fix(api,chart): resolve stack trace leaks, drop NET_BIND_SERVICE capability

[DerekRoberts]

Summary

This PR addresses the 4 remaining open Code Scanning alerts in the repository, resolving security and configuration quality issues:

1. Information Exposure through Stack Trace (js/stack-trace-exposure / Alerts code changes for adding rate limiting. #93, Hook up Crawler to post data to API #94, upgrade to rjsf 5.1.0 #95):

   • Problem: Raw error objects were passed directly to res.status(500).json(error) in four route handlers inside pub-code-service.js. This leaks internal database structures, paths, and stack trace metadata to clients.
   • Fix: Replaced raw error serialization with a safe, generic { message: "Internal server error" } payload while keeping detailed logs on the server side (logger.error(...)).

2. Specific capabilities added (KSV-0022 / Alert logs #157):

   • Problem: The frontend container securityContext was configured with capabilities.add: ["NET_BIND_SERVICE"].
   • Fix: Dropped this capability. Since the container binds to ports 3000 and 3001 (which are unprivileged ports >= 1024), standard non-root processes can bind to them natively. The capability was leftover boilerplate and is no longer needed.
   • Runtime Issue Resolution: Dropping this capability from the Helm configuration originally caused Caddy to crash at startup (exec /usr/bin/caddy: operation not permitted) because the binary in the official image had file capabilities set. We have updated frontend/Dockerfile to strip capabilities from the binary (setcap -r /usr/bin/caddy) during the build, allowing it to execute safely with dropped capabilities.

Verification

• Verified the Helm chart templates compile successfully:

  helm template charts/pubcode

  The generated frontend deployment manifests now correctly omit the securityContext.capabilities.add block.

---

Thanks for the PR!

Any successful deployments (not always required) will be available below.
API available
Frontend available

Once merged, code will be promoted and handed off to following workflow run.
Main Merge Workflow

[Copilot]

Pull request overview

This PR hardens the deployment and API error handling by removing an unnecessary Linux capability from the frontend container and ensuring API 500 responses don’t echo raw error objects back to clients.

Changes:

• Removed NET_BIND_SERVICE capability from the frontend container’s securityContext in the Helm values.
• Replaced res.status(500).json(error) responses with a generic { message: "Internal server error" } payload in the pub-code service.

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated no comments.

File	Description
charts/pubcode/values.yaml	Drops the NET_BIND_SERVICE capability from the frontend container configuration.
api/src/services/pub-code-service.js	Prevents error object/stack details from being returned in 500 responses by returning a generic message.