ge-aerospace/shopdb-flask
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Add agent fingerprinting, client certificate auth, and security audit documentation
Some checks failed
CI / backend (push) Has been cancelled
Details
CI / naming (push) Has been cancelled
Details
CI / gates (push) Has been cancelled
Details
CI / frontend (push) Has been cancelled
Details
CI / lean-build (push) Has been cancelled
Details

Browse Source 
This commit adds:
- Database migrations for app_delta fingerprints and client certificates
- Scripts for certificate generation and fingerprint backfilling
- Comprehensive security audit reports and findings tracking
- Implementation documentation for certificate authentication
- Test utilities for certificate renewal and fingerprinting
- GE-ENFORCE collector fix documentation

Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>
This commit is contained in:
Proudlock
2026-09-15 09:18:12 -04:00
parent 1a7bb9bd34
commit 5cd5332397
32 changed files with 8912 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

8
security-findings-tracker.csv Normal file
View File

@@ -0,0 +1,8 @@
ID,Severity,CWE,Title,File,Lines,Status,Priority,Assigned,Notes
f_agent_binj_1,HIGH,CWE-345,Agent Binary Injection,plugins/endpoints/api/agentupload.py,127-131,Open,P0,,Malicious binary deployment as SYSTEM - requires code signing
f_t_auth_acct_enum_1_1,HIGH,CWE-204,Account Enumeration via Lockout,shopdb/core/api/auth.py,102-107,Open,P0,,Username leak via HTTP 403/401 difference - fix constant-time response
f_jwt_timing_1,HIGH,CWE-208,Collector API Key Timing Attack,shopdb/core/api/collector.py,135-137,Open,P0,,Replace == with hmac.compare_digest()
f_jwt_1_1,MEDIUM,CWE-613,Refresh Token Non-Rotation,shopdb/core/api/auth.py,160-186,Open,P1,,30-day token reuse - implement rotation
f_t_gf_rate_limit_bypass_upload_1_1,MEDIUM,CWE-770,Token Refresh Rate Limit Bypass,shopdb/core/api/auth.py,160-186,Open,P1,,Add rate limiting to /refresh endpoint
f_gf_upload_dos_1_3,MEDIUM,CWE-307,File Upload DoS,shopdb/config.py,145-151,Open,P1,,Add rate limiting to upload endpoints
f_gf_collector_rc_3_event_dedup,LOW,CWE-362,Event Deduplication Race Condition,plugins/endpoints/plugin.py,1259-1278,Open,P2,,TOCTOU in collector - add SELECT FOR UPDATE
1 ID Severity CWE Title File Lines Status Priority Assigned Notes
2 f_agent_binj_1 HIGH CWE-345 Agent Binary Injection plugins/endpoints/api/agentupload.py 127-131 Open P0 Malicious binary deployment as SYSTEM - requires code signing
3 f_t_auth_acct_enum_1_1 HIGH CWE-204 Account Enumeration via Lockout shopdb/core/api/auth.py 102-107 Open P0 Username leak via HTTP 403/401 difference - fix constant-time response
4 f_jwt_timing_1 HIGH CWE-208 Collector API Key Timing Attack shopdb/core/api/collector.py 135-137 Open P0 Replace == with hmac.compare_digest()
5 f_jwt_1_1 MEDIUM CWE-613 Refresh Token Non-Rotation shopdb/core/api/auth.py 160-186 Open P1 30-day token reuse - implement rotation
6 f_t_gf_rate_limit_bypass_upload_1_1 MEDIUM CWE-770 Token Refresh Rate Limit Bypass shopdb/core/api/auth.py 160-186 Open P1 Add rate limiting to /refresh endpoint
7 f_gf_upload_dos_1_3 MEDIUM CWE-307 File Upload DoS shopdb/config.py 145-151 Open P1 Add rate limiting to upload endpoints
8 f_gf_collector_rc_3_event_dedup LOW CWE-362 Event Deduplication Race Condition plugins/endpoints/plugin.py 1259-1278 Open P2 TOCTOU in collector - add SELECT FOR UPDATE