archetech / archon / 31271852706

95%

push

github

docs: refresh SECURITY_AUDIT.md with the August 2026 audit (#867)

* docs: refresh SECURITY_AUDIT.md with the August 2026 audit

Full re-audit of main @ daf2c2ac (569 commits since the February 2026
review): gitleaks over full history (clean; 13 verified false
positives), npm audit (30 vulns), semgrep (owasp-top-ten +
security-audit, triaged), and manual review of the auth middleware,
Drawbridge L402/macaroon stack, Herald OAuth, browser-extension
messaging, cipher package, and docker posture.

Headline: one critical (L402 paywall bypass via the #121
subscription-auth stub — fix in PR #866), 4 high, 7 medium, 8 low, and
9 verified-fixed/positive notes including clean secrets hygiene and
the resolved NoSQL-injection finding. Section 7 maps every February
finding to its current status.

* docs(security): correct audit inaccuracies and complete the Feb mapping

Review of the audit turned up several factual errors that would have
misdirected remediation:

- H-01 listed Drawbridge's v1-admin.ts as fail-open. It is the opposite:
  403 when no key is configured, and timingSafeEqual. Removed it from the
  location list and made it the copy-paste template for the fix instead.
- L-06 claimed Python uses constant-time comparison. It does not —
  app.py:131 is a plain `!=` and compare_digest appears nowhere in
  keymaster_service. The Python port would have been skipped.
- H-01 claimed a default deployment exposes mnemonic export to the
  network. Compose binds Keymaster to 127.0.0.1; Gatekeeper is the one
  published on all interfaces. Restated per-service.
- C-01 is now genuinely fixed (PR #866 merged), so the checkmark and past
  tense are accurate; noted that older builds remain bypassable.
- Section 7 mapped only 15 of the February findings while claiming to be
  complete, and this report replaces that document in the tree. All 41
  rows are now present with verified statuses.
- M-03's "186 sites" did not reproduce (182); quoted the exact grep, and
  did the... (continued)

3611 of 4065 branches covered (88.83%)

Branch coverage included in aggregate %.

8234 of 8516 relevant lines covered (96.69%)

686.81 hits per line