Commit40dfe94
docs(audit): add 2026-07-07 remediation checklist (green-tick tracker)
docs(audit): add 2026-07-07 remediation checklist (green-tick tracker) Running source-of-truth for the audit + fixes: 5 criticals done+verified, fail-closed hardening done, deploy blocked on GLUECRON_PAT, plus the not-yet-started HIGH/features/design/MCP phases. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
1 file changed+68−040dfe947b614c060f7a6fd8b328bb1893b7839d6
1 changed file+68−0
AddedAUDIT-2026-07-07-CHECKLIST.md+68−0View fileUnifiedSplit
@@ -0,0 +1,68 @@
1# Audit & Remediation Checklist — 2026-07-07
2
3Running status of the full-platform audit and fixes. **Source of truth for this
4work.** Ticks are only green when verified (tests run / diff reviewed), not when
5"written". Full findings live in the session memory `audit_2026-07-07.md`.
6
7Legend: ✅ done & verified · 🔄 in progress · ⬜ not started · 🚫 blocked (needs owner)
8
9---
10
11## Phase 0 — Audit (4 parallel agents)
12- ✅ Feature/product reality vs BUILD_BIBLE
13- ✅ Security & secrets
14- ✅ Design & UX
15- ✅ MCP / agent connectivity
16- ✅ GateTest MCP installed (`claude mcp add gatetest`) — active after Claude Code restart
17
18## Phase 1 — CRITICAL security fixes (commit `5bb52fa`)
19- ✅ **C1** Workflow runner secret leak — env allowlist + denylist (`src/lib/workflow-runner.ts`)
20- ✅ **C2** Private repos world-readable (git protocol) — read-access gate (`src/routes/git.ts`)
21- ✅ **C2** Private repos world-readable (web browse) — `assertRepoReadable` on 12 routes (`src/routes/web.tsx`)
22- ✅ **C3** Anonymous push to any repo — write-access gate (`src/routes/git.ts`)
23- ✅ **C4** Stored XSS in markdown — `sanitize-html` + 14 regression tests (`src/lib/markdown.ts`)
24- ✅ **C5** Unauth admin sandbox endpoints — site-admin gate + bounded ports (`src/routes/admin-command.tsx`)
25
26## Phase 2 — Review hardening (commit `6b75ac1`)
27- ✅ Fail-CLOSED on DB error in `assertRepoReadable` (was fail-open) — flagged by automated review
28
29## Phase 3 — Verification
30- ✅ Full suite baseline (stashed): 23 fail / 2896 pass
31- ✅ Full suite with fixes: 23 fail / 2910 pass (+14 new, **0 new failures**)
32- ✅ Targeted: web-routes 13/13, repo-access 5/5, markdown-xss 14/14, workflows+secrets 28, api 6/6
33- ✅ Clean module imports for every edited file
34
35## Phase 4 — Ship
36- ✅ Committed to `main` (`5bb52fa`, `6b75ac1`)
37- ✅ Pushed to `origin` (GitHub mirror) — `main` == `origin/main` @ `6b75ac1`
38- 🚫 **Deploy LIVE to gluecron.com** — needs `GLUECRON_PAT` (not in session).
39 Run: `git push https://x:<PAT>@gluecron.com/ccantynz/Gluecron.com.git main`
40 Until done, the live site still runs the vulnerable code.
41
42---
43
44## Phase 5 — HIGH security items (NOT started)
45- ⬜ H1 `git grep` arg injection — add `--`, reject leading-`-` query (`src/git/repository.ts:518`)
46- ⬜ H2 SSRF DNS-rebinding — wire `resolvesToPrivate`, `redirect:"manual"` (`webhook-delivery.ts`, `mirrors.ts`)
47- ⬜ H3 Spoofable X-Forwarded-For — trusted-proxy IP only (`rate-limit.ts`, `auth.tsx`)
48- ⬜ H4 `/api/auth/*` no throttle/lockout — apply auth limiter + lockout
49- ⬜ H5 GitHub OAuth takeover via unverified email — require verified email (`sso.ts:594`)
50- ⬜ H6 api-v2 workflow-dispatch missing write check (IDOR) — gate on write access (`api-v2.ts:2610`)
51
52## Phase 6 — Overstated features (NOT started)
53- ⬜ CI does not run on push — wire workflow trigger into `post-receive.ts`
54- ⬜ "Verified" commit badge does no crypto verification — real verify or remove badge
55- ⬜ Orgs/teams don't gate repo access — consult org/team roles in `repo-access.ts`
56- ⬜ Test suite red on main (23 pre-existing fails) — fix or quarantine
57
58## Phase 7 — Design unification (NOT started)
59- ⬜ Quick wins: flat near-black buttons, delete glow orbs, emoji→SVG icons
60- ⬜ Collapse 4 design systems → 1 (QI palette: bg #fcfcfd, ink #16181d, accent #4353c9)
61- ⬜ Delete dead landings (`landing.tsx`, `landing-2030.tsx`, `landing-v2.tsx`)
62- ⬜ Wire orphaned `pr-redesign.tsx`
63
64## Phase 8 — MCP connectivity (NOT started)
65- ⬜ Fix `/docs/mcp-server` broken config (`.claude/settings.json` → `.mcp.json`) — 1-line, highest ROI
66- ⬜ OAuth discovery (`/.well-known/*` + DCR + 401 challenge) → unlocks Claude Desktop/web + directories
67- ⬜ Cross-client install (Add-to-Cursor deeplink, Windsurf/VS Code snippets)
68- ⬜ Token UX: expiry presets, stop passing PAT in URL query
069