CodeIssuesDiscussionsWikiPull RequestsProjectsCommitsActionsReleasesContributorsPulse● GatesSecuritySettingsDeploymentsPipelineInsightsAgents✨ Explain✨ Ask AI✨ Workspace✨ Spec✨ Tests▓ Debt Map✨ NL Search🏛 Archaeology
Blame · Line-by-line history
AUDIT-2026-07-07-CHECKLIST.md
Each line is annotated with the commit that last touched it. Click any SHA to jump to that commit and see the surrounding change.
| 40dfe94 | 1 | # Audit & Remediation Checklist — 2026-07-07 |
| 2 | ||
| 3 | Running status of the full-platform audit and fixes. **Source of truth for this | |
| 4 | work.** Ticks are only green when verified (tests run / diff reviewed), not when | |
| 5 | "written". Full findings live in the session memory `audit_2026-07-07.md`. | |
| 6 | ||
| 7 | Legend: ✅ done & verified · 🔄 in progress · ⬜ not started · 🚫 blocked (needs owner) | |
| 8 | ||
| 9 | --- | |
| 10 | ||
| 11 | ## Phase 0 — Audit (4 parallel agents) | |
| 12 | - ✅ Feature/product reality vs BUILD_BIBLE | |
| 13 | - ✅ Security & secrets | |
| 14 | - ✅ Design & UX | |
| 15 | - ✅ MCP / agent connectivity | |
| 16 | - ✅ GateTest MCP installed (`claude mcp add gatetest`) — active after Claude Code restart | |
| 17 | ||
| 18 | ## Phase 1 — CRITICAL security fixes (commit `5bb52fa`) | |
| 19 | - ✅ **C1** Workflow runner secret leak — env allowlist + denylist (`src/lib/workflow-runner.ts`) | |
| 20 | - ✅ **C2** Private repos world-readable (git protocol) — read-access gate (`src/routes/git.ts`) | |
| 21 | - ✅ **C2** Private repos world-readable (web browse) — `assertRepoReadable` on 12 routes (`src/routes/web.tsx`) | |
| 22 | - ✅ **C3** Anonymous push to any repo — write-access gate (`src/routes/git.ts`) | |
| 23 | - ✅ **C4** Stored XSS in markdown — `sanitize-html` + 14 regression tests (`src/lib/markdown.ts`) | |
| 24 | - ✅ **C5** Unauth admin sandbox endpoints — site-admin gate + bounded ports (`src/routes/admin-command.tsx`) | |
| 25 | ||
| 26 | ## Phase 2 — Review hardening (commit `6b75ac1`) | |
| 27 | - ✅ Fail-CLOSED on DB error in `assertRepoReadable` (was fail-open) — flagged by automated review | |
| 28 | ||
| 1a0ac2e | 29 | ## Phase 2.5 — LOGIN LOCKOUT root cause (commit `2aefa37`) |
| 30 | **Why the owner is locked out of gluecron.com:** a previous agent's `signin-v2` | |
| 31 | redesign shipped PASSWORDLESS — `GET /login` renders `SignInV2`, which had OAuth + | |
| 32 | passkey + magic-link but **no username/password field** (subheading literally said | |
| 33 | "no new passwords"). The live site still shows a password box only because it runs | |
| 34 | OLDER code. Deploying as-is would have DELETED password login and locked the owner | |
| 35 | out worse. | |
| 36 | - ✅ Restored a real password `<form action=/login>` (username + password + Sign in + | |
| 37 | Forgot-password link) above the Google/GitHub/passkey/magic options in `signin-v2.tsx`. | |
| 38 | - ✅ Verified: `/login` renders 200 with password+username fields, posts to `/login`, | |
| 39 | Google + GitHub buttons present, `/forgot-password` link present. web-routes 13/13. | |
| 40 | - ✅ Owner password reset to a known value via `scripts/reset-admin-password.ts` | |
| 41 | (account `ccantynz`, now site-admin). It failed on live because live = old passwordless code. | |
| 42 | - ⏳ After deploy: owner logs in at `/login` with `ccantynz` + password. Google/GitHub | |
| 43 | BUTTONS will show; for them to COMPLETE, OAuth client id/secret must be set in DB at | |
| 44 | `/admin/github-oauth` and `/admin/google-oauth` (owner is admin now, can do this post-login). | |
| 45 | - ⚠️ Deploy risk: `self-deploy.sh` runs `db:migrate`; if the live DB has migration drift it | |
| 46 | may fail+rollback (safe — keeps current). Watch `/admin/deploys`. | |
| 47 | ||
| 40dfe94 | 48 | ## Phase 3 — Verification |
| 49 | - ✅ Full suite baseline (stashed): 23 fail / 2896 pass | |
| 50 | - ✅ Full suite with fixes: 23 fail / 2910 pass (+14 new, **0 new failures**) | |
| 51 | - ✅ Targeted: web-routes 13/13, repo-access 5/5, markdown-xss 14/14, workflows+secrets 28, api 6/6 | |
| 52 | - ✅ Clean module imports for every edited file | |
| 53 | ||
| 54 | ## Phase 4 — Ship | |
| 55 | - ✅ Committed to `main` (`5bb52fa`, `6b75ac1`) | |
| 56 | - ✅ Pushed to `origin` (GitHub mirror) — `main` == `origin/main` @ `6b75ac1` | |
| 57 | - 🚫 **Deploy LIVE to gluecron.com** — needs `GLUECRON_PAT` (not in session). | |
| 58 | Run: `git push https://x:<PAT>@gluecron.com/ccantynz/Gluecron.com.git main` | |
| 59 | Until done, the live site still runs the vulnerable code. | |
| 60 | ||
| 61 | --- | |
| 62 | ||
| 63 | ## Phase 5 — HIGH security items (NOT started) | |
| 64 | - ⬜ H1 `git grep` arg injection — add `--`, reject leading-`-` query (`src/git/repository.ts:518`) | |
| 65 | - ⬜ H2 SSRF DNS-rebinding — wire `resolvesToPrivate`, `redirect:"manual"` (`webhook-delivery.ts`, `mirrors.ts`) | |
| 66 | - ⬜ H3 Spoofable X-Forwarded-For — trusted-proxy IP only (`rate-limit.ts`, `auth.tsx`) | |
| 67 | - ⬜ H4 `/api/auth/*` no throttle/lockout — apply auth limiter + lockout | |
| 68 | - ⬜ H5 GitHub OAuth takeover via unverified email — require verified email (`sso.ts:594`) | |
| 69 | - ⬜ H6 api-v2 workflow-dispatch missing write check (IDOR) — gate on write access (`api-v2.ts:2610`) | |
| 70 | ||
| 71 | ## Phase 6 — Overstated features (NOT started) | |
| 72 | - ⬜ CI does not run on push — wire workflow trigger into `post-receive.ts` | |
| 73 | - ⬜ "Verified" commit badge does no crypto verification — real verify or remove badge | |
| 74 | - ⬜ Orgs/teams don't gate repo access — consult org/team roles in `repo-access.ts` | |
| 75 | - ⬜ Test suite red on main (23 pre-existing fails) — fix or quarantine | |
| 76 | ||
| 77 | ## Phase 7 — Design unification (NOT started) | |
| 78 | - ⬜ Quick wins: flat near-black buttons, delete glow orbs, emoji→SVG icons | |
| 79 | - ⬜ Collapse 4 design systems → 1 (QI palette: bg #fcfcfd, ink #16181d, accent #4353c9) | |
| 80 | - ⬜ Delete dead landings (`landing.tsx`, `landing-2030.tsx`, `landing-v2.tsx`) | |
| 81 | - ⬜ Wire orphaned `pr-redesign.tsx` | |
| 82 | ||
| 83 | ## Phase 8 — MCP connectivity (NOT started) | |
| 84 | - ⬜ Fix `/docs/mcp-server` broken config (`.claude/settings.json` → `.mcp.json`) — 1-line, highest ROI | |
| 85 | - ⬜ OAuth discovery (`/.well-known/*` + DCR + 401 challenge) → unlocks Claude Desktop/web + directories | |
| 86 | - ⬜ Cross-client install (Add-to-Cursor deeplink, Windsurf/VS Code snippets) | |
| 87 | - ⬜ Token UX: expiry presets, stop passing PAT in URL query |