Security results: v0.2.0 (release Conduct)#
Recorded on 2026-10-20 from the public CI history and from status-summary.md. Rules: README.md.
What was run, and on which commit#
Release commit (tag v0.2.0) |
1e6b7a8, 2026-10-19 |
| Commit the full security run was made on | c21a633 ("Images: upgrade libx11 in the dashboard and editor images (CVE-2026-88806)"), one commit before the tag |
| What differs between the two | the version number in 23 package.json files, the release entry of CHANGES.md and the alignment line of docs/release/README.md. No code. |
| The run | workflow security, started by hand with the DAST scan ticked: run 39271161567, 2026-10-19, 14:41 UTC |
| Result | all jobs succeeded |
| Job | What it does | Result |
|---|---|---|
| static scans | dependency audit, secret scan of the tree and of the history, static analysis, shell lint, container and infrastructure configuration | success (the accepted findings are in scripts/security/static/baseline.json, each with a reason and a review date) |
| API + browser suites on a disposable stack | the API security suites (authentication, MFA, authorization of every route as five identities, public surface, uploads, outbound requests, gateway, limits), the unit tests and the browser tests | success |
| workspace isolation (two stacks) | two workspaces started side by side; one must not reach the other | success |
| DAST (OWASP ZAP) | baseline scan of the running stack | success |
| TLS template (testssl.sh), two nginx images | the TLS policy of the rendered proxy configuration | success (both images) |
Counts as written in the status summary of 2026-10-19: 1595 API tests in 32 files, 14 isolation tests, 83 test files in the CI run; 62 findings recorded (F-001 to F-062), all 9 High fixed.
The runs that failed first#
The same day, the two runs before the green one failed, both in the job API + browser suites on a disposable stack:
| Run | Commit | Result | What the record of the day says |
|---|---|---|---|
| 39262593653 | 3678b4a "Release 0.2.0 preparation" |
failure | CHANGES.md, 2026-10-19: an audit test that was not deterministic was made deterministic |
| 39267546033 | a0431b4 "Release 0.2.0 candidate" |
failure | CHANGES.md, 2026-10-19: browser specs updated after the navigation change; the image scan of the candidate had failed on admin-dashboard and whoobe-one-spike (libx11, CVE-2026-88806, fixed in the commit that was then tested) |
What this run did not cover#
As stated in the status summary, section 3, and not repeated as a claim of safety:
- no external audit, penetration test or certification: all the work is ours;
- SQL fuzzing of the remaining endpoints, the impact of prompt injection on the AI features, a
next buildornuxt buildof generated sites, load testing (by design); - a full Content-Security-Policy for the admin and editor SPAs (postponed on purpose, F-014);
- TLS on a real hostname with a public certificate (the template was tested, a live host was not);
- the browser-side XSS coverage of some
v-htmlsinks (F-008); - the DAST scan and the manual checklist were not repeated for the features added after 2026-10-09 that the status summary lists;
- Microsoft Entra, Okta and Google single sign-on: the OpenID Connect code was tried against a mock and a real Keycloak 26 only.
Open items at the time#
Listed with owner and reason in status-summary.md, section 3 (for example F-003: two accepted advisories of xlsx, baselined
until 2027-01-31; F-014; F-008; the TLS check on a live host).
Last updated