fix(core): Refuse default superadmin credentials in production by grolmus · Pull Request #4718 · vendurehq/vendure

grolmus · 2026-05-11T13:45:17Z

Summary

Vendure ships with the well-known defaults superadmin / superadmin for the initial admin user and has no built-in guard against running with them in production. This is a hard-coded-credentials issue (CWE-798): anyone with network access to a vanilla 3.6.x deployment can log in as superadmin if the operator did not override authOptions.superadminCredentials.

This PR adds a bootstrap-time check that:

Refuses to start the server when NODE_ENV === 'production' and the password matches the default constant from @vendure/common. The default superadmin identifier is intentionally allowed — only a default password is treated as insecure.
Logs a prominent Logger.warn with remediation hints in development / staging / any other non-test environment.
Stays silent in NODE_ENV === 'test' so the existing e2e suite (which uses the defaults by design) keeps a clean output.

The remediation hint points operators at wiring superadminCredentials from environment variables, which is the same pattern most starters already use.

Scope

No schema migration, no public API change.
The well-known constants in @vendure/common are kept as-is — they are still exported because plugins and the e2e/testing layer rely on them.
A more invasive follow-up (auto-generated random password on first init, forced password change on first login) is intentionally left for a future major change. This PR is the minimum-blast-radius patch that closes the critical concern.
Targets minor: refusing to start in production on a default password is a behavioural change, so it ships in a minor release rather than a patch.

Changes

New helper packages/core/src/service/helpers/utils/check-superadmin-credentials.ts containing the pure check (testable, no DI).
AdministratorService.ensureSuperAdminExists now calls the helper before creating / reconciling the superadmin user.
7 new unit tests in the paired spec file covering production / development / staging / test / safe-credentials paths.

Test plan

vitest run service/helpers/utils/check-superadmin-credentials.spec.ts — 7/7 pass
Full @vendure/core unit suite (vitest run) — 819/819 pass; no existing tests regressed
Manual smoke: boot dev server with default config (NODE_ENV unset) → expect a single Logger.warn line about the default password, server starts normally
Manual smoke: boot with NODE_ENV=production and default password → expect bootstrap to throw [Vendure] Refusing to start: Default superadmin password is configured…
Manual smoke: boot with NODE_ENV=production and explicit override → silent, server starts normally

Notes

Reported privately via responsible disclosure (internal Linear OSS-490 — Pratik Karan, 2026-04-03). No public GitHub issue exists.
Only the default password is treated as insecure. Using the well-known superadmin identifier with a strong, non-default password is fully supported (per maintainer review). The guard cannot detect weak-but-custom passwords — enforcing "non-default" is the enforceable boundary; "strong" remains the operator's responsibility.

^{Need help on this PR? Tag @codesmith with what you need.}

Let Codesmith autofix CI failures and bot reviews

vercel · 2026-05-11T13:45:23Z

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
vendure-storybook	Ready	Preview, Comment	Jun 25, 2026 12:54pm

coderabbitai · 2026-05-11T13:51:36Z

Walkthrough

This pull request adds a security validation utility to detect and prevent usage of well-known default superadmin credentials at application bootstrap. The utility function checkSuperadminCredentials compares provided identifier and password against shipped defaults, then either throws an error in production (halting startup), logs a warning in development/staging, or remains silent in test environments. The check is integrated into AdministratorService.ensureSuperAdminExists() and includes remediation guidance to configure credentials via authOptions.superadminCredentials. A comprehensive test suite validates the environment-specific behavior across all code paths.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title clearly and concisely describes the main change: adding a production-time guard against default superadmin credentials.
Docstring Coverage	✅ Passed	Docstring coverage is 100.00% which is sufficient. The required threshold is 80.00%.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Description check	✅ Passed	The PR description covers the summary, issue context, scope, and test plan, though it doesn’t follow the template sections exactly.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

🧪 Generate unit tests (beta)

Create PR with unit tests

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

_{Comment @coderabbitai help to get the list of available commands.}

michaelbromley

Hi Martin, this is generally a good idea but a couple of changes needed:

We should not disallow the superadmin identifier. It’s totally fine to use that, as long as there’s a non-default, strong password.
This must target the minor branch. It is a breaking change in behaviour.

Vendure shipped with hardcoded default `superadmin` / `superadmin` credentials and no built-in guard against using them in production. Add a bootstrap-time check in `AdministratorService.ensureSuperAdminExists` that inspects `authOptions.superadminCredentials` against the well-known defaults from `@vendure/common`. The check: - throws (refusing to start) when `NODE_ENV === 'production'` and either the identifier or the password matches the default; - logs a `Logger.warn` with remediation hints in development / staging / any other non-test environment; - stays silent in `NODE_ENV === 'test'` to keep the test runner output clean (the e2e suite uses the defaults by design). The check function is extracted to `helpers/utils/check-superadmin-credentials.ts` and covered by unit tests. Existing 819 core unit tests still pass; no schema or public-API change. Reported privately via responsible disclosure (Linear OSS-490).

…sword Address review feedback: the well-known superadmin identifier is fine to use as long as the password is non-default, so the bootstrap guard now checks only the password against the default. Refusing to start in production on a default password is a behavioural change, hence targeted at the minor branch. Relates to OSS-490

vendure-developer-hub · 2026-06-25T12:52:19Z

~~Docs preview~~ — PR merged

grolmus · 2026-06-25T13:01:35Z

all done

vercel Bot deployed to Preview May 11, 2026 13:46 View deployment

michaelbromley requested changes Jun 24, 2026

View reviewed changes

grolmus added 2 commits June 25, 2026 14:37

grolmus force-pushed the fix/oss-490-default-superadmin-credentials-guard branch from e4eaad6 to d56c118 Compare June 25, 2026 12:52

grolmus changed the base branch from master to minor June 25, 2026 12:52

vercel Bot deployed to Preview June 25, 2026 12:54 View deployment

grolmus requested a review from michaelbromley June 25, 2026 13:01

michaelbromley approved these changes Jun 29, 2026

View reviewed changes

michaelbromley merged commit f7aa6af into vendurehq:minor Jun 29, 2026
27 of 28 checks passed

vendure-ci-automation-bot Bot locked and limited conversation to collaborators Jun 29, 2026

Navigation Menu

Uh oh!

fix(core): Refuse default superadmin credentials in production - #4718

fix(core): Refuse default superadmin credentials in production#4718
michaelbromley merged 2 commits into
vendurehq:minorfrom
grolmus:fix/oss-490-default-superadmin-credentials-guard

grolmus commented May 11, 2026 •

edited

Loading

Uh oh!

vercel Bot commented May 11, 2026 •

edited

Loading

Uh oh!

coderabbitai Bot commented May 11, 2026 •

edited

Loading

Uh oh!

michaelbromley left a comment

Uh oh!

vendure-developer-hub Bot commented Jun 25, 2026 •

edited

Loading

Uh oh!

grolmus commented Jun 25, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Uh oh!

Conversation

grolmus commented May 11, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Scope

Changes

Test plan

Notes

Uh oh!

vercel Bot commented May 11, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

coderabbitai Bot commented May 11, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Walkthrough

Uh oh!

michaelbromley left a comment

Choose a reason for hiding this comment

Uh oh!

vendure-developer-hub Bot commented Jun 25, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

grolmus commented Jun 25, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

grolmus commented May 11, 2026 •

edited

Loading

vercel Bot commented May 11, 2026 •

edited

Loading

coderabbitai Bot commented May 11, 2026 •

edited

Loading

vendure-developer-hub Bot commented Jun 25, 2026 •

edited

Loading