From 2c32f84bf2acfd4fe48a3b66a9c07c04b99c1fdb Mon Sep 17 00:00:00 2001
From: Taesu <166604494+bytaesu@users.noreply.github.com>
Date: Tue, 20 Oct 2026 12:34:14 +0900
Subject: [PATCH] chore: configure Anthropic OSS Scanner (#11932)

---
 .oss-scanner/Dockerfile              | 24 ++++++++++++
 .oss-scanner/Dockerfile.dockerignore |  4 ++
 .oss-scanner/threat_model.md         | 57 ++++++++++++++++++++++++++++
 3 files changed, 85 insertions(+)
 create mode 100644 .oss-scanner/Dockerfile
 create mode 100644 .oss-scanner/Dockerfile.dockerignore
 create mode 100644 .oss-scanner/threat_model.md

diff --git a/.oss-scanner/Dockerfile b/.oss-scanner/Dockerfile
new file mode 100644
index 0000000000..0fa26d2b2b
--- /dev/null
+++ b/.oss-scanner/Dockerfile
@@ -0,0 +1,24 @@
+# syntax=docker/dockerfile:1
+
+# Build environment for Anthropic's OSS Scanner.
+# Network access is only available during this build, so every dependency the
+# scanner needs to run tests offline must be installed here.
+FROM node:24-bookworm
+
+# CI skips lefthook git hook installation and keeps vitest out of watch mode.
+ENV CI=true \
+    PLAYWRIGHT_SKIP_BROWSER_DOWNLOAD=1 \
+    TURBO_TELEMETRY_DISABLED=1
+
+RUN corepack enable
+
+WORKDIR /src
+COPY . .
+
+RUN pnpm install --frozen-lockfile --filter . --filter "./packages/**"
+RUN pnpm build
+
+# Smoke test against the default in-memory SQLite database.
+# Adapter tests need Docker databases and are not available offline.
+RUN pnpm --filter better-auth exec vitest run src/api/routes/sign-in.test.ts \
+    || echo "WARNING: smoke test reported failures"
diff --git a/.oss-scanner/Dockerfile.dockerignore b/.oss-scanner/Dockerfile.dockerignore
new file mode 100644
index 0000000000..dbcea741ce
--- /dev/null
+++ b/.oss-scanner/Dockerfile.dockerignore
@@ -0,0 +1,4 @@
+**/node_modules
+**/dist
+**/.turbo
+**/.next
diff --git a/.oss-scanner/threat_model.md b/.oss-scanner/threat_model.md
new file mode 100644
index 0000000000..ee2e1b92f0
--- /dev/null
+++ b/.oss-scanner/threat_model.md
@@ -0,0 +1,57 @@
+# Threat model
+
+## About this project
+
+Better Auth is an auth framework for TypeScript that developers own and run on
+their own servers, with users stored in their own database.
+
+## Trust boundaries
+
+Requests enter through the API engine in core (router, middleware, hooks) and
+reach core routes and plugin endpoints. Every request is untrusted, including
+OAuth callbacks, SAML responses, and webhooks. The application's configuration
+and server-side code are trusted. Organization admins and the identity
+providers they register are not trusted like the application operator.
+
+## Scope
+
+- In scope: everything under `packages/`, including plugins and client
+  libraries
+- Out of scope: `docs/`, `demo/`, `e2e/`, `test/`, `packages/test-utils`,
+  `packages/release-tooling`, and test files
+
+## How to exercise it
+
+- Run a single test file with `pnpm --filter <package> exec vitest run <path>`.
+- `getTestInstance()` from `packages/better-auth/src/test-utils` creates an
+  instance backed by in-memory SQLite.
+- The origin check is skipped in tests. Set
+  `advanced: { disableOriginCheck: false }` for origin or CSRF findings.
+- Packages resolve each other through `dist/`. Run `pnpm build` after changing
+  a package.
+
+## How you rate severity
+
+Rate impact on the application that uses Better Auth. In order of priority:
+
+1. Authentication bypass or session forgery
+2. Account takeover through password reset, email change, magic link, or OAuth
+   account linking
+3. Open redirect or token leakage through callback URLs
+4. Privilege escalation or cross-tenant access in plugins such as admin and
+   organization
+
+Plugins are not rated lower for being opt-in. Findings that need a non-default
+setting are rated lower, not excluded. Denial of service is low.
+
+## Anything to leave alone
+
+- Usage the docs describe as invalid, such as calling `auth.api` without
+  request headers
+- Findings that need a protection turned off, such as `disableCSRFCheck` or
+  `disableOriginCheck`
+- Missing authorization checks in application code around `auth.api` calls
+- Reproductions that write sessions, roles, or accounts directly to the
+  database instead of going through the endpoints
+- Hardcoded secrets in tests, and the `DEFAULT_SECRET` fallback outside
+  production when no secret is set