Security review
Snapshot of the platform’s security posture and the dependency audit. A formal third-party penetration test is the remaining external step before go-live; this document is the internal review that precedes it.
Dependency audit (run in Phase 10)
Section titled “Dependency audit (run in Phase 10)”- Python (
pip-audit): no known vulnerabilities in backend/agent dependencies. - Operator app (
npm audit): a critical advisory in Next.js 15.0.3 was remediated by upgrading to Next 15.5.x. Remaining items aremoderate, in dev-only tooling (postcss/esbuild) not shipped in the production build. - Marketing (
npm audit): advisories are in Vite/esbuild dev tooling only — the deployed artifact is static HTML/CSS, so the dev server is not in the production attack surface. Tracked for an Astro/Vite upgrade.
Re-run before each release: .venv/bin/pip-audit, and npm audit in web/ and marketing/.
Controls in place
Section titled “Controls in place”| Area | Control |
|---|---|
| Tenant isolation | Enforced in the data layer; cross-org access 404s (existence hidden), low role 403s |
| Device auth | Per-device API keys, SHA-256 hashed at rest, shown once, rotatable |
| User auth | scrypt password hashing, JWT access/refresh with purpose claim, optional TOTP MFA |
| Account enumeration | Password-reset always returns 202; no “email exists” oracle |
| Transport | TLS terminated at Caddy/platform (auto-cert); HTTPS everywhere in prod |
| Secrets | None in git; env/secret-store only; .env* gitignored |
| Abuse | Per-IP rate limiter; webhook payloads HMAC-SHA256 signed |
| Auditing | Sensitive actions (login, role change, commands, billing, config, escalation) audit-logged |
| Safety | Cloud can never override a local interlock; remote commands validated on the controller |
| Stripe webhooks | Signature-verified when the webhook secret is configured |
| Observability | Sentry errors/traces, Prometheus metrics, structured logs for detection |
Hardening backlog (before/with the pen test)
Section titled “Hardening backlog (before/with the pen test)”- Refresh-token denylist / rotation on logout.
- Distributed rate limiting (shared store) to replace the in-process limiter.
- Webhook delivery retries with backoff + a dead-letter view.
- Per-route metrics cardinality review; alert thresholds on error rate + p95 latency.
- Dependency upgrades to clear the dev-tooling advisories.
- Commission an external penetration test against staging; track findings to closure.