Repository navigation
docs(security): the v1.0.0 security review, closed on rc.4 - #39
Merged
Merged
Conversation
Slice 54's combined report. Three reviewers attacked v1.0.0-rc.1 (27 findings, 3 medium); the lead reran every proof; fresh reviewers confirmed each round of fixes on rc.2 (D), rc.3 (E) and rc.4 (F). Every finding is fixed by a pull request with a regression test or recorded as an accepted risk with an issue. The six reports are appended unchanged. The gate line names rc.4; v1.0.0 differs from it only in documentation. check-old-name exempts the report: the appended reports name the old data folder (finding B-03) and can't be edited. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Signed-off-by: Ayla Croft <dev@scriptkittyos.com>
- The privacy policy names every way a page can hide text that Kotiko still swaps (a transparent text colour, text turned away), and says a disguised word's card can open on a click too (reviewer F, F-01). - The data inventory shows Kotiko-HMAC v2 with the boot id (E-01). - The requirements list the proof route as the second open route. - Slice 54's spec describes the confirmation rounds, the stop rule and the gate check's reading of a report (E-06). - OpenSSF hardened_site is Met: kotiko.org sends HSTS, a CSP, X-Frame-Options, nosniff and Referrer-Policy (C-10). Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Signed-off-by: Ayla Croft <dev@scriptkittyos.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
The pre-release security review (slice 54, SCR-476) of Kotiko's first store release, closed on
v1.0.0-rc.4. Merging this unblocks the store uploads: the release workflow's store gate (scripts/check-security-gate.mjs) reads the closing line indocs/security/review-v1.0.0.md.The review in short
In this PR
docs/security/review-v1.0.0.md: scope and candidates, reviewers and independence, every finding with its outcome and fix PR, the final confirmation, accepted risks, coverage, and the six reports appended unchanged under## Appendix. The lead checked that the closing line passescheck-security-gate.mjs(with and without--version 1.0.0), and that the same report with the open line stays open.Kotiko-HMAC v2with the boot id), the requirements (the proof route is the second open route), and slice 54's spec (confirmation rounds, the stop rule, how the gate check reads a report).hardened_siteis Met: kotiko.org's headers, checked live.check-old-nameexempts the report, because the appended reports name the old data folder (finding B-03).v1.0.0 vs rc.4: documentation only (this PR) plus the release notes. No code changes after rc.4.
Also noted in the report: a misquoted test setting sent two of reviewer F's test lookups to OpenRouter's public endpoint, with no key, token or identity. They were refused, and F fixed the setting.
🤖 Generated with Claude Code