Hyperlines

Hyperlines TypeScript Audit and Pentest

Zealynx ran a five-day TypeScript audit and penetration test of the Hyperlines TypeScript applications (liqhub-v2 and trendln-v3) developed under the IPAL Network umbrella. Coverage included the Next.js frontend, Node.js backend, MongoDB and Redis layers, WebSocket transport, and Hyperliquid integration paths. Eleven issues were identified: three High (JWT cookie without HttpOnly/Secure/SameSite flags enabling token theft and CSRF; agent private keys persisted in localStorage; CORS misconfiguration with credentials and reflected origin on third-party analytics API), seven Medium (hardcoded WebSocket endpoints without integrity, unvalidated profile fields, MongoDB without explicit TLS enforcement, missing security headers, three reflected-parameter XSS vectors), and one Informational (sensitive object logging). Ten findings were fixed; one (MongoDB TLS hardening) was acknowledged.