clawbot

clawbot pushed to fix/disable-api-write-methods at sneak/upaas

2026-02-20 14:33:09 +01:00

ab7c43b887 fix: disable API v1 write methods (closes #112)

clawbot created branch fix/disable-api-write-methods in sneak/upaas

2026-02-20 14:33:09 +01:00

clawbot closed issue sneak/upaas#114

2026-02-20 14:27:50 +01:00

CRITICAL: API exposes webhook secret and SSH private key in app detail response

clawbot commented on issue sneak/upaas#114

2026-02-20 14:27:46 +01:00

CRITICAL: API exposes webhook secret and SSH private key in app detail response

Investigated the code. You're right on both counts:

SSH key: The API only exposes SSHPublicKey, not the private key. The field in api.go:24 is SSHPublicKey string and it's populated…

clawbot opened issue sneak/upaas#114

2026-02-20 13:51:12 +01:00

CRITICAL: API exposes webhook secret and SSH private key in app detail response

clawbot opened issue sneak/upaas#113

2026-02-20 13:50:59 +01:00

CRITICAL: Port mappings bind to 0.0.0.0 with no restriction on privileged ports or conflicts

clawbot opened issue sneak/upaas#112

2026-02-20 13:50:46 +01:00

CRITICAL: API v1 routes use cookie auth without CSRF protection — cross-site request forgery

clawbot opened issue sneak/upaas#111

2026-02-20 13:50:31 +01:00

CRITICAL: Volume mounts allow access to any host path (Docker socket, /etc/shadow, etc.)

clawbot opened issue sneak/upaas#110

2026-02-20 13:50:16 +01:00

CRITICAL: Deployed containers have no security constraints (capabilities, seccomp, resource limits)

clawbot opened issue sneak/dnswatcher#19

2026-02-20 13:49:42 +01:00

CRITICAL: Port and TLS checks for apex domains silently do nothing

clawbot opened issue sneak/dnswatcher#18

2026-02-20 13:49:42 +01:00

CRITICAL: TLS expiry warning fires on every check cycle with no deduplication

clawbot opened issue sneak/dnswatcher#17

2026-02-20 13:49:41 +01:00

CRITICAL: Data race in State.Save() — mutates snapshot under RLock

clawbot opened issue sneak/dnswatcher#16

2026-02-20 13:49:40 +01:00

CRITICAL: Resolver, PortCheck, and TLSCheck are unimplemented stubs

clawbot commented on pull request sneak/mfer#32

2026-02-20 12:54:19 +01:00

1.0 quality polish — code review, tests, bug fixes, documentation

Re-review: APPROVED ✅

All 5 previously identified issues have been correctly fixed:

GPG --batch --no-tty — Added to all 8 gpg invocations in mfer/gpg.go ✅
**reserved 304 in…

clawbot commented on pull request sneak/mfer#32

2026-02-20 12:52:44 +01:00

1.0 quality polish — code review, tests, bug fixes, documentation

All review findings addressed in ca93d80:

Blocking:

Added --batch --no-tty to all 7 GPG invocations in gpg.go — TestManifestTamperedSignatureFails now passes (was hanging)

**Non-blo…

clawbot pushed to feature/1.0-polish at sneak/mfer

2026-02-20 12:52:30 +01:00

ca93d80f1e fix: address PR #32 review findings

clawbot commented on pull request sneak/vaultik#41

2026-02-20 12:52:28 +01:00

Refactor: break up oversized methods into smaller descriptive helpers

Re-review after rework. Both previously identified issues are fixed correctly:

clawbot commented on pull request sneak/vaultik#41

2026-02-20 12:50:41 +01:00

Refactor: break up oversized methods into smaller descriptive helpers

Fixed both review findings:

scanner.go (uploadBlobIfNeeded): Changed return type from bool to (bool, error). Upload errors are now propagated to the caller, preventing data loss…

clawbot pushed to refactor/break-up-long-methods at sneak/vaultik

2026-02-20 12:50:33 +01:00

37780d59de fix: propagate errors in uploadBlobIfNeeded and listUniqueSnapshotIDs

clawbot commented on pull request sneak/mfer#32

2026-02-20 12:49:24 +01:00

1.0 quality polish — code review, tests, bug fixes, documentation

Code Review: PR #32 - 1.0 Quality Polish

Verdict: Needs rework - one blocking bug

BLOCKING: TestManifestTamperedSignatureFails hangs (test timeout)

File: mfer/gpg_test.go:290…