lfg2025/archy
1
0
Fork 0
Code Issues 7 Pull Requests Actions Packages Projects Releases 33 Wiki Activity

docs: add security audit report for new features (Task 22)

Browse Source 
Audited cloud file upload, AIUI iframe, context broker, FileBrowser
proxy, and RPC endpoints. Key findings:
- XSS: safe (Vue template escaping)
- Context broker: properly validates origins
- FileBrowser: medium risk path traversal (client-side), token in URLs
- CSRF: high risk (no tokens, but mitigated by JSON content type)
- Nginx: missing security headers

Full report: docs/security-audit-2026-03-05.md

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
This commit is contained in:
Dorian
2026-03-05 08:49:22 +00:00
parent 54c672943a
commit d7c9f4917a
2 changed files with 231 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
.claude/plans/reflective-meandering-castle.md
View File

@@ -123,7 +123,7 @@ After getting Claude Max OAuth working on the live server, hardening the deploy
- **Change**: Deploy latest AIUI build. Test chat mode end-to-end. If broken, fix and redeploy. Verify: (1) AIUI loads in iframe, (2) Claude responds via proxy, (3) Context broker sends real data, (4) Close button works on mobile and desktop.
- **Verify**: Full chat conversation works without errors
### Task 22: Security report
### Task 22: Security report [DONE]
- **Change**: Audit all new features (cloud file upload, AIUI iframe, context broker, filebrowser proxy). Check for XSS in file names, path traversal in filebrowser-client, origin validation in context broker postMessage, CSRF in RPC endpoints. Produce report.
- **Verify**: Written report with findings and mitigations