vasily
4fa17b8086
- Add junior-to-senior with research playbook and review rubric - Add fuck-slop with tell catalog and multi-register voice profiles - Add interface-kit with design engineering, motion, and a11y references - Add app-security with 4-pillar upload defense and hardening playbooks - Add debugging-workflow with systematic root cause isolation - Standardize all skills to 5-phase Skill Architect protocol - Sync symlinks to OpenCode, Codex, and Claude Code
1.6 KiB
1.6 KiB
Security Review & OWASP Verification Checklist
Input Validation & Boundaries
- Pydantic schemas enforce hard string bounds (max 50,000 for text, max 200 for titles).
- Dynamic path/query identifiers validated via
sanitize_identifier(). - Pagination limits clamped to
1 <= limit <= 50. - Batch array inputs clamped to safe upper bounds (max 100–200 items).
Four-Pillar Upload Defense
- Uploads restricted by
DEFAULT_MAX_FILE_SIZE(100MB; 5MB for images). - Blocked executable extensions rejected (
BLOCKED_EXTENSIONS). - Extension checked against
ALLOWED_EXTENSIONS. - Header magic bytes inspected (
check_magic_bytes) to block disguised binaries. - Filenames sanitized with
sanitize_filename()(path traversal and CLI injection stripped). - Disk writes resolved strictly via
safe_resolve_path().
SSRF Defense
- All outbound requests in research/web-retrieval validated with
validate_safe_url(). - Loopback (
127.0.0.1), private RFC 1918 subnets, and cloud metadata (169.254.169.254) blocked. - Scheme restricted strictly to
httpandhttps.
Secrets & Data Hygiene
- Zero API keys, bearer tokens, or password hashes written to
error_logor logs. - Authorization headers masked in logging formatters (
Bearer ***). - Production error responses mask internal database paths and raw tracebacks.
Authorization & State Safety
- Mutations verify that target records match the active session / conversation scope.
- SQLite queries use parameterized SQL; no raw string concatenation.
- Rate limits applied on expensive inference and digestion endpoints.