 cgalo5758
|
b245bdb0a9
|
Fix security audit findings from 2026-09-21 scan
Remediate six confirmed security issues: deployment-only config keys,
bounded provider responses, short-lived registration sessions, private
init file mode, FedWiki workflow authorization, and switch preview
gates.
- Add DeploymentOnly config key declaration; refuse runtime overrides
for keys that decide where secrets are sent
- Create httplimit package; bound all provider response reads at 8 MiB
- Set fifteen-minute deadline on /register sessions
- Write mc-config.yaml with 0600 permissions
- Derive FedWiki workflow IDs from site IDs; re-authorize sites before
mutating activities
- Apply switch authorization gates to the proration preview
|
2026-09-21 13:57:57 -05:00 |
|