fix: all api endpoints in backend/main in main.py

[anupamme]

Summary

Fix high severity security issue in backend/main.py.

Vulnerability

Field	Value
ID	V-001
Severity	HIGH
Scanner	multi_agent_ai
Rule	V-001
File	backend/main.py:108
Assessment	Likely exploitable
Chain Complexity	2-step

Description: All API endpoints in backend/main.py lack authentication mechanisms. The endpoints /api/v1/tables, /api/v1/snapshot-map/<table_name>, /api/v1/graph-data, and /api/v1/graph-data/<job_id> are publicly accessible without any authentication checks, allowing any unauthenticated user to access sensitive table metadata, snapshot data, and graph information.

Evidence

Exploitation scenario: An attacker with network access can send HTTP requests to any of the API endpoints without credentials.

Scanner confirmation: multi_agent_ai rule V-001 flagged this pattern.

Production code: This file is in the production codebase, not test-only code.

Threat Model Context

This main application appears to be publicly accessible. This is a containerized service - vulnerabilities may be exploitable depending on network exposure.

Changes

• backend/main.py

Behavior Preservation

The change is scoped to 1 file on the vulnerable path, and the project builds successfully with this change applied.

Verification

• Build passes
• Scanner re-scan confirms fix
• LLM code review passed

---

Automated security fix by OrbisAI Security