add-ideas/govoplan
1
0
Fork 0
Code Issues 3 Pull Requests Actions Packages Projects Releases Wiki Activity

[Audit] Burndown: 2026-07-11 full GovOPlaN security and quality report #4

New Issue
Closed
opened 2026-07-11 16:14:03 +02:00 by zemion · 4 comments
zemion commented 2026-07-11 16:14:03 +02:00
Owner
Copy Link

Full audit baseline from /mnt/DATA/git/govoplan/audit-reports/govoplan-full-20260711-1529.

Scanner Summary

  • Gitleaks: clean across scanned repositories.
  • OSV-Scanner: clean for govoplan, govoplan-core, and addideas-govoplan-website manifests scanned in this run.
  • npm audit: clean for govoplan-core WebUI release lockfile.
  • Bandit: 224 total findings; 12 high/medium non-test findings remain.
  • Ruff security rules: 143 findings, mostly overlapping with Bandit/test fixture noise.
  • Semgrep: 54 findings before the local fixes in this burndown batch.
  • Trivy: 1 Dockerfile misconfiguration before the local website fix.
  • Xenon: 53 complexity threshold findings.
  • jscpd: 377 duplicate blocks, 5,046 duplicated lines, 2.709% duplicated lines.

Fixed / Closed In This Batch

Open Child Issues

Next Reduction Order

  1. Re-run the audit after the local meta and website fixes are pushed/available to the audit container.
  2. Fix high-signal security issues: shell boundaries, URL policy, SQL/text helpers, dynamic imports.
  3. Narrow or document false positives in tests only after production findings are handled.
  4. Split duplication triage into child issues only where the duplicate code crosses ownership boundaries or causes real maintenance risk.
  5. Use SECURITY_AUDIT_FAIL_ON_FINDINGS=1 only after the baseline is intentionally clean or explicitly waived.
Full audit baseline from `/mnt/DATA/git/govoplan/audit-reports/govoplan-full-20260711-1529`. ## Scanner Summary - Gitleaks: clean across scanned repositories. - OSV-Scanner: clean for `govoplan`, `govoplan-core`, and `addideas-govoplan-website` manifests scanned in this run. - npm audit: clean for `govoplan-core` WebUI release lockfile. - Bandit: 224 total findings; 12 high/medium non-test findings remain. - Ruff security rules: 143 findings, mostly overlapping with Bandit/test fixture noise. - Semgrep: 54 findings before the local fixes in this burndown batch. - Trivy: 1 Dockerfile misconfiguration before the local website fix. - Xenon: 53 complexity threshold findings. - jscpd: 377 duplicate blocks, 5,046 duplicated lines, 2.709% duplicated lines. ## Fixed / Closed In This Batch - add-ideas/govoplan#2: workflow action references pinned to immutable SHAs. - add-ideas/addideas-govoplan-website#7: website nginx container/header findings fixed locally. - add-ideas/govoplan-core#244: OSV audit-toolbox dependency finding is clean in the new report. - add-ideas/govoplan-core#241 and #238: closed as superseded by meta-owned issues after the script move. ## Open Child Issues - add-ideas/govoplan#1: meta release/Gitea command and URL trust boundaries. - add-ideas/govoplan#3: jscpd duplicate-code baseline triage. - add-ideas/govoplan-core#232: module installer shell hook trust boundary. - add-ideas/govoplan-core#239: core outbound URL policy. - add-ideas/govoplan-core#240: dynamic SQL/text safe identifier review. - add-ideas/govoplan-core#242: dynamic module import trust boundary. - add-ideas/govoplan-core#245: core complexity refactor. - add-ideas/govoplan-calendar#8 and #13: calendar URL policy and complexity. - add-ideas/govoplan-files#27 and #28: SMB connector container/root and files complexity. - add-ideas/govoplan-mail#11 and #12: mail SQL/regex and mail complexity. - add-ideas/govoplan-campaign#53 and #54: campaign WebUI security patterns and complexity. - add-ideas/govoplan-access#13, govoplan-admin#5, govoplan-audit#6, govoplan-docs#18, govoplan-idm#4, govoplan-policy#7, govoplan-tenancy#4: complexity issues from Xenon. ## Next Reduction Order 1. Re-run the audit after the local meta and website fixes are pushed/available to the audit container. 2. Fix high-signal security issues: shell boundaries, URL policy, SQL/text helpers, dynamic imports. 3. Narrow or document false positives in tests only after production findings are handled. 4. Split duplication triage into child issues only where the duplicate code crosses ownership boundaries or causes real maintenance risk. 5. Use `SECURITY_AUDIT_FAIL_ON_FINDINGS=1` only after the baseline is intentionally clean or explicitly waived.
zemion commented 2026-07-11 17:41:11 +02:00
Author
Owner
Copy Link

Codex State: progress

Summary

Security burn-down batch completed locally:

  • Closed govoplan#1: meta release/Gitea tooling shell and URL trust boundaries fixed.
  • Closed govoplan-core#232: module installer shell hook execution replaced with argv execution and shell syntax rejection.
  • Closed govoplan-core#239: core outbound URL policy hardened.
  • Closed govoplan-core#240: dynamic SQL identifier paths guarded and narrowly documented.
  • Closed govoplan-calendar#8: calendar/CalDAV outbound URL policy hardened.
  • Closed govoplan-mail#11: mail dynamic SQL and wildcard regex findings fixed.
  • Closed govoplan-campaign#53: campaign dynamic regex/prototype-pollution findings fixed.
  • Left govoplan-files#27 open: SMB dev container needs a deliberate non-root testbed redesign or narrow documented exception.

Verification

  • Python compile checks passed for touched meta/core/calendar/mail files.
  • npm run test:mail-ui passed.
  • npm run test:import-utils passed.
  • npm run test:template-preview passed.
  • Full Python unit tests were attempted but blocked in this shell by missing cryptography / defusedxml dependencies.

Remaining Security Work

  • govoplan-core#242: dynamic module import trust boundary remains open.
  • govoplan-files#27: SMB dev container root behavior remains open.
  • Complexity/duplication issues remain separate from this security burn-down.
## Codex State: progress ### Summary Security burn-down batch completed locally: - Closed `govoplan#1`: meta release/Gitea tooling shell and URL trust boundaries fixed. - Closed `govoplan-core#232`: module installer shell hook execution replaced with argv execution and shell syntax rejection. - Closed `govoplan-core#239`: core outbound URL policy hardened. - Closed `govoplan-core#240`: dynamic SQL identifier paths guarded and narrowly documented. - Closed `govoplan-calendar#8`: calendar/CalDAV outbound URL policy hardened. - Closed `govoplan-mail#11`: mail dynamic SQL and wildcard regex findings fixed. - Closed `govoplan-campaign#53`: campaign dynamic regex/prototype-pollution findings fixed. - Left `govoplan-files#27` open: SMB dev container needs a deliberate non-root testbed redesign or narrow documented exception. ### Verification - Python compile checks passed for touched meta/core/calendar/mail files. - `npm run test:mail-ui` passed. - `npm run test:import-utils` passed. - `npm run test:template-preview` passed. - Full Python unit tests were attempted but blocked in this shell by missing `cryptography` / `defusedxml` dependencies. ### Remaining Security Work - `govoplan-core#242`: dynamic module import trust boundary remains open. - `govoplan-files#27`: SMB dev container root behavior remains open. - Complexity/duplication issues remain separate from this security burn-down.
zemion commented 2026-07-11 18:17:31 +02:00
Author
Owner
Copy Link

Security burn-down update: govoplan-core#242 is implemented and closed locally/Gitea pending push. govoplan-files#27 has a non-root SMB dev-container attempt implemented locally, but remains open until Docker runtime validation confirms Samba works under the non-root image.

Security burn-down update: `govoplan-core#242` is implemented and closed locally/Gitea pending push. `govoplan-files#27` has a non-root SMB dev-container attempt implemented locally, but remains open until Docker runtime validation confirms Samba works under the non-root image.
zemion commented 2026-07-11 18:33:14 +02:00
Author
Owner
Copy Link

Security burn-down update: govoplan-files#27 runtime validation passed on the Docker host and the issue is now closed pending push. The SMB dev container runs as non-root and the signed authenticated SMB connector smoke passed.

Security burn-down update: `govoplan-files#27` runtime validation passed on the Docker host and the issue is now closed pending push. The SMB dev container runs as non-root and the signed authenticated SMB connector smoke passed.
zemion commented 2026-07-11 19:06:52 +02:00
Author
Owner
Copy Link

Closing after the first security burn-down batch was implemented, validated, and pushed.

Pushed fixes:

  • govoplan audit tooling / release helper hardening
  • govoplan-calendar CalDAV sync hardening
  • govoplan-campaign import/path handling hardening
  • govoplan-core module install/import trust-boundary hardening
  • govoplan-files non-root SMB dev connector
  • govoplan-mail mail profile validation hardening

Validation:

  • Latest full report: audit-reports/govoplan-full-20260711-1857
  • mode=full, scope=govoplan, repositories scanned: 63
  • Unsuppressed Semgrep findings: 0
  • Gitleaks findings: 0
  • Trivy findings: 0
  • npm audit vulnerabilities: 0
  • OSV vulnerabilities: 0

Remaining Bandit/Ruff/Xenon/jscpd baseline quality findings are better tracked as follow-up issue groups rather than keeping this initial burn-down tracker open.

Closing after the first security burn-down batch was implemented, validated, and pushed. Pushed fixes: - `govoplan` audit tooling / release helper hardening - `govoplan-calendar` CalDAV sync hardening - `govoplan-campaign` import/path handling hardening - `govoplan-core` module install/import trust-boundary hardening - `govoplan-files` non-root SMB dev connector - `govoplan-mail` mail profile validation hardening Validation: - Latest full report: `audit-reports/govoplan-full-20260711-1857` - `mode=full`, `scope=govoplan`, repositories scanned: `63` - Unsuppressed Semgrep findings: `0` - Gitleaks findings: `0` - Trivy findings: `0` - npm audit vulnerabilities: `0` - OSV vulnerabilities: `0` Remaining Bandit/Ruff/Xenon/jscpd baseline quality findings are better tracked as follow-up issue groups rather than keeping this initial burn-down tracker open.
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
area/api
HTTP API contracts, routers, schemas, or API smoke behavior.
area/auth
Authentication, sessions, access bootstrap, or login behavior.
area/db
Database sessions, models, transactions, or persistence primitives.
area/deployment
Deployment, release, operations, or runtime packaging.
area/devex
Local developer workflow, scripts, tests, tooling, or release helpers.
area/docs
Durable documentation and project guidance.
area/governance
Governance policy, audit, privacy, retention, or compliance behavior.
area/marketing
Public website, product messaging, publication copy, or legal page content.
area/migrations
Alembic migrations, schema bootstrap, or persistence evolution.
area/module-system
Module discovery, manifests, capabilities, routing, or optional integrations.
area/rbac
Permissions, roles, delegation, or authorization policy.
area/release
Versioning, release locks, tags, packaging, or dependency pins.
area/security
Security posture, static analysis, supply-chain hardening, or vulnerability remediation.
area/tenancy
Tenant boundaries, provisioning, or tenant-scoped data behavior.
area/webui
Shared WebUI shell, frontend components, routing, or frontend tests.
audit/complexity
Complexity finding from Radon, Xenon, or equivalent maintainability scans.
audit/duplication
Duplicated-code finding from jscpd or equivalent similarity scans.
audit/false-positive
Audit finding reviewed as a narrow false positive or acceptable risk.
audit/needs-design
Audit finding that needs an architectural or product decision before implementation.
audit/quick-fix
Audit finding that appears narrow and directly fixable.
audit/structural
Audit finding that needs design, refactoring, or behavior review.
codex/needs-human
Needs an explicit human decision before Codex should implement.
codex/ready
Suitable for Codex to pick up with the existing issue context.
module/access
GovOPlaN access, identity, authentication, RBAC, and administration behavior.
module/addresses
GovOPlaN Addresses module behavior or integration.
module/admin
GovOPlaN Admin module behavior or integration.
module/appointments
GovOPlaN Appointments module behavior or integration.
module/approvals
GovOPlaN Approvals module behavior or integration.
module/assets
GovOPlaN Assets module behavior or integration.
module/audit
GovOPlaN Audit module behavior or integration.
module/booking
GovOPlaN Booking module behavior or integration.
module/calendar
GovOPlaN Calendar module behavior or integration.
module/campaign
GovOPlaN campaign module behavior or integration.
module/cases
GovOPlaN Cases module behavior or integration.
module/certificates
GovOPlaN Certificates module behavior or integration.
module/committee
GovOPlaN Committee module behavior or integration.
module/connectors
GovOPlaN Connectors module behavior or integration.
module/consultation
GovOPlaN Consultation module behavior or integration.
module/contracts
GovOPlaN Contracts module behavior or integration.
module/core
GovOPlaN core runner, shared primitives, shell, or extension points.
module/dist-lists
GovOPlaN Distribution Lists module behavior or integration.
module/dms
GovOPlaN Dms module behavior or integration.
module/docs
GovOPlaN documentation layer behavior or integration.
module/erp
GovOPlaN Erp module behavior or integration.
module/evaluation
GovOPlaN Evaluation module behavior or integration.
module/facilities
GovOPlaN Facilities module behavior or integration.
module/files
GovOPlaN files module behavior or integration.
module/fit-connect
GovOPlaN Fit Connect module behavior or integration.
module/forms
GovOPlaN Forms module behavior or integration.
module/forms-runtime
GovOPlaN Forms Runtime module behavior or integration.
module/grants
GovOPlaN Grants module behavior or integration.
module/helpdesk
GovOPlaN Helpdesk module behavior or integration.
module/identity
GovOPlaN Identity module behavior or integration.
module/identity-trust
GovOPlaN Identity Trust module behavior or integration.
module/idm
GovOPlaN Idm module behavior or integration.
module/inspections
GovOPlaN Inspections module behavior or integration.
module/issue-reporting
GovOPlaN Issue Reporting module behavior or integration.
module/learning
GovOPlaN Learning module behavior or integration.
module/ledger
GovOPlaN Ledger module behavior or integration.
module/mail
GovOPlaN mail module behavior or integration.
module/notifications
GovOPlaN Notifications module behavior or integration.
module/ops
GovOPlaN Ops module behavior or integration.
module/organizations
GovOPlaN Organizations module behavior or integration.
module/payments
GovOPlaN Payments module behavior or integration.
module/permits
GovOPlaN Permits module behavior or integration.
module/policy
GovOPlaN Policy module behavior or integration.
module/poll
GovOPlaN Poll module behavior or integration.
module/portal
GovOPlaN Portal module behavior or integration.
module/postbox
GovOPlaN Postbox module behavior or integration.
module/procurement
GovOPlaN Procurement module behavior or integration.
module/records
GovOPlaN Records module behavior or integration.
module/reporting
GovOPlaN Reporting module behavior or integration.
module/resources
GovOPlaN Resources module behavior or integration.
module/risk-compliance
GovOPlaN Risk Compliance module behavior or integration.
module/scheduling
GovOPlaN Scheduling module behavior or integration.
module/search
GovOPlaN Search module behavior or integration.
module/tasks
GovOPlaN Tasks module behavior or integration.
module/templates
GovOPlaN Templates module behavior or integration.
module/tenancy
GovOPlaN Tenancy module behavior or integration.
module/transparency
GovOPlaN Transparency module behavior or integration.
module/web
GovOPlaN public website, product page, or publication content.
module/workflow
GovOPlaN Workflow module behavior or integration.
module/xoev
GovOPlaN Xoev module behavior or integration.
module/xrechnung
GovOPlaN Xrechnung module behavior or integration.
module/xta-osci
GovOPlaN Xta Osci module behavior or integration.
priority
p0
Immediate stop-the-line priority.
priority
p1
High priority for the next focused work window.
priority
p2
Normal planned priority.
priority
p3
Low priority or opportunistic cleanup.
source/backlog-import
Imported from markdown backlog, roadmap, plan, or TODO files.
source/module-roadmap
Created from GovOPlaN module and integration roadmap planning.
source/security-audit
Created from a structured security or code-quality audit report.
source/todo-scan
Imported from inline TODO/FIXME/HACK markers by the Gitea TODO importer.
status
blocked
Cannot progress without a decision, dependency, credential, or external change.
status
in-progress
Currently being worked.
status
needs-info
Needs clarifying input before implementation can proceed safely.
status
ready
Ready for implementation.
status
triage
Needs review, ownership, priority, or acceptance criteria.
type
bug
A reproducible defect, regression, or incorrect behavior.
type
debt
Cleanup, refactoring, risk reduction, or deferred engineering work.
type
docs
Documentation, process, or developer workflow work.
type
feature
New user-visible behavior or platform capability.
type
task
Implementation, maintenance, migration, or operational work.
type
user-story
End-to-end user journey or real-world process story used to steer product slices.
No Label
area/devex
area/security
audit/structural
codex/ready
priority
p1
source/security-audit
status
in-progress
type
task
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
zemion
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: add-ideas/govoplan#4
No description provided.
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?