olaf/Link-Log
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases 4 Wiki Activity

Updated Security Audit

Browse Source
This commit is contained in:
olaf
2026-08-26 20:42:44 +02:00
parent 018c02c759
commit 16c9c3a03f
3 changed files with 101 additions and 226 deletions
Download Patch File Download Diff File Expand all files Collapse all files
VIBE/CHAT_LOG.md
+6
View File
@@ -1,5 +1,11 @@
# Chat Log
### User
Perform a new security audit overwriting Security-audit.md with new and remaining issues.
### Assistant outcome
Replaced the historical audit with a fresh current-state review dated 2026-08-26. The new report records verified controls and nine remaining findings: logout token transport, raw infrastructure errors, unauthenticated setup exposure, audit-detail sanitization, production secret fallback, non-distributed rate limiting, incomplete security headers/request policy, missing audit operations, and incomplete dependency/container/secret/runtime verification. The baseline backend suite passed 49 tests.
### User
Update SA-012 to reflect the actual implementation, document device binding, rotation, reuse detection, family revocation, logout and password-reset revocation, update the checklist and README API examples, and add the refresh endpoint to the documented API surface.
VIBE/PROMPTS.md
+1
View File
@@ -198,6 +198,7 @@
192. Put the email greeting in a separate top-aligned cell to the right of the logo.
193. Reduce the email greeting font size somewhat.
194. Replace LINKLOG_TOKEN_EXPIRY_DAYS with LINKLOG_TOKEN_EXPIRY_MINUTES, add LINKLOG_REFRESH_TOKEN_EXPIRY_DAYS to production Compose, and add a CI configuration consistency test.
195. Perform a new security audit overwriting Security-audit.md with new and remaining issues.
195. Update SA-012 and README for the implemented refresh-token lifecycle, revocation behavior, and refresh endpoint.
## Future entries