Repository navigation
docs: scan #112 — fossasia/voxbento (0 first-party, Starlette currency on the login path) - #162
Merged
Merged
Conversation
…y on the login path) 168 findings at medium+ (83 high, 82 medium, 3 meta), 0 first-party defects after curation. Post-only: the quality gate for filing upstream was not met. Two families explain most of the count. Semgrep's django-no-csrf-token fired 45 times on a FastAPI app's Jinja templates, where the auth cookies are HttpOnly + SameSite=Lax, admin writes are POST/DELETE and the developer dashboard adds a double-submit token. Gitleaks counted one CI-only encryption key 49 times because 17 files under docs/plans/ quote the test workflow. The one actionable item is starlette 1.1.0 -> 1.3.1 (CVE-2026-54283), transitive via fastapi and reachable on the unauthenticated /register and /login routes; 39 of 45 Trivy advisories are the Docusaurus docs site's build chain. Credited: the startup guard that refuses the compose file's change-me fallback outside debug, and MultiFernet rotation for stored provider keys. The post states its scope: every tool finding is accounted for, but the OAuth2 provider, API-key platform and WebSocket layer were not swept by hand this run. verdicts.json validated (exit 0) and copied to corpus/. Also adds the treg post's forward pointer and bumps the scan counters to 112. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Each item in the post's "Notes on the tool" maps to a roadmap entry: the framework-applicability check gains the django-no-csrf-token-on-FastAPI instance, and two new items cover Gitleaks secret-fingerprint dedupe and partial-coverage advice keyed on the Semgrep error type. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
docs/scans/fossasia-voxbento.md: 168 findings atmedium+, 0 first-party defects after curation. Post-only; nothing filed upstream (quality gate not met).index.md,scan-log.md,fixed.md,work-with-me.md).corpus/verdicts/fossasia-voxbento.json: 31 curation rows + 8 scanner rows, validated withrun_verdict_check.py --check(exit 0).Curation in one line each
docs/plans/) + an empty.env.examplevalue.django-no-csrf-token: FastAPI app withHttpOnly+SameSite=Laxauth cookies, POST/DELETE admin writes, double-submit token on the developer dashboard.website/package-lock.json: Docusaurus build chain, static output, never imported by the portal./registerand/login.The post states its scope explicitly: every tool finding is accounted for, but the OAuth2 provider, API-key platform and WebSocket layer were not swept by hand in this run.
🤖 Generated with Claude Code