# Audit & Remediation Checklist — 2026-07-07

Running status of the full-platform audit and fixes. **Source of truth for this
work.** Ticks are only green when verified (tests run / diff reviewed), not when
"written". Full findings live in the session memory `audit_2026-07-07.md`.

Legend: ✅ done & verified · 🔄 in progress · ⬜ not started · 🚫 blocked (needs owner)

---

## Phase 0 — Audit (4 parallel agents)
- ✅ Feature/product reality vs BUILD_BIBLE
- ✅ Security & secrets
- ✅ Design & UX
- ✅ MCP / agent connectivity
- ✅ GateTest MCP installed (`claude mcp add gatetest`) — active after Claude Code restart

## Phase 1 — CRITICAL security fixes (commit `5bb52fa`)
- ✅ **C1** Workflow runner secret leak — env allowlist + denylist (`src/lib/workflow-runner.ts`)
- ✅ **C2** Private repos world-readable (git protocol) — read-access gate (`src/routes/git.ts`)
- ✅ **C2** Private repos world-readable (web browse) — `assertRepoReadable` on 12 routes (`src/routes/web.tsx`)
- ✅ **C3** Anonymous push to any repo — write-access gate (`src/routes/git.ts`)
- ✅ **C4** Stored XSS in markdown — `sanitize-html` + 14 regression tests (`src/lib/markdown.ts`)
- ✅ **C5** Unauth admin sandbox endpoints — site-admin gate + bounded ports (`src/routes/admin-command.tsx`)

## Phase 2 — Review hardening (commit `6b75ac1`)
- ✅ Fail-CLOSED on DB error in `assertRepoReadable` (was fail-open) — flagged by automated review

## Phase 2.5 — LOGIN LOCKOUT root cause (commit `2aefa37`)
**Why the owner is locked out of gluecron.com:** a previous agent's `signin-v2`
redesign shipped PASSWORDLESS — `GET /login` renders `SignInV2`, which had OAuth +
passkey + magic-link but **no username/password field** (subheading literally said
"no new passwords"). The live site still shows a password box only because it runs
OLDER code. Deploying as-is would have DELETED password login and locked the owner
out worse.
- ✅ Restored a real password `<form action=/login>` (username + password + Sign in +
  Forgot-password link) above the Google/GitHub/passkey/magic options in `signin-v2.tsx`.
- ✅ Verified: `/login` renders 200 with password+username fields, posts to `/login`,
  Google + GitHub buttons present, `/forgot-password` link present. web-routes 13/13.
- ✅ Owner password reset to a known value via `scripts/reset-admin-password.ts`
  (account `ccantynz`, now site-admin). It failed on live because live = old passwordless code.
- ⏳ After deploy: owner logs in at `/login` with `ccantynz` + password. Google/GitHub
  BUTTONS will show; for them to COMPLETE, OAuth client id/secret must be set in DB at
  `/admin/github-oauth` and `/admin/google-oauth` (owner is admin now, can do this post-login).
- ⚠️ Deploy risk: `self-deploy.sh` runs `db:migrate`; if the live DB has migration drift it
  may fail+rollback (safe — keeps current). Watch `/admin/deploys`.

## Phase 3 — Verification
- ✅ Full suite baseline (stashed): 23 fail / 2896 pass
- ✅ Full suite with fixes: 23 fail / 2910 pass (+14 new, **0 new failures**)
- ✅ Targeted: web-routes 13/13, repo-access 5/5, markdown-xss 14/14, workflows+secrets 28, api 6/6
- ✅ Clean module imports for every edited file

## Phase 4 — Ship
- ✅ Committed to `main` (`5bb52fa`, `6b75ac1`)
- ✅ Pushed to `origin` (GitHub mirror) — `main` == `origin/main` @ `6b75ac1`
- 🚫 **Deploy LIVE to gluecron.com** — needs `GLUECRON_PAT` (not in session).
     Run: `git push https://x:<PAT>@gluecron.com/ccantynz/Gluecron.com.git main`
     Until done, the live site still runs the vulnerable code.

---

## Phase 5 — HIGH security items (NOT started)
- ⬜ H1 `git grep` arg injection — add `--`, reject leading-`-` query (`src/git/repository.ts:518`)
- ⬜ H2 SSRF DNS-rebinding — wire `resolvesToPrivate`, `redirect:"manual"` (`webhook-delivery.ts`, `mirrors.ts`)
- ⬜ H3 Spoofable X-Forwarded-For — trusted-proxy IP only (`rate-limit.ts`, `auth.tsx`)
- ⬜ H4 `/api/auth/*` no throttle/lockout — apply auth limiter + lockout
- ⬜ H5 GitHub OAuth takeover via unverified email — require verified email (`sso.ts:594`)
- ⬜ H6 api-v2 workflow-dispatch missing write check (IDOR) — gate on write access (`api-v2.ts:2610`)

## Phase 6 — Overstated features (NOT started)
- ⬜ CI does not run on push — wire workflow trigger into `post-receive.ts`
- ⬜ "Verified" commit badge does no crypto verification — real verify or remove badge
- ⬜ Orgs/teams don't gate repo access — consult org/team roles in `repo-access.ts`
- ⬜ Test suite red on main (23 pre-existing fails) — fix or quarantine

## Phase 7 — Design unification (NOT started)
- ⬜ Quick wins: flat near-black buttons, delete glow orbs, emoji→SVG icons
- ⬜ Collapse 4 design systems → 1 (QI palette: bg #fcfcfd, ink #16181d, accent #4353c9)
- ⬜ Delete dead landings (`landing.tsx`, `landing-2030.tsx`, `landing-v2.tsx`)
- ⬜ Wire orphaned `pr-redesign.tsx`

## Phase 8 — MCP connectivity (NOT started)
- ⬜ Fix `/docs/mcp-server` broken config (`.claude/settings.json` → `.mcp.json`) — 1-line, highest ROI
- ⬜ OAuth discovery (`/.well-known/*` + DCR + 401 challenge) → unlocks Claude Desktop/web + directories
- ⬜ Cross-client install (Add-to-Cursor deeplink, Windsurf/VS Code snippets)
- ⬜ Token UX: expiry presets, stop passing PAT in URL query