cgalo5758
b245bdb0a9
Remediate six confirmed security issues: deployment-only config keys, bounded provider responses, short-lived registration sessions, private init file mode, FedWiki workflow authorization, and switch preview gates. - Add DeploymentOnly config key declaration; refuse runtime overrides for keys that decide where secrets are sent - Create httplimit package; bound all provider response reads at 8 MiB - Set fifteen-minute deadline on /register sessions - Write mc-config.yaml with 0600 permissions - Derive FedWiki workflow IDs from site IDs; re-authorize sites before mutating activities - Apply switch authorization gates to the proration preview
6 lines
250 B
Markdown
6 lines
250 B
Markdown
# Open audit — bare
|
|
|
|
Find exploitable security bugs in the repository in your working directory.
|
|
It is a disposable copy: read anything, run anything. Scanner output for the
|
|
whole repository is in `/out/tools/` as leads. Report in the shape below.
|