admin/raven
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Security review: John's decisions on F41, F42 and F32

Browse Source 
2FA turned off on the affected accounts until the F5/F41 fix; F42 key not
rotated now, moving it out of source is a later case; FastMail password
rotation after the old Sockeye server is retired.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
This commit is contained in:
John Cardinal
2026-10-23 21:15:16 -07:00
parent d6a7e024f0
commit 8a54c020c5
1 changed files with 6 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

8
devdocs/modernization/SECURITY-REVIEW.md
View File

@@ -662,7 +662,8 @@ and their history (contrary to the "secrets never go in a repo" rule), and debug
email through that account (which explains report 81's real bounces in testing). Fix: rotate that email through that account (which explains report 81's real bounces in testing). Fix: rotate that
FastMail app password now (John); remove the values from both files and read debug SMTP settings FastMail app password now (John); remove the values from both files and read debug SMTP settings
from an environment variable or user secrets. History need not be rewritten once the password is from an environment variable or user secrets. History need not be rewritten once the password is
rotated. rotated. **John, 2026-10-23:** rotation planned once the old Sockeye server is retired after the
migration; its own case.
OK in pass 8: SMTP settings change and the test-send route are OpsAdmin only; batch direct SMTP OK in pass 8: SMTP settings change and the test-send route are OpsAdmin only; batch direct SMTP
(`job-operations/batch-direct-smtp`) checks modify rights on the record type and sends only to the (`job-operations/batch-direct-smtp`) checks modify rights on the record type and sends only to the
@@ -770,7 +771,8 @@ and subscription servers; the business AyaNova server (8.2.x) has the same code.
either has 2FA turned on, it can be reached with no password and a guessed code. **Immediate either has 2FA turned on, it can be reached with no password and a guessed code. **Immediate
mitigation (no code change):** turn 2FA off on those accounts until the fix is deployed; with 2FA mitigation (no code change):** turn 2FA off on those accounts until the fix is deployed; with 2FA
off the account is not matched by this query and the password protects it as usual. Then apply off the account is not matched by this query and the password protects it as usual. Then apply
the F5 fix to Sockeye too. Other shared-code findings apply to Sockeye as well (F7, F8, F12, F19, the F5 fix to Sockeye too. **John, 2026-10-23: 2FA turned off** on the affected accounts; the fix goes
in the same case as F5 (one commit per repo). Other shared-code findings apply to Sockeye as well (F7, F8, F12, F19,
F21, F30; F1 if its config kept a placeholder); its admin UI is used by John alone, so only the F21, F30; F1 if its config kept a placeholder); its admin UI is used by John alone, so only the
anonymous ones (F5, F41) are urgent there. anonymous ones (F5, F41) are urgent there.
@@ -786,6 +788,8 @@ environment variable on the Sockeye server only (root-readable, outside the repo
published files) and remove it from the source. Rotation (new key pair, new public key in published files) and remove it from the source. Rotation (new key pair, new public key in
AyaNova, every licence reissued) is a business decision for John; without rotation the keys stay AyaNova, every licence reissued) is a business decision for John; without rotation the keys stay
in history, so access to the repository and its backups must be treated as access to the keys. in history, so access to the repository and its backups must be treated as access to the keys.
**John, 2026-10-23:** no rotation now; moving the key out of source becomes its own case for later
(not an 8.3.0 blocker).
### F39 One-shot licence fetch by DB ID (pass 11, from code) ### F39 One-shot licence fetch by DB ID (pass 11, from code)