Files

T

cgalo5758 0b28a9dc29 Remediate security audit findings

- Replace gorilla/csrf with net/http CrossOriginProtection
- Require valkey-password and add TLS options for session store
- End session at /logout and revoke refresh tokens
- Re-derive identity and roles from provider every five minutes
- Process each Stripe webhook event in its own Temporal workflow
- Give each outbox entry its own workflow with Temporal retries
- Guard against stale Stripe events with provider timestamps
- Derive transport security from base-url scheme

2026-09-09 13:25:43 -05:00

1.4 KiB

Raw Blame History

container-image Specification

Purpose

Define the security posture of the shipped application container image, starting with running the application process as a dedicated non-root user.

Requirements

Requirement: Runtime container executes as non-root

The application container image SHALL run the application process as a dedicated non-root user.

Scenario: Container process has a non-zero UID

WHEN the image is built and a container is started from it with no user override
THEN the application process SHALL run with a non-zero UID

Scenario: Application serves normally as non-root

WHEN the container runs as the non-root user
THEN the application SHALL bind port 8080 and serve requests
AND no operation SHALL fail with a filesystem or port permission error

Requirement: Base images are supported and pinned

The container image SHALL build on a Go release that still receives security fixes, and SHALL name every base image by a specific version tag rather than a floating one, so that a build is reproducible and its provenance is auditable.

Scenario: The builder uses a supported Go release

WHEN the image is built
THEN the builder stage SHALL use a Go release that is within the upstream support window

Scenario: No base image floats

WHEN the Dockerfile is inspected
THEN no FROM instruction SHALL reference the latest tag

1.4 KiB Raw Blame History