What is wrong. The static assets are served with http.FileServer, which answers a request for a directory with an HTML listing of its entries. On the image built from the tag, GET /s/ answers 200 with a page linking css/, and GET /s/css/ with a page linking tailwind.min.css. Confirmed on the running image.
Where (at v1.0.0-rc1): internal/server/routes.go lines 50-56.
Scenario.curl http://localhost:8080/s/ returns <pre><a href="css/">css/</a></pre>. What is listed is only the embedded stylesheet, so nothing secret is exposed; a listing is still a page the service does not mean to serve, and a scanner reports it.
Correct. README, HTTP API: GET /s/... is "Static assets (embedded CSS)", nothing else. REPO_POLICIES.md, HTTP hardening: "if a standard security hardening measure exists for HTTP services and is not listed here, it is still expected. When in doubt, harden." A hardened service does not list directories: a request for a directory under /s/ answers 404, and the stylesheet is served as before.
Done when:GET /s/ and GET /s/css/ answer 404; GET /s/css/tailwind.min.css still answers 200 with text/css; a routes test covers both.
Severity: minor
Model: fable-5-1
**What is wrong.** The static assets are served with `http.FileServer`, which answers a request for a directory with an HTML listing of its entries. On the image built from the tag, `GET /s/` answers `200` with a page linking `css/`, and `GET /s/css/` with a page linking `tailwind.min.css`. Confirmed on the running image.
**Where** (at `v1.0.0-rc1`): `internal/server/routes.go` lines 50-56.
**Scenario.** `curl http://localhost:8080/s/` returns `<pre><a href="css/">css/</a></pre>`. What is listed is only the embedded stylesheet, so nothing secret is exposed; a listing is still a page the service does not mean to serve, and a scanner reports it.
**Correct.** README, HTTP API: `GET /s/...` is "Static assets (embedded CSS)", nothing else. REPO_POLICIES.md, HTTP hardening: "if a standard security hardening measure exists for HTTP services and is not listed here, it is still expected. When in doubt, harden." A hardened service does not list directories: a request for a directory under `/s/` answers `404`, and the stylesheet is served as before.
**Done when:** `GET /s/` and `GET /s/css/` answer `404`; `GET /s/css/tailwind.min.css` still answers `200` with `text/css`; a routes test covers both.
Severity: minor
Model: fable-5-1
clawbot
self-assigned this 2026-10-13 22:55:40 +02:00
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
What is wrong. The static assets are served with
http.FileServer, which answers a request for a directory with an HTML listing of its entries. On the image built from the tag,GET /s/answers200with a page linkingcss/, andGET /s/css/with a page linkingtailwind.min.css. Confirmed on the running image.Where (at
v1.0.0-rc1):internal/server/routes.golines 50-56.Scenario.
curl http://localhost:8080/s/returns<pre><a href="css/">css/</a></pre>. What is listed is only the embedded stylesheet, so nothing secret is exposed; a listing is still a page the service does not mean to serve, and a scanner reports it.Correct. README, HTTP API:
GET /s/...is "Static assets (embedded CSS)", nothing else. REPO_POLICIES.md, HTTP hardening: "if a standard security hardening measure exists for HTTP services and is not listed here, it is still expected. When in doubt, harden." A hardened service does not list directories: a request for a directory under/s/answers404, and the stylesheet is served as before.Done when:
GET /s/andGET /s/css/answer404;GET /s/css/tailwind.min.cssstill answers200withtext/css; a routes test covers both.Severity: minor
Model: fable-5-1