cgalo5758
5829091881
The contained runner that drove the 2026-09 security audit, the README review and four rounds of design ideation lived only inside the ignored notebook. It moves to scripts/agent-runner/: the prepare, tools, audit, ideation and teardown scripts, the compose and container files, the allowlist proxy and the prompt templates, with the paths that assumed the notebook fixed and findings written to a caller-named directory. Run outputs, transcripts and the round-specific sheet scripts stay behind. docs/agent-runner.md states the method: the disposable git archive copy and the fail-closed proxy, how a task is shaped, union rather than intersection of findings across models, separate adjudication of every finding against the source, and the evidence a finding must carry.
1.4 KiB
1.4 KiB
T05 — Cross-tenant isolation on member surfaces
Threat model. A signed-in member of organization A changes an identifier in a URL or form to reach data belonging to organization B.
Slice. internal/server/member_domains.go, member_products.go,
member_invoices.go, the FedWiki member partials in
internal/integrations/fedwiki/web/partials.go and api.go (note the
{domain} and {claimID} path parameters), and the queries they call.
Questions.
- For every handler taking an id from the URL, form, or query: where is that id checked against the caller's own person, organization, or workspace? Quote the check, or state that there is none.
- Are ownership checks in the SQL predicate, or applied in Go after a fetch that already returned another tenant's row?
{domain}and{claimID}name resources that may be globally unique. What stops a member from acting on another member's domain claim?- Can a member enumerate identifiers belonging to other tenants through error messages, redirects, or response timing?
- Do the archive, restore, cancel, and keep-active mutations verify ownership as strictly as the read paths do?
Note. This bug class needs whole-system context and is the class language models miss most often. Prefer "Undetermined, here is why" over a guess.
Not in scope. Operator-role escalation (T02).