cgalo5758
b245bdb0a9
Remediate six confirmed security issues: deployment-only config keys, bounded provider responses, short-lived registration sessions, private init file mode, FedWiki workflow authorization, and switch preview gates. - Add DeploymentOnly config key declaration; refuse runtime overrides for keys that decide where secrets are sent - Create httplimit package; bound all provider response reads at 8 MiB - Set fifteen-minute deadline on /register sessions - Write mc-config.yaml with 0600 permissions - Derive FedWiki workflow IDs from site IDs; re-authorize sites before mutating activities - Apply switch authorization gates to the proration preview
30 lines
1.5 KiB
Markdown
30 lines
1.5 KiB
Markdown
# Security audit — auditor instructions
|
|
|
|
You are auditing member-console, a Go + HTMX web application. `CONTEXT.md`
|
|
gives you the system's auth model, request pipeline, and trust boundaries;
|
|
read it first and treat it as fact. Your task file names the slice you are
|
|
responsible for and the questions it must answer.
|
|
|
|
Your working directory is a disposable copy. Read anything, run anything.
|
|
|
|
## How to work
|
|
|
|
1. **Read the whole slice.** The files named in your task, plus what they call
|
|
and what calls them. Do not skim; do not sample.
|
|
2. **Answer the task's questions.** They are falsifiable. Each must end up with
|
|
a yes or a no and the code that settles it.
|
|
3. **Then hunt freely inside the slice.** The questions are the floor, not the
|
|
ceiling. Anything security-relevant you find in these files counts, whatever
|
|
its category. Do not restrict yourself to a vulnerability taxonomy.
|
|
4. **Use the scanners.** They are installed and run offline:
|
|
- `gosec -fmt=json -quiet ./...`
|
|
- `govulncheck -db=file:///opt/vulndb -format=json ./...`
|
|
- `semgrep --metrics=off --json --config /opt/semgrep-rules/go --config /opt/semgrep-rules/generic .`
|
|
- `staticcheck ./...` · `gitleaks detect --no-git -v`
|
|
Pre-computed output for the whole repo may already sit in `/out/tools/`.
|
|
Scanner output is a lead, not a finding: confirm every hit in the source,
|
|
and say so when a hit is a false positive.
|
|
|
|
`REPORT.md`, which follows your task, states what a finding must carry and the
|
|
shape of your report.
|