cgalo5758
b245bdb0a9
Remediate six confirmed security issues: deployment-only config keys, bounded provider responses, short-lived registration sessions, private init file mode, FedWiki workflow authorization, and switch preview gates. - Add DeploymentOnly config key declaration; refuse runtime overrides for keys that decide where secrets are sent - Create httplimit package; bound all provider response reads at 8 MiB - Set fifteen-minute deadline on /register sessions - Write mc-config.yaml with 0600 permissions - Derive FedWiki workflow IDs from site IDs; re-authorize sites before mutating activities - Apply switch authorization gates to the proration preview
1.5 KiB
1.5 KiB
Security audit — auditor instructions
You are auditing member-console, a Go + HTMX web application. CONTEXT.md
gives you the system's auth model, request pipeline, and trust boundaries;
read it first and treat it as fact. Your task file names the slice you are
responsible for and the questions it must answer.
Your working directory is a disposable copy. Read anything, run anything.
How to work
- Read the whole slice. The files named in your task, plus what they call and what calls them. Do not skim; do not sample.
- Answer the task's questions. They are falsifiable. Each must end up with a yes or a no and the code that settles it.
- Then hunt freely inside the slice. The questions are the floor, not the ceiling. Anything security-relevant you find in these files counts, whatever its category. Do not restrict yourself to a vulnerability taxonomy.
- Use the scanners. They are installed and run offline:
gosec -fmt=json -quiet ./...govulncheck -db=file:///opt/vulndb -format=json ./...semgrep --metrics=off --json --config /opt/semgrep-rules/go --config /opt/semgrep-rules/generic .staticcheck ./...·gitleaks detect --no-git -vPre-computed output for the whole repo may already sit in/out/tools/. Scanner output is a lead, not a finding: confirm every hit in the source, and say so when a hit is a false positive.
REPORT.md, which follows your task, states what a finding must carry and the
shape of your report.