R-254 CLOSED both sites (controller v0.208.0); R-255 filed; R-242 red again

Browse Source

R-254 site one was the same defect and is fixed the same way. Site two was NOT the
defect the row described: the pre-deploy hidden input is deliberate (a form must
carry what it submits, README §318) and was left alone; the indefensible one was
the readonly display input on an ALREADY-DEPLOYED app, where nothing is submitted.

The premise that this broke a repo rule does not hold and is recorded rather than
dropped: no line in the repo says 'no silent auto-fill'. What exists is
CONTEXT.md:2070, about accidental EMPTY-password deployments.

§7.3 measured on the fleet: site one's code path has never run (crafty-controller
is the only app declaring initial_credentials and is deployed nowhere); site two's
exposure is also empty (demo-hp runs three apps, none with a generated secret
field). HONEST LIMIT: that is a current-state measurement, and nothing recorded
reads — which was part of the fault. No evidence of exposure, and no mechanism
that could have produced evidence either way. Rotation not indicated by anything
measured.

R-255 NEW: the guard covers 4 of 27 pages at runtime, and the cheap all-templates
gate is blind to the shape that actually shipped (a secret under a neutral
page-data key) — both verified, both stated in the gate's own docstring. Filed
rather than declaring a partial guard complete.

R-242 red a second time in 24h; --no-verify declared. The cadence is the argument
for its other half: nothing gates the vouch.

...

This commit is contained in:

authentik Default Admin

2026-08-07 21:27:20 +02:00

parent f651b31a7a

commit 59527d00f9

2 changed files with 33 additions and 22 deletions

Show all changes Ignore whitespace when comparing lines Ignore changes in amount of whitespace Ignore changes in whitespace at EOL

Download Patch File Download Diff File Expand all files Collapse all files

documentation/backlog/OPEN-ITEMS.md

+13 -2

File diff suppressed because one or more lines are too long