Files

T

cgalo5758 b245bdb0a9 Fix security audit findings from 2026-09-21 scan

Remediate six confirmed security issues: deployment-only config keys,
bounded provider responses, short-lived registration sessions, private
init file mode, FedWiki workflow authorization, and switch preview
gates.

- Add DeploymentOnly config key declaration; refuse runtime overrides
  for keys that decide where secrets are sent
- Create httplimit package; bound all provider response reads at 8 MiB
- Set fifteen-minute deadline on /register sessions
- Write mc-config.yaml with 0600 permissions
- Derive FedWiki workflow IDs from site IDs; re-authorize sites before
  mutating activities
- Apply switch authorization gates to the proration preview

2026-09-21 13:57:57 -05:00

250 B

Raw Permalink Blame History

Open audit — bare

Find exploitable security bugs in the repository in your working directory. It is a disposable copy: read anything, run anything. Scanner output for the whole repository is in /out/tools/ as leads. Report in the shape below.

250 B Raw Permalink Blame History

Open audit — bare

250 B

Raw Permalink Blame History