cgalo5758
5829091881
The contained runner that drove the 2026-09 security audit, the README review and four rounds of design ideation lived only inside the ignored notebook. It moves to scripts/agent-runner/: the prepare, tools, audit, ideation and teardown scripts, the compose and container files, the allowlist proxy and the prompt templates, with the paths that assumed the notebook fixed and findings written to a caller-named directory. Run outputs, transcripts and the round-specific sheet scripts stay behind. docs/agent-runner.md states the method: the disposable git archive copy and the fail-closed proxy, how a task is shaped, union rather than intersection of findings across models, separate adjudication of every finding against the source, and the evidence a finding must carry.
25 lines
1.2 KiB
Markdown
25 lines
1.2 KiB
Markdown
# T04 — Webhook receivers
|
|
|
|
**Threat model.** An attacker who can POST to the application, but does not
|
|
hold the provider's signing secret, tries to forge a payment or membership
|
|
event.
|
|
|
|
**Slice.** `internal/integrations/stripe/web/webhook.go`,
|
|
`internal/integrations/discourse/web/webhook.go`, and the fulfillment code each
|
|
one reaches (`internal/fulfillment/`, the outbox/event tables they write).
|
|
|
|
**Questions.**
|
|
1. Is the signature verified before any part of the payload is parsed, trusted,
|
|
logged, or written? Show the order.
|
|
2. On verification failure, what status is returned and is anything persisted?
|
|
3. Is the comparison constant-time? Is the secret loaded per-request or cached,
|
|
and what happens if it is empty or unset?
|
|
4. Replay: can the same signed event be delivered twice, and what is the
|
|
effect? Is there an idempotency key, a timestamp tolerance, or neither?
|
|
5. Does the handler trust amounts, identifiers, or plan references from the
|
|
payload, or refetch authoritative state from the provider?
|
|
6. If a delivery fails mid-processing, can it leave a person entitled to
|
|
something unpaid, or paid but unentitled?
|
|
|
|
**Not in scope.** Whether the paths are exempt (T03 covers that).
|