rtmx-ai / rtmx / 23609340192

79%

Build Type

push

github

Committed by rhino11

Commit Message

security: Fix 7 vulnerabilities, update attack tests (REQ-SEC-004..009)

Fixes:
- SEC-004: Pin all 41 GitHub Actions to commit SHAs across 4 workflows
- SEC-005: Install script now verifies GPG signatures on checksums.txt
- SEC-006: GPG signing mandatory (removed conditional on import step)
- SEC-007: GitHub adapter validates repo format, Jira validates HTTPS
  and rejects RFC1918/link-local URLs, JQL project values quoted
- SEC-008: Shadow resolver rejects path traversal (filepath stays within
  remote directory)
- SEC-009: Database Save() uses atomic temp-file + rename

Attack tests updated to assert fixed behavior (PASS when secure).
3 unfixed vulnerabilities remain: SEC-001 (results HMAC), SEC-002
(sync auth), SEC-003 (grant enforcement) -- these need design work.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Run Details

39 of 70 new or added lines in 4 files covered. (55.71%)

22 existing lines in 2 files now uncovered.

7093 of 8874 relevant lines covered (79.93%)

26.58 hits per line