and uses tldts for registrable root-domain detection.
• Caps workflow webhook response bodies and invalidates email-based user cache after password resets.

Reviewed changes

Copilot reviewed 9 out of 10 changed files in this pull request and generated 4 comments.

Show a summary per file

File	Description
apps/api/src/services/WorkflowExecutionService.ts	Adds capped webhook response body reading.
apps/api/src/services/SecurityService.ts	Invalidates project cache after security/phishing disables.
apps/api/src/services/ProjectService.ts	Adds project cache invalidation helper.
apps/api/src/services/keys.ts	Normalizes user email cache keys.
apps/api/src/services/DomainService.ts	Adds domain canonicalization and PSL-based root-domain logic.
apps/api/src/controllers/Webhooks.ts	Invalidates project caches after Stripe webhook updates.
apps/api/src/controllers/Users.ts	Invalidates project caches after project updates/key regeneration.
apps/api/src/controllers/Auth.ts	Clears email cache on password reset.
apps/api/package.json	Adds tldts dependency.
yarn.lock	Locks tldts and tldts-core.

Comments suppressed due to low confidence (1)

apps/api/src/services/WorkflowExecutionService.ts:1008

• When the response reaches the byte cap exactly, this loop exits without reading again, so truncated remains false even if more data is available in the next chunk. Oversized webhook responses whose chunks align to 64 KiB will be returned as capped but not marked truncated; read one extra chunk/byte (or set truncated when the cap is hit before EOF is observed) to report this accurately.

      while (received < maxBytes) {
        const {done, value} = await reader.read();
        if (done) break;
        if (!value) continue;

        const remaining = maxBytes - received;
        if (value.byteLength > remaining) {
          chunks.push(value.subarray(0, remaining));
          received += remaining;
          truncated = true;
          break;

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.