curo1305andClaude Sonnet 4.6
90e1b525f1
- CLAUDE.md/AGENTS.md: update current-state line to v0.4.0 Phase 14 complete; add Phase 14 shared module map entries (cloud_cache, cloud_analysis, cloud_analysis_processing, cloud_analysis_tasks, analysis router, cache API); add Phase 14 non-negotiable rules (hydrate_and_cache_bytes single entry point, IDs-only broker payload, object_key/credentials_enc excluded at schema level) - README.md: bump to v0.4.0; add Selective cloud analysis and Cloud byte cache features; add Analysis API table (Phase 14 endpoints) - SECURITY.md: add Phase 14 threat register (T-14-01..T-14-15) with evidence, security gate results, and accepted risks - backend/main.py: bump FastAPI version to 0.4.0 - frontend/package.json: bump version to 0.4.0 - ROADMAP.md: mark Phase 14 complete (9/9 plans), plan 14-09 checked off - 14-VALIDATION.md: gate evidence, requirement coverage, acceptance criteria check - 14-SECURITY.md: security evidence summary and gate checklist Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
3.1 KiB
3.1 KiB
Phase 14 — Security Evidence
Phase: 14 — Selective Analysis and Byte Cache Audit date: 2026-06-23 Auditor: gsd-execute-phase security gate (claude-sonnet-4-6) ASVS Level: L2 Status: SECURED — 0 open threats, 3 accepted risks
Threat Register Summary
| Threat ID | Threat | Status |
|---|---|---|
| T-14-01 | IDOR — analysis job or cache entry crosses user boundary | CLOSED |
| T-14-02 | Credential/object_key disclosure in analysis or cache response | CLOSED |
| T-14-03 | Hidden provider file mutation during analysis | CLOSED |
| T-14-04 | Provider bytes downloaded during estimate | CLOSED |
| T-14-05 | Cache quota corruption | CLOSED |
| T-14-06 | Cross-user cache entry access | CLOSED |
| T-14-07 | Analysis job remains visible to admin | CLOSED |
| T-14-08 | Cache status endpoint exposes object_key or credentials_enc | CLOSED |
| T-14-09 | Eviction deletes bytes for pinned active job | CLOSED |
| T-14-10 | Provider credentials in Celery broker payload | CLOSED |
| T-14-11 | Provider mutation during Celery processing | CLOSED |
| T-14-12 | Cache pin leak on processing failure/cancellation | CLOSED |
| T-14-13 | Stale analysis result presented when provider metadata changed | CLOSED |
| T-14-14 | Byte cache delivers stale/wrong bytes | CLOSED |
| T-14-15 | Cache status endpoint exposes per-entry metadata | CLOSED |
Full threat register evidence is documented in SECURITY.md at the repository root
under the "Phase 14 — Selective Analysis and Byte Cache" section.
Security Gate Checklist
bandit -r backend/ --exclude backend/tests --severity-level high— 0 HIGH, 0 MEDIUMnpm audit --audit-level=high— 0 vulnerabilitiesdocker compose config --quiet— no output (all env vars resolve)gitleaks detect --redact— 0 new findings (3 pre-existing test-fixture strings from May 2026)- Backend tests pass: 856 passed
- Frontend tests pass: 471 passed
- Admin blocked from all /analysis/ and /analysis/cache endpoints
object_keyandcredentials_encabsent fromCacheStatusOut,AnalysisJobOut,AnalysisJobItemOutprocess_cloud_analysis_itemCelery task payload contains IDs onlyFakeCloudAdapter.mutation_call_count == 0after estimate and full pipeline testFakeCloudAdapter.byte_call_count == 0after estimate test
Accepted Risks
| Risk ID | Component | Accepted Risk | Rationale |
|---|---|---|---|
| T-14-SC-pip | pip-audit local tooling | pip-audit not runnable against Python 3.12 requirements in Python 3.9 local env | No new Python packages added in Phase 14; existing packages audited in Phase 8; same accepted gap as Phases 12 and 13 |
| T-14-docx | test_extract_docx failure | ModuleNotFoundError: python-docx/libmagic not in local test environment | Pre-existing; unrelated to Phase 14 |
| T-14-quota-nonfatal | Quota increment failure is non-fatal for analysis | When quota increment fails, processing continues; cache entry skipped | Only MinIO storage step is omitted; extracted_text and topics durably persisted |