psa-systems/mokosh-server
Watch
9
0
Fork
You've already forked mokosh-server
 1
Code Issues Pull requests Projects Releases 10 Packages Wiki Activity Actions

chore(security): triage audit roll-up findings (PMS-504) #373

Merged
Claude-Run merged 1 commit from chore/PMS-504-security-audit-triage into main 2026-06-26 11:06:35 +02:00
Conversation 0 Commits 1 Files changed 3 +491 -4
Claude-Run commented 2026-06-26 10:47:49 +02:00
Member
Copy link

Triage all 38 medium/low/info findings from the 2026-06-25 mokosh-server security audit. Adds dev-docs/audits/security-2026-06-25/mokosh-server-triage.md dispositioning every finding as FIXED, RISK-ACCEPTED, FOLLOW-UP (own issue, TBD until a human files it - this automated run cannot create YouTrack issues), or ALREADY-FIXED, mirroring the mokosh-apps MAPPS-308 roll-up format.

Applied the contained, obviously-correct fixes inline; larger architectural, data-migration, infra, and CI-policy items are dispositioned as grouped follow-ups for separate tracked issues.

Fixed in this change:

  • M14: stop forcing mokosh_server=debug + tower_http=debug in every environment. The subscriber now honors RUST_LOG (the dev stack already sets info,mokosh_server=debug) and defaults to info, so production no longer logs at debug.
  • L13: covered by M14 - tower_http no longer logs request URIs (OAuth code/state query params on the callback) at the default info level.
  • L19: TOTP verify() now uses constant_time_eq instead of String == to avoid a timing side-channel on the code comparison.

Risk-accepted: M6 (partial), M15, L1, I1 - rationale in the triage doc.

#PMS-504

Triage all 38 medium/low/info findings from the 2026-06-25 mokosh-server security audit. Adds dev-docs/audits/security-2026-06-25/mokosh-server-triage.md dispositioning every finding as FIXED, RISK-ACCEPTED, FOLLOW-UP (own issue, TBD until a human files it - this automated run cannot create YouTrack issues), or ALREADY-FIXED, mirroring the mokosh-apps MAPPS-308 roll-up format. Applied the contained, obviously-correct fixes inline; larger architectural, data-migration, infra, and CI-policy items are dispositioned as grouped follow-ups for separate tracked issues. Fixed in this change: - M14: stop forcing mokosh_server=debug + tower_http=debug in every environment. The subscriber now honors RUST_LOG (the dev stack already sets info,mokosh_server=debug) and defaults to info, so production no longer logs at debug. - L13: covered by M14 - tower_http no longer logs request URIs (OAuth code/state query params on the callback) at the default info level. - L19: TOTP verify() now uses constant_time_eq instead of String == to avoid a timing side-channel on the code comparison. Risk-accepted: M6 (partial), M15, L1, I1 - rationale in the triage doc. #PMS-504
chore(security): triage audit roll-up findings (PMS-504)
All checks were successful
Check / fmt + clippy + build + tests (pull_request) Successful in 1m25s
Details
E2E / Playwright against staging (pull_request) Successful in 1m28s
Details
Integration / integration tests (pull_request) Successful in 18m23s
Details
Create release / Gate (release-branch merges only) (pull_request) Successful in 1s
Details
Create release / Create release from merged PR (pull_request) Has been skipped
Details
6dc007753a 
Triage all 38 medium/low/info findings from the 2026-06-25 mokosh-server security audit. Adds dev-docs/audits/security-2026-06-25/mokosh-server-triage.md dispositioning every finding as FIXED, RISK-ACCEPTED, FOLLOW-UP (own issue, TBD until a human files it - this automated run cannot create YouTrack issues), or ALREADY-FIXED, mirroring the mokosh-apps MAPPS-308 roll-up format.

Applied the contained, obviously-correct fixes inline; larger architectural, data-migration, infra, and CI-policy items are dispositioned as grouped follow-ups for separate tracked issues.

Fixed in this change:
- M14: stop forcing mokosh_server=debug + tower_http=debug in every environment. The subscriber now honors RUST_LOG (the dev stack already sets info,mokosh_server=debug) and defaults to info, so production no longer logs at debug.
- L13: covered by M14 - tower_http no longer logs request URIs (OAuth code/state query params on the callback) at the default info level.
- L19: TOTP verify() now uses constant_time_eq instead of String == to avoid a timing side-channel on the code comparison.

Risk-accepted: M6 (partial), M15, L1, I1 - rationale in the triage doc.

#PMS-504
Sign in to join this conversation.
Reviewers
No reviewers
Labels
Clear labels
No items
No labels
Milestone
Clear milestone
No items
No milestone
Projects
Clear projects
No items
No project
Assignees
Clear assignees
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference
psa-systems/mokosh-server!373
No description provided.