Blame · Line-by-line history
AUDIT-2026-07-07-CHECKLIST.md
Each line is annotated with the commit that last touched it. Click any SHA to jump to that commit and see the surrounding change.
| 40dfe94 | 1 | # Audit & Remediation Checklist — 2026-07-07 |
| 2 | ||
| 3 | Running status of the full-platform audit and fixes. **Source of truth for this | |
| 4 | work.** Ticks are only green when verified (tests run / diff reviewed), not when | |
| 5 | "written". Full findings live in the session memory `audit_2026-07-07.md`. | |
| 6 | ||
| 7 | Legend: ✅ done & verified · 🔄 in progress · ⬜ not started · 🚫 blocked (needs owner) | |
| 8 | ||
| 9 | --- | |
| 10 | ||
| 11 | ## Phase 0 — Audit (4 parallel agents) | |
| 12 | - ✅ Feature/product reality vs BUILD_BIBLE | |
| 13 | - ✅ Security & secrets | |
| 14 | - ✅ Design & UX | |
| 15 | - ✅ MCP / agent connectivity | |
| 16 | - ✅ GateTest MCP installed (`claude mcp add gatetest`) — active after Claude Code restart | |
| 17 | ||
| 18 | ## Phase 1 — CRITICAL security fixes (commit `5bb52fa`) | |
| 19 | - ✅ **C1** Workflow runner secret leak — env allowlist + denylist (`src/lib/workflow-runner.ts`) | |
| 20 | - ✅ **C2** Private repos world-readable (git protocol) — read-access gate (`src/routes/git.ts`) | |
| 21 | - ✅ **C2** Private repos world-readable (web browse) — `assertRepoReadable` on 12 routes (`src/routes/web.tsx`) | |
| 22 | - ✅ **C3** Anonymous push to any repo — write-access gate (`src/routes/git.ts`) | |
| 23 | - ✅ **C4** Stored XSS in markdown — `sanitize-html` + 14 regression tests (`src/lib/markdown.ts`) | |
| 24 | - ✅ **C5** Unauth admin sandbox endpoints — site-admin gate + bounded ports (`src/routes/admin-command.tsx`) | |
| 25 | ||
| 26 | ## Phase 2 — Review hardening (commit `6b75ac1`) | |
| 27 | - ✅ Fail-CLOSED on DB error in `assertRepoReadable` (was fail-open) — flagged by automated review | |
| 28 | ||
| 29 | ## Phase 3 — Verification | |
| 30 | - ✅ Full suite baseline (stashed): 23 fail / 2896 pass | |
| 31 | - ✅ Full suite with fixes: 23 fail / 2910 pass (+14 new, **0 new failures**) | |
| 32 | - ✅ Targeted: web-routes 13/13, repo-access 5/5, markdown-xss 14/14, workflows+secrets 28, api 6/6 | |
| 33 | - ✅ Clean module imports for every edited file | |
| 34 | ||
| 35 | ## Phase 4 — Ship | |
| 36 | - ✅ Committed to `main` (`5bb52fa`, `6b75ac1`) | |
| 37 | - ✅ Pushed to `origin` (GitHub mirror) — `main` == `origin/main` @ `6b75ac1` | |
| 38 | - 🚫 **Deploy LIVE to gluecron.com** — needs `GLUECRON_PAT` (not in session). | |
| 39 | Run: `git push https://x:<PAT>@gluecron.com/ccantynz/Gluecron.com.git main` | |
| 40 | Until done, the live site still runs the vulnerable code. | |
| 41 | ||
| 42 | --- | |
| 43 | ||
| 44 | ## Phase 5 — HIGH security items (NOT started) | |
| 45 | - ⬜ H1 `git grep` arg injection — add `--`, reject leading-`-` query (`src/git/repository.ts:518`) | |
| 46 | - ⬜ H2 SSRF DNS-rebinding — wire `resolvesToPrivate`, `redirect:"manual"` (`webhook-delivery.ts`, `mirrors.ts`) | |
| 47 | - ⬜ H3 Spoofable X-Forwarded-For — trusted-proxy IP only (`rate-limit.ts`, `auth.tsx`) | |
| 48 | - ⬜ H4 `/api/auth/*` no throttle/lockout — apply auth limiter + lockout | |
| 49 | - ⬜ H5 GitHub OAuth takeover via unverified email — require verified email (`sso.ts:594`) | |
| 50 | - ⬜ H6 api-v2 workflow-dispatch missing write check (IDOR) — gate on write access (`api-v2.ts:2610`) | |
| 51 | ||
| 52 | ## Phase 6 — Overstated features (NOT started) | |
| 53 | - ⬜ CI does not run on push — wire workflow trigger into `post-receive.ts` | |
| 54 | - ⬜ "Verified" commit badge does no crypto verification — real verify or remove badge | |
| 55 | - ⬜ Orgs/teams don't gate repo access — consult org/team roles in `repo-access.ts` | |
| 56 | - ⬜ Test suite red on main (23 pre-existing fails) — fix or quarantine | |
| 57 | ||
| 58 | ## Phase 7 — Design unification (NOT started) | |
| 59 | - ⬜ Quick wins: flat near-black buttons, delete glow orbs, emoji→SVG icons | |
| 60 | - ⬜ Collapse 4 design systems → 1 (QI palette: bg #fcfcfd, ink #16181d, accent #4353c9) | |
| 61 | - ⬜ Delete dead landings (`landing.tsx`, `landing-2030.tsx`, `landing-v2.tsx`) | |
| 62 | - ⬜ Wire orphaned `pr-redesign.tsx` | |
| 63 | ||
| 64 | ## Phase 8 — MCP connectivity (NOT started) | |
| 65 | - ⬜ Fix `/docs/mcp-server` broken config (`.claude/settings.json` → `.mcp.json`) — 1-line, highest ROI | |
| 66 | - ⬜ OAuth discovery (`/.well-known/*` + DCR + 401 challenge) → unlocks Claude Desktop/web + directories | |
| 67 | - ⬜ Cross-client install (Add-to-Cursor deeplink, Windsurf/VS Code snippets) | |
| 68 | - ⬜ Token UX: expiry presets, stop passing PAT in URL query |