Repository navigation
Conversation
## Audit Summary - Period: 2026-03-06 to 2026-10-26 (144 commits, 7+ months) - Status: 🟡 YELLOW - New findings in OAuth and config validation - New findings: 3 (#13 MEDIUM, #14 MEDIUM, #15 LOW) - Total active findings: 11 (was 8) - Security improvements: MCP auth, loopback binding, path-safety fix ## New Findings **Finding #13 (MEDIUM):** OAuth credential file permissions not enforced - container-manager.ts:336 - writeCredentialsFile() doesn't set mode 0600 - Regression check confirming #11 issue persists **Finding #14 (MEDIUM):** Unvalidated settings config field - schema.ts:1088 - z.unknown() accepts arbitrary SDK settings - Unknown what settings are security-sensitive **Finding #15 (LOW):** OAuth error logging may leak tokens - container-manager.ts:369,389 - HTTP responses and errors logged unsanitized ## New Attack Surface **File Serving Route:** /files/:agentName/* (APPROVED) - Well-defended with realpath resolution, containment checks, TOCTOU prevention - CSP sandbox headers mitigate untrusted agent content - Same auth gap as web API (#12) - needs localhost-only documentation ## Hot Spot Analysis Critical files verified (WARN status): - container-manager.ts: OAuth credential handling modified - container-runner.ts: MCP bridge integration - config/schema.ts: New settings/plugins/mcp fields - state/session.ts: Session adoption system ## Security Improvements Noted ✅ MCP HTTP bridge now requires bearer token authentication ✅ MCP bridge binds to loopback (127.0.0.1) by default ✅ Path traversal fix for Windows path separators ✅ Shell escaping improved ($, backtick, \, ") ## Priority Actions 1. HIGH: Document web dashboard + file serving as localhost-only (#12) 2. MEDIUM: Fix OAuth file permissions - add mode 0o600 (#13) 3. MEDIUM: Review SDK settings validation requirements (#14) 4. MEDIUM: Sanitize OAuth error logging (#15) ## Files Updated - intel/2026-10-26.md - Full audit report - intel/FINDINGS-INDEX.md - Added #13, #14, #15 - STATE.md - Updated to 2026-10-26, 11 open findings - summaries/2026-10-26-executive-summary.md - Executive summary Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>
Incremental audit covering 4 commits (2026-10-26 to 2026-10-30): - 0 production files modified (metadata only) - 0 hot spots changed - 0 new findings - 11 existing findings unchanged Clean audit period with no security-relevant changes. Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>
Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>
Added user-facing changelog entries for: - Web dashboard reliability improvements (session loading, retry, ordering) - Custom agent settings passthrough (settings field) - Secure MCP HTTP bridge with bearer tokens - Claude Opus 5.5 support (SDK floor raised to 0.3.283) - Reliable CLI session IDs (minted instead of inferred) Analyzed 15 commits since 03b4ccc (last update Aug 13): 0c0a1b3 through 6feb70e Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>
Contributor
|
Warning Review limit reachedYou've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository. Next included review available in 5 minutes. View limit details
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. CodeRabbit Verify
|
Deploying herdctl with
|
| Latest commit: |
a1f13a3
|
| Status: | ✅ Deploy successful! |
| Preview URL: | https://904f1995.herdctl.pages.dev |
| Branch Preview URL: | https://changelog-auto-update-2026-1-qmvs.herdctl.pages.dev |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Daily changelog update covering 15 commits from Aug 13 (03b4ccc) through Nov 3 (0c0a1b3).
Added 5 user-facing entries to the What's New page:
settingsfield for passing Claude Code settings at the flag tierChanges
docs/src/content/docs/whats-new.mdwith 5 new entriesagents/changelog/state.mdwith run metadataTest plan
🤖 Generated with changelog-updater agent