security: fix scanner findings from rapid-audit-kit recon pass

Prep work before building the self-serve audit kit — ran govulncheck, gosec,
gitleaks (full history), syft SBOM, pnpm audit, and semgrep against the current
codebase for the first time, then fixed everything real and documented everything
false-positive rather than letting the kit launch against an unverified scan.

Real fixes:
- golang.org/x/image bumped from a 2021 pseudo-version to v0.43.0 — the old pin
  carried 11 known CVEs (TIFF/WebP/BMP decode DoS/panic) reachable via the
  branding-logo upload path. govulncheck now reports zero vulnerabilities.
- Avatar/branding upload directories created 0750 instead of 0755 (gosec G301).

Noise cleanup (37 gosec G104 "unhandled error" findings, all verified low-risk):
- worker.go job-status/webhook-delivery bookkeeping updates and avatar/logo
  temp-file cleanup now log on failure (genuine value — a stuck job or an
  orphaned temp file is worth knowing about).
- The rest (rows.Close()/resp.Body.Close() on already-consumed/already-erroring
  paths, and a few best-effort exists-checks backed by a DB UNIQUE constraint)
  are documented `#nosec G104` with the reasoning inline, not silently ignored.

semgrep (9 findings, all false positives, now inline-documented + suppressed):
- var-in-href on .PrivacyURL/.TermsURL: server-validated to require an http(s)
  scheme before storage (validatedLegalURL), so a javascript: URI never reaches
  the template.
- unquoted-attribute-var on the intake-question id/name attrs: admin-configured
  question IDs, and html/template context-escapes them regardless.
- var-in-script-tag on .BookingLogicJS (book.html + manage.html): a static
  go:embed'd JS asset, never request/database data.

Verified false positives left as-is (gosec G202/G701 "SQL injection" — all
parameterized with ? placeholders; G203 "XSS" — goldmark markdown has no
WithUnsafe(), template.JS wraps embedded/JSON-marshaled data; G304 path
traversal — validated + filepath.Base()'d; G124/G101 — cookies do set
Secure/HttpOnly/SameSite, "secret" was a public OAuth endpoint URL).

govulncheck: 0. gosec: 82->43 (all remaining verified false positives).
semgrep: 9->0. gitleaks: clean across 321 commits. go test ./...: all pass.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Author: shockalotti

frontend/embed.go

@@ -48,7 +48,7 @@ func (h *spaHandler) ServeHTTP(w http.ResponseWriter, r *http.Request) {
 	f, err := h.fs.Open(r.URL.Path)
 	if err == nil {
 		st, statErr := f.Stat()
-		f.Close()
+		f.Close() // #nosec G104 -- handle already Stat()-ed above; nothing actionable on close error
 		// Treat directories as not-found so the SPA shell handles the route
 		// instead of http.FileServer rendering a directory listing.
 		if statErr == nil && st.IsDir() {

go.mod

@@ -9,7 +9,7 @@ require (
 	github.com/pressly/goose/v3 v3.27.1
 	github.com/yuin/goldmark v1.8.2
 	golang.org/x/crypto v0.53.0
-	golang.org/x/image v0.0.0-20211028202545-6944b10bf410
+	golang.org/x/image v0.43.0
 	golang.org/x/oauth2 v0.36.0
 	modernc.org/sqlite v1.49.1
 )

go.sum

@@ -51,8 +51,8 @@ go.uber.org/multierr v1.11.0/go.mod h1:20+QtiLqy0Nd6FdQB9TLXag12DsQkrbs3htMFfDN8
 golang.org/x/crypto v0.53.0 h1:QZ4Muo8THX6CizN2vPPd5fBGHyogrdK9fG4wLPFUsto=
 golang.org/x/crypto v0.53.0/go.mod h1:DNLU434OwVakk9PzuwV8w62mAJpRJL3vsgcfp4Qnsio=
 golang.org/x/image v0.0.0-20191009234506-e7c1f5e7dbb8/go.mod h1:FeLwcggjj3mMvU+oOTbSwawSJRM1uh48EjtB4UJZlP0=
-golang.org/x/image v0.0.0-20211028202545-6944b10bf410 h1:hTftEOvwiOq2+O8k2D5/Q7COC7k5Qcrgc2TFURJYnvQ=
-golang.org/x/image v0.0.0-20211028202545-6944b10bf410/go.mod h1:023OzeP/+EPmXeapQh35lcL3II3LrY8Ic+EFFKVhULM=
+golang.org/x/image v0.43.0 h1:FLxcP4ec2350nTfOC8ysKtqYSIFbk/QGjw1ZHNP4tsY=
+golang.org/x/image v0.43.0/go.mod h1:rrpelvGFt+kLPAjPM4HeWPgrl0FtafueU//e5N0qk/Q=
 golang.org/x/mod v0.33.0 h1:tHFzIWbBifEmbwtGz65eaWyGiGZatSrT9prnU8DbVL8=
 golang.org/x/mod v0.33.0/go.mod h1:swjeQEj+6r7fODbD2cqrnje9PnziFuw4bmLbBZFrQ5w=
 golang.org/x/oauth2 v0.36.0 h1:peZ/1z27fi9hUOFCAZaHyrpWG5lwe0RJEEEeH0ThlIs=
@@ -62,8 +62,6 @@ golang.org/x/sync v0.20.0/go.mod h1:9xrNwdLfx4jkKbNva9FpL6vEN7evnE43NNNJQ2LF3+0=
 golang.org/x/sys v0.46.0 h1:noSf2Fq6F8DBgS+LysIkx7rIExoNHJsxOAtPp4rthXw=
 golang.org/x/sys v0.46.0/go.mod h1:4GL1E5IUh+htKOUEOaiffhrAeqysfVGipDYzABqnCmw=
 golang.org/x/text v0.3.0/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
-golang.org/x/text v0.3.6/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
-golang.org/x/tools v0.0.0-20180917221912-90fa682c2a6e/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
 golang.org/x/tools v0.42.0 h1:uNgphsn75Tdz5Ji2q36v/nsFSfR/9BRFvqhGBaJGd5k=
 golang.org/x/tools v0.42.0/go.mod h1:Ma6lCIwGZvHK6XtgbswSoWroEkhugApmsXyrUmBhfr0=
 gopkg.in/yaml.v3 v3.0.1 h1:fxVm/GzAzEWqLHuvctI91KS9hhNmmWOoWu0XTYJS7CA=

internal/booking/service.go

@@ -475,12 +475,12 @@ func (s *Service) Reschedule(ctx context.Context, bookingID string, newStart, ne
 	for hostRows.Next() {
 		var u string
 		if err := hostRows.Scan(&u); err != nil {
-			hostRows.Close()
+			hostRows.Close() // #nosec G104 -- already returning the scan error; nothing more actionable
 			return nil, fmt.Errorf("booking: reschedule hosts scan: %w", err)
 		}
 		hostIDs = append(hostIDs, u)
 	}
-	hostRows.Close()
+	hostRows.Close() // #nosec G104 -- rows already fully consumed above; nothing actionable on close error
 	if len(hostIDs) == 0 { // legacy booking with no booking_hosts rows
 		hostIDs = []string{b.HostID}
 	}

internal/calendar/microsoft/freebusy.go

@@ -77,11 +77,11 @@ func (c *Client) freeBusyForClient(ctx context.Context, hc *http.Client, from, t
 		var cv calendarViewResp
 		if resp.StatusCode != http.StatusOK {
 			msg := graphErrBody(resp)
-			resp.Body.Close()
+			resp.Body.Close() // #nosec G104 -- already returning a more specific error; nothing actionable on close error
 			return nil, fmt.Errorf("microsoft: calendarView status %d: %s", resp.StatusCode, msg)
 		}
 		derr := json.NewDecoder(resp.Body).Decode(&cv)
-		resp.Body.Close()
+		resp.Body.Close() // #nosec G104 -- body already decoded above; nothing actionable on close error
 		if derr != nil {
 			return nil, fmt.Errorf("microsoft: calendarView decode: %w", derr)
 		}

internal/handler/auth_google.go

@@ -97,7 +97,11 @@ func (h *Handler) Logout(w http.ResponseWriter, r *http.Request) {
 	// Only delete the session if the cookie value corresponds to an actual row,
 	// so a forged or empty cookie cannot be used to trigger arbitrary deletes.
 	if cookie, err := r.Cookie(sessionCookieName); err == nil && cookie.Value != "" {
-		h.db.ExecContext(r.Context(), //nolint:errcheck
+		// Best-effort: logout must proceed (cookie is cleared below) even if this fails;
+		// worst case is a harmless stale row that the session's own expiry cleans up.
+		//nolint:errcheck
+		// #nosec G104
+		h.db.ExecContext(r.Context(),
 			`DELETE FROM sessions WHERE id = ?`, cookie.Value)
 	}
 	http.SetCookie(w, &http.Cookie{

internal/handler/avatar.go

@@ -80,7 +80,7 @@ func (h *Handler) UploadAvatar(w http.ResponseWriter, r *http.Request) {
 	}
 
 	avatarDir := filepath.Join(h.dataDir, "avatars")
-	if err := os.MkdirAll(avatarDir, 0o755); err != nil {
+	if err := os.MkdirAll(avatarDir, 0o750); err != nil {
 		h.logger.ErrorContext(r.Context(), "avatar: mkdir", "error", err)
 		h.writeError(w, http.StatusInternalServerError, "internal error")
 		return
@@ -96,9 +96,11 @@ func (h *Handler) UploadAvatar(w http.ResponseWriter, r *http.Request) {
 	tmpPath := tmp.Name()
 	committed := false
 	defer func() {
-		tmp.Close()
+		tmp.Close() // #nosec G104 -- file already written/renamed by this point; nothing actionable
 		if !committed {
-			os.Remove(tmpPath)
+			if rerr := os.Remove(tmpPath); rerr != nil && !os.IsNotExist(rerr) {
+				h.logger.Warn("avatar: cleanup temp file", "error", rerr, "path", tmpPath)
+			}
 		}
 	}()
 

internal/handler/branding_settings.go

@@ -248,7 +248,7 @@ func (h *Handler) UploadBrandingLogo(w http.ResponseWriter, r *http.Request) {
 	}
 
 	dir := h.brandingDir()
-	if err := os.MkdirAll(dir, 0o755); err != nil {
+	if err := os.MkdirAll(dir, 0o750); err != nil {
 		h.logger.ErrorContext(r.Context(), "logo: mkdir", "error", err)
 		h.writeError(w, http.StatusInternalServerError, "internal error")
 		return
@@ -263,9 +263,11 @@ func (h *Handler) UploadBrandingLogo(w http.ResponseWriter, r *http.Request) {
 	tmpPath := tmp.Name()
 	committed := false
 	defer func() {
-		tmp.Close()
+		tmp.Close() // #nosec G104 -- file already written/renamed by this point; nothing actionable
 		if !committed {
-			os.Remove(tmpPath)
+			if rerr := os.Remove(tmpPath); rerr != nil && !os.IsNotExist(rerr) {
+				h.logger.Warn("logo: cleanup temp file", "error", rerr, "path", tmpPath)
+			}
 		}
 	}()
 	if _, err := tmp.Write(out.Bytes()); err != nil {

internal/handler/calendar_reconcile.go

@@ -86,7 +86,7 @@ func (h *Handler) reconcileReschedules(ctx context.Context, gc *calendar.Service
 			items = append(items, d)
 		}
 	}
-	rows.Close()
+	rows.Close() // #nosec G104 -- rows already fully consumed above; nothing actionable on close error
 
 	for _, d := range items {
 		start, err1 := time.Parse(time.RFC3339Nano, d.startStr)
@@ -128,7 +128,7 @@ func (h *Handler) reconcileCancellations(ctx context.Context, gc *calendar.Servi
 			orphans = append(orphans, o)
 		}
 	}
-	rows.Close()
+	rows.Close() // #nosec G104 -- rows already fully consumed above; nothing actionable on close error
 
 	for _, o := range orphans {
 		if err := gc.CancelEvent(ctx, o.userID, o.eventID); err != nil {
@@ -181,7 +181,7 @@ func (h *Handler) reconcileCreations(ctx context.Context, gc *calendar.Service)
 			items = append(items, m)
 		}
 	}
-	rows.Close()
+	rows.Close() // #nosec G104 -- rows already fully consumed above; nothing actionable on close error
 
 	for _, m := range items {
 		has, err := gc.HasDestination(ctx, m.userID)

internal/handler/claim.go

@@ -31,8 +31,12 @@ func (h *Handler) AuthStatus(w http.ResponseWriter, r *http.Request) {
 		providers = append(providers, "microsoft")
 	}
 
+	// Best-effort status flag: on query error emailLoginCount simply stays 0 (treated
+	// as "no email-login users yet"), which is a safe default for this UI hint.
 	var emailLoginCount int
-	h.db.QueryRowContext(r.Context(), //nolint:errcheck
+	//nolint:errcheck
+	// #nosec G104
+	h.db.QueryRowContext(r.Context(),
 		`SELECT COUNT(*) FROM users WHERE email_login = 1`).Scan(&emailLoginCount)
 
 	h.writeJSON(w, http.StatusOK, map[string]any{