Security results: v0.3.0 (release Operate)#

Recorded on 2026-10-23 from the public CI history and from status-summary.md. Rules: README.md.

What was run, and on which commit#

Release commit (tag v0.3.0)	7642173, 2026-10-23
Commit the full security run was made on	38fb4bb ("Dockerfile: node 22.23.4 base image digest"), one commit before the release commit
What differs between the two	the version number in 23 package.json files, the release entry of CHANGES.md, the alignment line of docs/release/README.md and the release notes (no longer a draft, a "Known limits" section). No code.
The run	workflow security, started by hand with the DAST scan ticked: run 39943598701, 2026-10-23, 11:05 UTC
Result	all jobs succeeded
The run on the release commit itself	push run 39947508475: success (a push runs the static scans only; the commit has no code change)
Other runs on the tag	upgrade 39947508564 (v0.2.0 to this tree): success; release 39947508526 (six images for amd64 and arm64, cosign signature, build provenance, draft release): success

Job	What it does	Result
static scans	dependency audit, secret scan of the tree and of the history, static analysis, shell lint, container and infrastructure configuration	success (the accepted findings are in scripts/security/static/baseline.json, each with a reason and a review date)
API + browser suites on a disposable stack	the API security suites, the unit tests, the browser tests, and the scan of the stack's images	success
workspace isolation (two stacks)	two workspaces started side by side; one must not reach the other	success
DAST (OWASP ZAP)	active scan of the running stack	success
TLS template (testssl.sh), two nginx images	the TLS policy of the rendered proxy configuration	success (both images)

Counts, read from the reports of run 39943598701 (commit 38fb4bb): API suites 2337 passed, 0 failed, 2 skipped (92 test files in the earlier run 39934951757, same code); isolation 14 passed, 0 failed. The reports are attached to the GitHub Release (security-reports-v0.3.0.zip), with the CycloneDX SBOMs of the source and of the six images.

The static report lists, as warnings that do not fail the run, three bypass-tls-verification hits in packages/core/src/db/client.test.ts (a test of the TLS settings) and one react-dangerouslysetinnerhtml in packages/sdk/react/src/defaults.tsx; neither is in the baseline yet. Moderate advisories (@tiptap/core, katex, postcss-selector-parser, sanitize-html) are listed as information.

Image scan (trivy image, HIGH/CRITICAL, fixed only), run 39934951757: the five own images passed the gate (0 fixable HIGH/CRITICAL; the figures of the other images were not read separately); postgres:16-alpine 26, all in the Go standard library of gosu (reported, not gating, decision of the owner 2026-10-23; F-050).

Other checks on the release candidate: upgrade from v0.2.0 (67 to 73 migrations, data intact, login: run 39937017622 on f515ea1, again on the tag); a fresh install from a clean clone (five images built from source, 7/7 containers healthy, login 200, 5 min 28 s); the release workflow tried on the trial tag v0.3.0-rc.1 (signature, provenance and an install from ghcr.io on an isolated network, 2026-10-23).

The runs that failed first#

On the same day, before the green runs:

Run	Commit	Result	What the record of the day says
39925302553 (nightly) and 39929201254 (push)	9628fef, 619dcf3	failure in static scans	pnpm audit: new advisories on dompurify 3.4.16 (one critical), reached through mermaid; fixed with an override to ^3.4.17 (CHANGES.md, "Dependency: dompurify")
39931768624 (by hand, DAST)	f052171	failure in API + browser suites, step Container images	trivy image could not find the five own images: the list in run-trivy-image.sh used the names compose gave before 2026-10-22. Test script fixed (the list comes from docker compose config --images); no finding in the product

Also removed before the tag, because of the audit: the library xlsx (two high advisories, no fix on npm), which was also used to read files, not only to write (F-003 corrected).

What this run did not cover#

As stated in the status summary, section 3, and not repeated as a claim of safety:

• no external audit, penetration test or certification: all the work is ours;
• the manual security checklist was not repeated for the features added since 0.2.0 (Generate Website Wizard and site specification, Kits, uploaded fonts, private profile, fleet commands), and the browser suite was not extended for them;
• the Assets changes of 2026-10-23 (type filter, audio, PDF preview with the session) were not checked in a browser;
• the AI provider path of the Generate Website Wizard was never exercised;
• SQL fuzzing of the remaining endpoints, the impact of prompt injection on the AI features, a next build or nuxt build of generated sites, load testing (by design);
• a full Content-Security-Policy for the admin and editor SPAs (postponed on purpose, F-014);
• TLS on a real hostname with a public certificate;
• the browser-side XSS coverage of some v-html sinks (F-008);
• Microsoft Entra, Okta and Google single sign-on, and a real Cloudflare Images account.

Open items at the time#

Listed with owner and reason in status-summary.md, section 3: F-003 (@tiptap/core, moderate; braces, high with no fix, accepted until 2027-01-31), F-008, F-014, F-050 (gosu in the postgres image), the TLS check on a live host. The register has no entry kept private under the disclosure policy.