From 8a54c020c583e688d207a23948531e147c469e33 Mon Sep 17 00:00:00 2001 From: John Cardinal Date: Fri, 23 Oct 2026 21:15:16 -0700 Subject: [PATCH] Security review: John's decisions on F41, F42 and F32 2FA turned off on the affected accounts until the F5/F41 fix; F42 key not rotated now, moving it out of source is a later case; FastMail password rotation after the old Sockeye server is retired. Co-Authored-By: Claude Opus 5.5 --- devdocs/modernization/SECURITY-REVIEW.md | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-) diff --git a/devdocs/modernization/SECURITY-REVIEW.md b/devdocs/modernization/SECURITY-REVIEW.md index b05824e2..113fecd3 100644 --- a/devdocs/modernization/SECURITY-REVIEW.md +++ b/devdocs/modernization/SECURITY-REVIEW.md @@ -662,7 +662,8 @@ and their history (contrary to the "secrets never go in a repo" rule), and debug email through that account (which explains report 81's real bounces in testing). Fix: rotate that FastMail app password now (John); remove the values from both files and read debug SMTP settings from an environment variable or user secrets. History need not be rewritten once the password is -rotated. +rotated. **John, 2026-10-23:** rotation planned once the old Sockeye server is retired after the +migration; its own case. OK in pass 8: SMTP settings change and the test-send route are OpsAdmin only; batch direct SMTP (`job-operations/batch-direct-smtp`) checks modify rights on the record type and sends only to the @@ -770,7 +771,8 @@ and subscription servers; the business AyaNova server (8.2.x) has the same code. either has 2FA turned on, it can be reached with no password and a guessed code. **Immediate mitigation (no code change):** turn 2FA off on those accounts until the fix is deployed; with 2FA off the account is not matched by this query and the password protects it as usual. Then apply -the F5 fix to Sockeye too. Other shared-code findings apply to Sockeye as well (F7, F8, F12, F19, +the F5 fix to Sockeye too. **John, 2026-10-23: 2FA turned off** on the affected accounts; the fix goes +in the same case as F5 (one commit per repo). Other shared-code findings apply to Sockeye as well (F7, F8, F12, F19, F21, F30; F1 if its config kept a placeholder); its admin UI is used by John alone, so only the anonymous ones (F5, F41) are urgent there. @@ -786,6 +788,8 @@ environment variable on the Sockeye server only (root-readable, outside the repo published files) and remove it from the source. Rotation (new key pair, new public key in AyaNova, every licence reissued) is a business decision for John; without rotation the keys stay in history, so access to the repository and its backups must be treated as access to the keys. +**John, 2026-10-23:** no rotation now; moving the key out of source becomes its own case for later +(not an 8.3.0 blocker). ### F39 One-shot licence fetch by DB ID (pass 11, from code)