[PM-27564] Self-host configuration is not applied with nx build

[coroiu]

🎟️ Tracking

📔 Objective

📸 Screenshots

⏰ Reminders before review

• Contributor guidelines followed
• All formatters and local linters executed and passed
• Written new unit and / or integration tests where applicable
• Protected functional changes with optionality (feature flags)
• Used internationalization (i18n) for all UI strings
• CI builds passed
• Communicated to DevOps any deployment requirements
• Updated any necessary documentation (Confluence, contributing docs) or informed the documentation team

🦮 Reviewer guidelines

• 👍 (:+1:) or similar for great changes
• 📝 (:memo:) or ℹ️ (:information_source:) for notes or general info
• ❓ (:question:) for questions
• 🤔 (:thinking:) or 💭 (:thought_balloon:) for more open inquiry that's not quite a confirmed issue and could potentially benefit from discussion
• 🎨 (:art:) for suggestions / improvements
• ❌ (:x:) or ⚠️ (:warning:) for more significant problems or concerns needing attention
• 🌱 (:seedling:) or ♻️ (:recycle:) for future improvements or indications of technical debt
• ⛏ (:pick:) for minor or nitpick changes

[claude]

⚠️ Finding 1: Inconsistent LOGGING logic compared to ENV and NODE_ENV.

While ENV and NODE_ENV use nullish coalescing for boolean/truthy checks, LOGGING uses != "false" which means:

• params.env.LOGGING undefined → falls through to process.env.LOGGING != "false"
• If params.env.LOGGING is false (boolean), it becomes the value without the string check

This could lead to unexpected behavior if params.env.LOGGING is passed as a boolean false (it would be used directly) vs a string "false" (which would need the != check).

Consider making this consistent:

const LOGGING = params.env?.LOGGING ?? (process.env?.LOGGING != "false");

[coroiu]

Was your code snippet the suggestion?

[github-actions]

Checkmarx One – Scan Summary & Details – 848b2518-3e2b-421c-a8e5-b483cde7d99b

New Issues (7)

Checkmarx found the following issues in this Pull Request

Severity	Issue	Source File / Package	Checkmarx Insight
	CVE-2025-12727	Npm-electron-37.7.0	details Description: Inappropriate implementation in V8 in Google Chrome prior to 142.0.7444.137 allowed a remote attacker to potentially exploit heap corruption via a ... Attack Vector: NETWORK Attack Complexity: LOW ID: OTlVCmZTsk%2BM2NZRIbiuAAEOhy95nW0j7ISaBu7BkbE%3D Vulnerable Package
	CVE-2025-12907	Npm-electron-37.7.0	details Description: Insufficient validation of untrusted input in Devtools in Google Chrome prior to 140.0.7339.80 allowed a remote attacker to execute arbitrary code ... Attack Vector: NETWORK Attack Complexity: LOW ID: 6%2FnD12Pt9qFllJ%2B1wD%2B%2FfKvEp3R4juLLeIqT%2Fn6aAro%3D Vulnerable Package
	CVE-2025-11215	Npm-electron-37.7.0	details Description: Off-by-one Error in V8 in Google Chrome prior to 141.0.7390.54 allowed a remote attacker to perform an Out-of-bounds Memory Read via a crafted HTML... Attack Vector: NETWORK Attack Complexity: LOW ID: PuXRo%2FQ2R1gXtVmg269xyvzozIhrU4g6zcwH1%2BcxbPU%3D Vulnerable Package
	CVE-2025-11216	Npm-electron-37.7.0	details Recommended version: 39.2.0 Description: Inappropriate implementation in Storage in Google Chrome on Mac prior to 141.0.7390.54 allowed a remote attacker to perform domain spoofing via a c... Attack Vector: NETWORK Attack Complexity: LOW ID: 2FylzSpfe%2FK%2BaDGmYyODmD5CFDHJI3Qa10CGg84zWgw%3D Vulnerable Package
	CVE-2025-12728	Npm-electron-37.7.0	details Description: Inappropriate implementation in Omnibox in Google Chrome on Android prior to 142.0.7444.137 allowed a remote attacker who convinced a user to engag... Attack Vector: NETWORK Attack Complexity: HIGH ID: 3P%2BWzlR6%2F0a5rPfptaKVSBqJP0ij2T3afNjkTYoZsEA%3D Vulnerable Package
	CVE-2025-12729	Npm-electron-37.7.0	details Description: Inappropriate implementation in Omnibox in Google Chrome on Android prior to 142.0.7444.137 allowed a remote attacker who convinced a user to engag... Attack Vector: NETWORK Attack Complexity: HIGH ID: 0uTR37IzfOR%2FyC1GlhInkLBIJuDXKK%2FBy7VHfpyC4HM%3D Vulnerable Package
	CVE-2025-11219	Npm-electron-37.7.0	details Recommended version: 39.2.0 Description: Use After Free in V8 in Google Chrome prior to 141.0.7390.54 allowed a remote attacker to potentially perform Out-of-bounds Memory Access via a cra... Attack Vector: NETWORK Attack Complexity: HIGH ID: q3J3ak6QWHnf7VmugPEQ3OSpnMn9AkFlkziNU7Fai1s%3D Vulnerable Package

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 41.24%. Comparing base (90ca6bf) to head (48aec17).
⚠️ Report is 12 commits behind head on main.
✅ All tests successful. No failed tests found.

Additional details and impacted files

@@            Coverage Diff             @@
##             main   #17279      +/-   ##
==========================================
+ Coverage   41.12%   41.24%   +0.12%     
==========================================
  Files        3544     3543       -1     
  Lines      101844   101963     +119     
  Branches    15265    15295      +30     
==========================================
+ Hits        41879    42054     +175     
+ Misses      58202    58145      -57     
- Partials     1763     1764       +1     

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[addisonbeck]

One thing you should also consider is that folks expect the self hosted web vault to run on a different port. This isn't configured in the web apps project.json right now, and I think it needs to be.