diff --git a/documentation/audits/security-review-2026-10-12/SCANNERS.md b/documentation/audits/security-review-2026-10-12/SCANNERS.md new file mode 100644 index 00000000..a06baa30 --- /dev/null +++ b/documentation/audits/security-review-2026-10-12/SCANNERS.md @@ -0,0 +1,81 @@ +# Scanner baseline — security review 2026-10-12 + +Standard (non-AI) tools, installed as user binaries under `/mnt/5_hdd/felhom.eu/tools/security/bin/` on DooPlex. +Nothing was installed system-wide or on any box. Raw output (redacted) is in `scanners/`. + +| tool | version | how installed | sha256 of the binary (first..last 4) | +|---|---|---|---| +| govulncheck | v1.1.4 | `go install golang.org/x/vuln/cmd/govulncheck@v1.1.4` | 6b04..2f5e | +| gosec | v2.22.4 | `go install github.com/securego/gosec/v2/cmd/gosec@v2.22.4` | 3111..607e | +| gitleaks | 8.24.3 | GitHub release tarball, checked against the release checksums file | e183..72d3 | +| trivy | 0.74.0 | GitHub release tarball, checked against the release checksums file | d89b..d7b9 | + +Trivy note: releases 0.27–0.69.1 are no longer published upstream; 0.74.0 (2026-08-14) was the newest release older +than two weeks. + +## Reviewed commits + +controller `dcd89364a4` (v0.307.0) · agent `86adbcaf8a` (v0.154.0) · felhom.eu `c9b9432986` · catalog `1a642b43e7` · +homelab-manifests `fdd324bb62`. Shipped artifacts: controller image `0.307.0`, hub image `0.146.0`, agent binary +`0.154.0` (copied from demo-hp). + +## 1. govulncheck + +Commands: `govulncheck ./...` in each module (source mode), and `govulncheck -mode binary ` on the shipped +binaries. Source mode reports the stdlib of the LOCAL toolchain (go1.26.0), not the one that built the shipped +program, so the binary mode is the one that counts. + +| target | built with | vulnerabilities reported as reachable | triage | +|---|---|---|---| +| controller 0.307.0 binary | go1.24.13, x/crypto v0.31.0 | 62 (stdlib + x/crypto/ssh) | real → R-972 (toolchain) | +| hub 0.146.0 binary | go1.24.13, x/crypto v0.31.0 | 62 (stdlib + x/crypto/ssh) | real → R-972 | +| agent 0.154.0 binary | go1.26.0 | 27 (stdlib) | real → R-972 | +| source mode, three modules | local go1.26.0 | 46 / 45 / 27 | superseded by the binary rows | + +Mostly denial-of-service fixes; it includes html/template escaping fixes and x/crypto/ssh fixes. Go 1.24 is past the +Go support window (the two newest major releases: https://go.dev/doc/devel/release#policy). + +## 2. gitleaks + +Command: `gitleaks git --redact=100 --log-opts=--all -f json`, full history of all five repositories. +Redacted reports in `scanners/` (author name and e-mail dropped). Each hit was triaged by masked context only: the +line was shown with every long token replaced by its length and a hash prefix; no value was printed. + +| repo | hits | triage | +|---|---|---| +| felhom-controller | 12 | 4 were one live credential → R-950 (rotated 2026-10-12; withheld from the report file); the rest are test constants, docs and decoy fixtures | +| felhom-agent | 15 | all test fixtures | +| felhom.eu | 43 | 1 → R-950 (withheld); 5 are `manifests/felhom.secret.yaml` history → R-925; the rest are old evidence logs of throwaway demo apps (values compared by hash with the running demo apps: none match), test constants, public keys, fingerprints | +| app-catalog-felhom.eu | 1 | a health-probe URL, noise | +| homelab-manifests | 17 | private repository; locations kept off-git; not product. gitleaks did NOT flag R-908's key (note on R-908) | + +A credential found only in history counted until its rotation was checked: the old Gitea registry token in +felhom.eu history is not among the admin account's live tokens (compared by its last eight characters with the token +list); the old Resend key in hub.yaml history was rotated in June (hash differs from the live one). + +## 3. trivy image + +Command: `trivy image --image-src remote --scanners vuln -f json ` (registry API, no Docker daemon). + +| image | OS | fixable CRITICAL / HIGH (OS) | Go binary | triage | +|---|---|---|---|---| +| felhom-controller:0.307.0 | Debian 12.15 | 12 / 23 | felhom-controller go1.24.13 (34 HIGH) | real → R-972 | +| felhom-hub:0.146.0 | Alpine 3.21.8 | 0 / 2 | felhom-hub go1.24.13 (34 HIGH) | real → R-972 | +| felhom-samba:1.1.0 | Alpine 3.21.7 | 0 / 48 | — | real → R-972 | +| traefik:v3.7.13 | Alpine 3.24.2 | 0 / 0 | 4 HIGH (upstream) | upstream; R-979 (pins) | +| cloudflared:2026.9.3 | Debian 13.7 | 0 / 1 | 4 HIGH (upstream) | upstream | +| filebrowser 1.5.6-stable | Alpine 3.24.1 | 1 / 2 | 4 HIGH (upstream) | upstream | + +Not scanned: the 53 catalog app images → R-987. + +## 4. gosec (leads only) + +Command: `gosec -quiet -tests=false -fmt=json ./...` per module. Hits: controller 470, agent 117, hub 215. +Triage of the high-signal rules: G202 (SQL string building) — every hit builds `?` placeholders, noise. G402 (TLS +verify off) — each sits beside a certificate pin, noise. G407/G404 — the export cipher uses random IVs and scrypt, a +backoff jitter uses math/rand, noise. G101 — comments and constant names, noise. G304/G301/G306/G104 — bulk noise, +not filed. + +## 5. Proposed push gate + +Not wired in this session. Shape: R-986. diff --git a/documentation/audits/security-review-2026-10-12/evidence/demo-hp-guest-reads.txt b/documentation/audits/security-review-2026-10-12/evidence/demo-hp-guest-reads.txt new file mode 100644 index 00000000..6f8f0819 --- /dev/null +++ b/documentation/audits/security-review-2026-10-12/evidence/demo-hp-guest-reads.txt @@ -0,0 +1,28 @@ +# demo-hp guests 9201 (reads only) / 9202, 2026-10-12T15:13:29+02:00 +=== guest 9201 +permitrootlogin without-password +passwordauthentication yes +root L 2026-08-18 0 99999 7 -1 +*:22 0.0.0.0:443 0.0.0.0:80 127.0.0.1:25 [::1]:25 [::]:443 [::]:80 +controller privileged=false binds=[/opt/docker/stacks:/opt/docker/stacks /mnt:/mnt:rslave /var/run/docker.sock:/var/run/docker.sock /etc/felhom-bootstrap:/etc/felhom-bootstrap:ro felhom-controller-data:/opt/docker/felhom-controller] +644 root data/settings.json.bak +644 root data/settings.json +600 root data/family.json +600 root data/dashboard-sessions.json +600 root data/encryption.key +644 root data/settings.json.pre-gate-day +600 root data/setup-gate.key +600 root controller.yaml +=== guest 9202 +permitrootlogin without-password +passwordauthentication yes +root L 2026-09-13 0 99999 7 -1 +*:22 0.0.0.0:443 0.0.0.0:80 127.0.0.1:25 [::1]:25 [::]:443 [::]:80 +controller privileged=false binds=[/var/run/docker.sock:/var/run/docker.sock /etc/felhom-bootstrap:/etc/felhom-bootstrap:ro felhom-controller-data:/opt/docker/felhom-controller /opt/docker/stacks:/opt/docker/stacks /mnt:/mnt:rslave] +600 root data/family.json +644 root data/settings.json.bak +600 root data/setup-gate.key +600 root data/encryption.key +644 root data/settings.json +600 root data/dashboard-sessions.json +600 root controller.yaml diff --git a/documentation/audits/security-review-2026-10-12/evidence/demo-hp-host-reads.txt b/documentation/audits/security-review-2026-10-12/evidence/demo-hp-host-reads.txt new file mode 100644 index 00000000..7d2c78a4 --- /dev/null +++ b/documentation/audits/security-review-2026-10-12/evidence/demo-hp-host-reads.txt @@ -0,0 +1,108 @@ +# demo-hp host reads, 2026-10-12T15:13:29+02:00, via ssh demo-hp (read-only) +felhom-agent 0.154.0 +## listening sockets +tcp *:3128 users:(("spiceproxy +tcp *:8006 users:(("pveproxy +tcp 0.0.0.0:111 users:(("rpcbind",pid=689,fd=4),("systemd",pid=1,fd=169)) +tcp 0.0.0.0:22 users:(("sshd",pid=1010,fd=6)) +tcp 0.0.0.0:8822 users:(("sshd",pid=1004,fd=7)) +tcp 127.0.0.1:25 users:(("master",pid=1185,fd=13)) +tcp 127.0.0.1:53 users:(("dnsmasq",pid=1001,fd=7)) +tcp 127.0.0.1:85 users:(("pvedaemon +tcp 169.254.253.1:8443 users:(("felhom-agent",pid=1265,fd=16)) +tcp 192.168.0.104:53 users:(("dnsmasq",pid=1001,fd=5)) +tcp [::1]:25 users:(("master",pid=1185,fd=14)) +tcp [::]:111 users:(("rpcbind",pid=689,fd=6),("systemd",pid=1,fd=171)) +tcp [::]:22 users:(("sshd",pid=1010,fd=7)) +tcp [::]:8822 users:(("sshd",pid=1004,fd=6)) +udp 0.0.0.0:111 users:(("rpcbind",pid=689,fd=5),("systemd",pid=1,fd=170)) +udp 0.0.0.0:55675 +udp 10.77.0.3:51822 users:(("felhom-agent",pid=1265,fd=24)) +udp 127.0.0.1:323 users:(("chronyd",pid=777,fd=4)) +udp 127.0.0.1:53 users:(("dnsmasq",pid=1001,fd=6)) +udp 192.168.0.104:53 users:(("dnsmasq",pid=1001,fd=4)) +udp [::1]:323 users:(("chronyd",pid=777,fd=5)) +udp [::]:111 users:(("rpcbind",pid=689,fd=7),("systemd",pid=1,fd=172)) +udp [::]:55675 +## sshd -T (auth lines) +port 22 +listenaddress [::]:22 +listenaddress 0.0.0.0:22 +maxauthtries 6 +permitrootlogin yes +pubkeyauthentication yes +passwordauthentication yes +kbdinteractiveauthentication no +## nft felhom_oob + chain input { + type filter hook input priority filter - 5; policy accept; + iifname "wg-felhom" tcp dport @ssh_port ip saddr @operator_ips accept + iifname "wg-felhom" tcp dport @ssh_port drop + tcp dport @ssh_port iifname != "wg-felhom" drop +## sudoers.d +total 36 +-r--r----- 1 root root 1068 Apr 11 2026 README +-r--r----- 1 root root 24335 Oct 7 13:36 felhom-agent +-r--r----- 1 root root 1466 Oct 7 13:36 felhom-op +-r--r----- 1 root root 666 May 20 2023 zfs +## guest LXC 9201 (mac masked) +arch: amd64 +cores: 7 +features: nesting=1,keyctl=1 +hookscript: local:snippets/felhom-guest-hook.sh +hostname: demo-hp +memory: 25898 +mp0: local-lvm:vm-9201-disk-1,mp=/var/lib/felhom,backup=1,size=70G +mp8: /mnt/felhom-drives,mp=/mnt/felhom-drives +mp9: /var/lib/felhom-agent/guests/9201/bootstrap,mp=/etc/felhom-bootstrap,ro=1 +net0: name=eth0,bridge=vmbr0,hwaddr=,ip=dhcp,type=veth +net1: name=eth1,bridge=vmbr9,hwaddr=,ip=169.254.253.2/30,type=veth +onboot: 1 +ostype: debian +rootfs: local-lvm:vm-9201-disk-0,size=32G +swap: 512 +unprivileged: 1 +## secret-file modes (paths/modes only) +600 felhom-agent:felhom-agent 2454 /etc/felhom-agent/agent.json +600 felhom-agent:felhom-agent 2498 /etc/felhom-agent/agent.json.night-0925-off +600 felhom-agent:felhom-agent 2451 /etc/felhom-agent/agent.json.pre-a4-retention +600 felhom-agent:felhom-agent 2451 /etc/felhom-agent/agent.json.pre-d44 +600 root:root 2451 /etc/felhom-agent/agent.json.pre-r672 +644 root:root 0 /etc/felhom/.bootstrap-done +644 root:root 7 /etc/felhom/appliance-pairing-code +644 root:root 3429 /etc/felhom/config-bundle.json +644 root:root 456 /etc/felhom/crash-guard.conf +644 root:root 131 /etc/felhom/operator-signers +644 root:root 61 /etc/felhom/os-trust.json +600 felhom-agent:felhom-agent 189 /var/lib/felhom-agent/backup-success-state.json +600 felhom-agent:felhom-agent 290 /var/lib/felhom-agent/controller-swap-9201.json +600 felhom-agent:felhom-agent 61 /var/lib/felhom-agent/drive-intents.json +600 felhom-agent:felhom-agent 64 /var/lib/felhom-agent/escrow-stage/restic_repo_password +600 felhom-agent:felhom-agent 93 /var/lib/felhom-agent/felhom-sshd/authorized_keys.felhom-op +600 felhom-agent:felhom-agent 5 /var/lib/felhom-agent/felhom-sshd/port +600 felhom-agent:felhom-agent 433 /var/lib/felhom-agent/felhom-sshd/sshd_config +600 felhom-agent:felhom-agent 67 /var/lib/felhom-agent/guest-binds.json +600 felhom-agent:felhom-agent 241 /var/lib/felhom-agent/guest-disk-trim.json +600 100000:100000 403 /var/lib/felhom-agent/guests/9201/bootstrap/bootstrap.json +600 felhom-agent:felhom-agent 234 /var/lib/felhom-agent/guests/9201/controller-restarts-24h.json +644 root:root 254 /var/lib/felhom-agent/guests/9202/bootstrap/bootstrap.json +600 felhom-agent:felhom-agent 31342 /var/lib/felhom-agent/journal.log +644 felhom-agent:felhom-agent 591 /var/lib/felhom-agent/local-api.crt +600 felhom-agent:felhom-agent 227 /var/lib/felhom-agent/local-api.key +600 felhom-agent:felhom-agent 82 /var/lib/felhom-agent/local-tokens.log +600 felhom-agent:felhom-agent 3196 /var/lib/felhom-agent/nonces.log +600 felhom-agent:felhom-agent 20 /var/lib/felhom-agent/os/last-night-run +600 felhom-agent:felhom-agent 79 /var/lib/felhom-agent/os/os-update-block.json +600 felhom-agent:felhom-agent 0 /var/lib/felhom-agent/os/pass.lock +600 felhom-agent:felhom-agent 148 /var/lib/felhom-agent/os/plan-20261005T025659Z-guest-apply.json +600 felhom-agent:felhom-agent 203 /var/lib/felhom-agent/os/plan-20261005T054446Z-guest-apply.json +600 felhom-agent:felhom-agent 203 /var/lib/felhom-agent/os/plan-20261005T061334Z-guest-apply.json +600 felhom-agent:felhom-agent 203 /var/lib/felhom-agent/os/plan-20261005T075541Z-guest-apply.json +600 felhom-agent:felhom-agent 2398 /var/lib/felhom-agent/pbsdr/agent.json.pre-seed +600 felhom-agent:felhom-agent 129 /var/lib/felhom-agent/pbsdr/marker.json +600 felhom-agent:felhom-agent 367 /var/lib/felhom-agent/restore-test-state.json +644 felhom-agent:felhom-agent 288 /var/lib/felhom-agent/units/mnt-hdd_1.mount +600 felhom-agent:felhom-agent 64 /var/lib/felhom-agent/wg/last-applied.sha +600 felhom-agent:felhom-agent 45 /var/lib/felhom-agent/wg/private.key +600 felhom-agent:felhom-agent 101 /var/lib/felhom-agent/wg/registered.json +600 felhom-agent:felhom-agent 327 /var/lib/felhom-agent/wg/wg-felhom.conf diff --git a/documentation/audits/security-review-2026-10-12/evidence/demo-hp-lan-tcp-connect.txt b/documentation/audits/security-review-2026-10-12/evidence/demo-hp-lan-tcp-connect.txt new file mode 100644 index 00000000..7f1ed5b9 --- /dev/null +++ b/documentation/audits/security-review-2026-10-12/evidence/demo-hp-lan-tcp-connect.txt @@ -0,0 +1 @@ +192.168.0.104 open TCP: [22, 53, 111, 3128, 8006] diff --git a/documentation/audits/security-review-2026-10-12/evidence/hub-0.148.0-live-check.txt b/documentation/audits/security-review-2026-10-12/evidence/hub-0.148.0-live-check.txt new file mode 100644 index 00000000..bc22ef29 --- /dev/null +++ b/documentation/audits/security-review-2026-10-12/evidence/hub-0.148.0-live-check.txt @@ -0,0 +1,7 @@ +# hub v0.148.0 live check 2026-10-12T16:58:46+02:00 from DooPlex (LAN; the ingress admits LAN, HU, IE) +A no credential GET /api/v1/customers -> 403 body names a customer: False body: Forbidden: global key required +C operator key GET /api/v1/customers -> 200 bytes 1247 +A no credential GET /api/v1/customers/ -> 403 body names a customer: False body: Forbidden: global key required +C operator key GET /api/v1/customers/ -> 200 bytes 2542 +A no credential GET /api/v1/customers//history -> 403 body names a customer: False body: Forbidden: global key required +C operator key GET /api/v1/customers//history -> 200 bytes 3 diff --git a/documentation/audits/security-review-2026-10-12/evidence/public-sites.txt b/documentation/audits/security-review-2026-10-12/evidence/public-sites.txt new file mode 100644 index 00000000..41a975b8 --- /dev/null +++ b/documentation/audits/security-review-2026-10-12/evidence/public-sites.txt @@ -0,0 +1,29 @@ +# public sites, read-only GETs at browsing rate, 2026-10-12T15:13:59+02:00, from DooPlex +== https://felhom.eu/ +HTTP/2 200 +x-frame-options: SAMEORIGIN +x-content-type-options: nosniff +strict-transport-security: max-age=31536000; includeSubDomains +== https://iso.felhom.eu/ +HTTP/2 404 +server: cloudflare +== https://stats.felhom.eu/ +HTTP/2 200 +content-security-policy: default-src 'self'; img-src 'self' https: data:; script-src 'self' 'unsafe-eval' 'unsafe-inline'; style-src 'self' 'unsafe-inline'; connect-src 'self' https:; frame-ancestors 'self' ; +strict-transport-security: max-age=31536000; includeSubDomains +== https://gitea.dooplex.hu/ +HTTP/2 200 +x-frame-options: SAMEORIGIN +strict-transport-security: max-age=31536000; includeSubDomains +== https://hub.felhom.eu/login +HTTP/2 200 +strict-transport-security: max-age=31536000; includeSubDomains +felhom.eu/.git/HEAD 404 +felhom.eu/scripts/ 403 +felhom.eu/.env 404 +felhom.eu/robots.txt 200 +== gitea anonymous repo list +[('admin/app-catalog-felhom.eu', 'public'), ('admin/felhom-agent', 'public'), ('admin/felhom-controller', 'public'), ('admin/felhom.eu', 'public'), ('admin/misc-scripts', 'public'), ('admin/recipe-importer', 'public'), ('admin/revfulop-calendar', 'public')] +== gitea sign-up page says: +['Registration is disabled.'] +gitea anon packages API 401 diff --git a/documentation/audits/security-review-2026-10-12/scanners/gitleaks-app-catalog-felhom.eu.redacted.json b/documentation/audits/security-review-2026-10-12/scanners/gitleaks-app-catalog-felhom.eu.redacted.json new file mode 100644 index 00000000..42773e41 --- /dev/null +++ b/documentation/audits/security-review-2026-10-12/scanners/gitleaks-app-catalog-felhom.eu.redacted.json @@ -0,0 +1,22 @@ +{ + "withheld_P1_entries": 0, + "findings": [ + { + "RuleID": "generic-api-key", + "Description": "Detected a Generic API Key, potentially exposing access to various services and sensitive operations.", + "StartLine": 13, + "EndLine": 13, + "StartColumn": 53, + "EndColumn": 90, + "Secret": "REDACTED", + "File": "REPORT.md", + "SymlinkFile": "", + "Commit": "f51f794cf0f2d03206449bf7b79381be85879d32", + "Entropy": 3.9232519, + "Date": "2026-06-22T13:12:19Z", + "Message": "docs: REPORT for komga healthcheck fix\n\nCo-Authored-By: Claude Opus 4.8 (1M context) ", + "Tags": [], + "Fingerprint": "f51f794cf0f2d03206449bf7b79381be85879d32:REPORT.md:generic-api-key:13" + } + ] +} \ No newline at end of file diff --git a/documentation/audits/security-review-2026-10-12/scanners/gitleaks-felhom-agent.redacted.json b/documentation/audits/security-review-2026-10-12/scanners/gitleaks-felhom-agent.redacted.json new file mode 100644 index 00000000..7dd285a3 --- /dev/null +++ b/documentation/audits/security-review-2026-10-12/scanners/gitleaks-felhom-agent.redacted.json @@ -0,0 +1,260 @@ +{ + "withheld_P1_entries": 0, + "findings": [ + { + "RuleID": "generic-api-key", + "Description": "Detected a Generic API Key, potentially exposing access to various services and sensitive operations.", + "StartLine": 246, + "EndLine": 246, + "StartColumn": 43, + "EndColumn": 128, + "Secret": "REDACTED", + "File": "internal/escrow/recover_retained_test.go", + "SymlinkFile": "", + "Commit": "91b9405c81bd94f6f1067eed5ce866879363ba29", + "Entropy": 3.97006, + "Date": "2026-10-08T05:53:01Z", + "Message": "R-304: no 'wrong code' when earlier sealed packages were not all checked (424 older_unchecked)\n\nUnreleased; ships with tomorrow's release.\n\nCo-Authored-By: Claude Opus 5.5 (1M context) \nClaude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS", + "Tags": [], + "Fingerprint": "91b9405c81bd94f6f1067eed5ce866879363ba29:internal/escrow/recover_retained_test.go:generic-api-key:246" + }, + { + "RuleID": "generic-api-key", + "Description": "Detected a Generic API Key, potentially exposing access to various services and sensitive operations.", + "StartLine": 247, + "EndLine": 247, + "StartColumn": 41, + "EndColumn": 126, + "Secret": "REDACTED", + "File": "internal/escrow/recover_retained_test.go", + "SymlinkFile": "", + "Commit": "91b9405c81bd94f6f1067eed5ce866879363ba29", + "Entropy": 3.9528196, + "Date": "2026-10-08T05:53:01Z", + "Message": "R-304: no 'wrong code' when earlier sealed packages were not all checked (424 older_unchecked)\n\nUnreleased; ships with tomorrow's release.\n\nCo-Authored-By: Claude Opus 5.5 (1M context) \nClaude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS", + "Tags": [], + "Fingerprint": "91b9405c81bd94f6f1067eed5ce866879363ba29:internal/escrow/recover_retained_test.go:generic-api-key:247" + }, + { + "RuleID": "generic-api-key", + "Description": "Detected a Generic API Key, potentially exposing access to various services and sensitive operations.", + "StartLine": 295, + "EndLine": 295, + "StartColumn": 43, + "EndColumn": 128, + "Secret": "REDACTED", + "File": "internal/escrow/recover_retained_test.go", + "SymlinkFile": "", + "Commit": "91b9405c81bd94f6f1067eed5ce866879363ba29", + "Entropy": 3.9528196, + "Date": "2026-10-08T05:53:01Z", + "Message": "R-304: no 'wrong code' when earlier sealed packages were not all checked (424 older_unchecked)\n\nUnreleased; ships with tomorrow's release.\n\nCo-Authored-By: Claude Opus 5.5 (1M context) \nClaude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS", + "Tags": [], + "Fingerprint": "91b9405c81bd94f6f1067eed5ce866879363ba29:internal/escrow/recover_retained_test.go:generic-api-key:295" + }, + { + "RuleID": "generic-api-key", + "Description": "Detected a Generic API Key, potentially exposing access to various services and sensitive operations.", + "StartLine": 30, + "EndLine": 30, + "StartColumn": 43, + "EndColumn": 128, + "Secret": "REDACTED", + "File": "internal/escrow/recover_retained_test.go", + "SymlinkFile": "", + "Commit": "1db56bf8379df68ee23e7b000c5ff01bd76b5c79", + "Entropy": 3.9528196, + "Date": "2026-08-12T16:40:00Z", + "Message": "v0.129.0 \u2014 a correct code for an earlier package stops being called wrong (R-311)\n\nYesterday's drill proved a retained escrow package opens a set-aside store and\nrestores planted files byte-identical, while this agent answered the customer's\ncorrect code with \"the recovery code did not open the sealed bundle\". Nothing had\never tried the retained packages, so a correct-but-earlier code and a mistype were\ngenuinely indistinguishable.\n\nOffsiteKeyRecoverer gains an optional FetchRetained, consulted ONLY after the\ncurrent package refuses, so the ordinary recovery pays nothing for it and cannot\nfail because of it. A match returns ErrCodeOpensRetained wrapped in a\nRetainedOpenedError carrying the supersession date - no material, no code, no\npassword. The local API answers 422: a FIFTH status added to the R-224 switch,\nnever a restructuring of it.\n\nFail-safe in every direction. Nil fetcher, a hub too old for the route (404 is a\nclean \"none\"), a transport failure, a malformed package: each leaves the original\nrefusal standing. Attempts bounded at 6 because each unwrap is ~1s of scrypt.\n\nSeven tests with REAL age crypto - the two situations are indistinguishable AT\nTHE UNWRAP, so a faked unwrap would prove nothing. Red-proof asserted applied:\nremove the retained lookup and the fail-closed wrong-code error returns, which is\nthe lie in those exact words.", + "Tags": [], + "Fingerprint": "1db56bf8379df68ee23e7b000c5ff01bd76b5c79:internal/escrow/recover_retained_test.go:generic-api-key:30" + }, + { + "RuleID": "generic-api-key", + "Description": "Detected a Generic API Key, potentially exposing access to various services and sensitive operations.", + "StartLine": 102, + "EndLine": 102, + "StartColumn": 43, + "EndColumn": 128, + "Secret": "REDACTED", + "File": "internal/escrow/recover_retained_test.go", + "SymlinkFile": "", + "Commit": "1db56bf8379df68ee23e7b000c5ff01bd76b5c79", + "Entropy": 3.9528196, + "Date": "2026-08-12T16:40:00Z", + "Message": "v0.129.0 \u2014 a correct code for an earlier package stops being called wrong (R-311)\n\nYesterday's drill proved a retained escrow package opens a set-aside store and\nrestores planted files byte-identical, while this agent answered the customer's\ncorrect code with \"the recovery code did not open the sealed bundle\". Nothing had\never tried the retained packages, so a correct-but-earlier code and a mistype were\ngenuinely indistinguishable.\n\nOffsiteKeyRecoverer gains an optional FetchRetained, consulted ONLY after the\ncurrent package refuses, so the ordinary recovery pays nothing for it and cannot\nfail because of it. A match returns ErrCodeOpensRetained wrapped in a\nRetainedOpenedError carrying the supersession date - no material, no code, no\npassword. The local API answers 422: a FIFTH status added to the R-224 switch,\nnever a restructuring of it.\n\nFail-safe in every direction. Nil fetcher, a hub too old for the route (404 is a\nclean \"none\"), a transport failure, a malformed package: each leaves the original\nrefusal standing. Attempts bounded at 6 because each unwrap is ~1s of scrypt.\n\nSeven tests with REAL age crypto - the two situations are indistinguishable AT\nTHE UNWRAP, so a faked unwrap would prove nothing. Red-proof asserted applied:\nremove the retained lookup and the fail-closed wrong-code error returns, which is\nthe lie in those exact words.", + "Tags": [], + "Fingerprint": "1db56bf8379df68ee23e7b000c5ff01bd76b5c79:internal/escrow/recover_retained_test.go:generic-api-key:102" + }, + { + "RuleID": "generic-api-key", + "Description": "Detected a Generic API Key, potentially exposing access to various services and sensitive operations.", + "StartLine": 103, + "EndLine": 103, + "StartColumn": 44, + "EndColumn": 129, + "Secret": "REDACTED", + "File": "internal/escrow/recover_retained_test.go", + "SymlinkFile": "", + "Commit": "1db56bf8379df68ee23e7b000c5ff01bd76b5c79", + "Entropy": 3.9528196, + "Date": "2026-08-12T16:40:00Z", + "Message": "v0.129.0 \u2014 a correct code for an earlier package stops being called wrong (R-311)\n\nYesterday's drill proved a retained escrow package opens a set-aside store and\nrestores planted files byte-identical, while this agent answered the customer's\ncorrect code with \"the recovery code did not open the sealed bundle\". Nothing had\never tried the retained packages, so a correct-but-earlier code and a mistype were\ngenuinely indistinguishable.\n\nOffsiteKeyRecoverer gains an optional FetchRetained, consulted ONLY after the\ncurrent package refuses, so the ordinary recovery pays nothing for it and cannot\nfail because of it. A match returns ErrCodeOpensRetained wrapped in a\nRetainedOpenedError carrying the supersession date - no material, no code, no\npassword. The local API answers 422: a FIFTH status added to the R-224 switch,\nnever a restructuring of it.\n\nFail-safe in every direction. Nil fetcher, a hub too old for the route (404 is a\nclean \"none\"), a transport failure, a malformed package: each leaves the original\nrefusal standing. Attempts bounded at 6 because each unwrap is ~1s of scrypt.\n\nSeven tests with REAL age crypto - the two situations are indistinguishable AT\nTHE UNWRAP, so a faked unwrap would prove nothing. Red-proof asserted applied:\nremove the retained lookup and the fail-closed wrong-code error returns, which is\nthe lie in those exact words.", + "Tags": [], + "Fingerprint": "1db56bf8379df68ee23e7b000c5ff01bd76b5c79:internal/escrow/recover_retained_test.go:generic-api-key:103" + }, + { + "RuleID": "generic-api-key", + "Description": "Detected a Generic API Key, potentially exposing access to various services and sensitive operations.", + "StartLine": 125, + "EndLine": 125, + "StartColumn": 43, + "EndColumn": 128, + "Secret": "REDACTED", + "File": "internal/escrow/recover_retained_test.go", + "SymlinkFile": "", + "Commit": "1db56bf8379df68ee23e7b000c5ff01bd76b5c79", + "Entropy": 3.9528196, + "Date": "2026-08-12T16:40:00Z", + "Message": "v0.129.0 \u2014 a correct code for an earlier package stops being called wrong (R-311)\n\nYesterday's drill proved a retained escrow package opens a set-aside store and\nrestores planted files byte-identical, while this agent answered the customer's\ncorrect code with \"the recovery code did not open the sealed bundle\". Nothing had\never tried the retained packages, so a correct-but-earlier code and a mistype were\ngenuinely indistinguishable.\n\nOffsiteKeyRecoverer gains an optional FetchRetained, consulted ONLY after the\ncurrent package refuses, so the ordinary recovery pays nothing for it and cannot\nfail because of it. A match returns ErrCodeOpensRetained wrapped in a\nRetainedOpenedError carrying the supersession date - no material, no code, no\npassword. The local API answers 422: a FIFTH status added to the R-224 switch,\nnever a restructuring of it.\n\nFail-safe in every direction. Nil fetcher, a hub too old for the route (404 is a\nclean \"none\"), a transport failure, a malformed package: each leaves the original\nrefusal standing. Attempts bounded at 6 because each unwrap is ~1s of scrypt.\n\nSeven tests with REAL age crypto - the two situations are indistinguishable AT\nTHE UNWRAP, so a faked unwrap would prove nothing. Red-proof asserted applied:\nremove the retained lookup and the fail-closed wrong-code error returns, which is\nthe lie in those exact words.", + "Tags": [], + "Fingerprint": "1db56bf8379df68ee23e7b000c5ff01bd76b5c79:internal/escrow/recover_retained_test.go:generic-api-key:125" + }, + { + "RuleID": "generic-api-key", + "Description": "Detected a Generic API Key, potentially exposing access to various services and sensitive operations.", + "StartLine": 151, + "EndLine": 151, + "StartColumn": 43, + "EndColumn": 128, + "Secret": "REDACTED", + "File": "internal/escrow/recover_retained_test.go", + "SymlinkFile": "", + "Commit": "1db56bf8379df68ee23e7b000c5ff01bd76b5c79", + "Entropy": 3.9528196, + "Date": "2026-08-12T16:40:00Z", + "Message": "v0.129.0 \u2014 a correct code for an earlier package stops being called wrong (R-311)\n\nYesterday's drill proved a retained escrow package opens a set-aside store and\nrestores planted files byte-identical, while this agent answered the customer's\ncorrect code with \"the recovery code did not open the sealed bundle\". Nothing had\never tried the retained packages, so a correct-but-earlier code and a mistype were\ngenuinely indistinguishable.\n\nOffsiteKeyRecoverer gains an optional FetchRetained, consulted ONLY after the\ncurrent package refuses, so the ordinary recovery pays nothing for it and cannot\nfail because of it. A match returns ErrCodeOpensRetained wrapped in a\nRetainedOpenedError carrying the supersession date - no material, no code, no\npassword. The local API answers 422: a FIFTH status added to the R-224 switch,\nnever a restructuring of it.\n\nFail-safe in every direction. Nil fetcher, a hub too old for the route (404 is a\nclean \"none\"), a transport failure, a malformed package: each leaves the original\nrefusal standing. Attempts bounded at 6 because each unwrap is ~1s of scrypt.\n\nSeven tests with REAL age crypto - the two situations are indistinguishable AT\nTHE UNWRAP, so a faked unwrap would prove nothing. Red-proof asserted applied:\nremove the retained lookup and the fail-closed wrong-code error returns, which is\nthe lie in those exact words.", + "Tags": [], + "Fingerprint": "1db56bf8379df68ee23e7b000c5ff01bd76b5c79:internal/escrow/recover_retained_test.go:generic-api-key:151" + }, + { + "RuleID": "generic-api-key", + "Description": "Detected a Generic API Key, potentially exposing access to various services and sensitive operations.", + "StartLine": 169, + "EndLine": 169, + "StartColumn": 43, + "EndColumn": 128, + "Secret": "REDACTED", + "File": "internal/escrow/recover_retained_test.go", + "SymlinkFile": "", + "Commit": "1db56bf8379df68ee23e7b000c5ff01bd76b5c79", + "Entropy": 3.97006, + "Date": "2026-08-12T16:40:00Z", + "Message": "v0.129.0 \u2014 a correct code for an earlier package stops being called wrong (R-311)\n\nYesterday's drill proved a retained escrow package opens a set-aside store and\nrestores planted files byte-identical, while this agent answered the customer's\ncorrect code with \"the recovery code did not open the sealed bundle\". Nothing had\never tried the retained packages, so a correct-but-earlier code and a mistype were\ngenuinely indistinguishable.\n\nOffsiteKeyRecoverer gains an optional FetchRetained, consulted ONLY after the\ncurrent package refuses, so the ordinary recovery pays nothing for it and cannot\nfail because of it. A match returns ErrCodeOpensRetained wrapped in a\nRetainedOpenedError carrying the supersession date - no material, no code, no\npassword. The local API answers 422: a FIFTH status added to the R-224 switch,\nnever a restructuring of it.\n\nFail-safe in every direction. Nil fetcher, a hub too old for the route (404 is a\nclean \"none\"), a transport failure, a malformed package: each leaves the original\nrefusal standing. Attempts bounded at 6 because each unwrap is ~1s of scrypt.\n\nSeven tests with REAL age crypto - the two situations are indistinguishable AT\nTHE UNWRAP, so a faked unwrap would prove nothing. Red-proof asserted applied:\nremove the retained lookup and the fail-closed wrong-code error returns, which is\nthe lie in those exact words.", + "Tags": [], + "Fingerprint": "1db56bf8379df68ee23e7b000c5ff01bd76b5c79:internal/escrow/recover_retained_test.go:generic-api-key:169" + }, + { + "RuleID": "generic-api-key", + "Description": "Detected a Generic API Key, potentially exposing access to various services and sensitive operations.", + "StartLine": 196, + "EndLine": 196, + "StartColumn": 43, + "EndColumn": 128, + "Secret": "REDACTED", + "File": "internal/escrow/recover_retained_test.go", + "SymlinkFile": "", + "Commit": "1db56bf8379df68ee23e7b000c5ff01bd76b5c79", + "Entropy": 3.97006, + "Date": "2026-08-12T16:40:00Z", + "Message": "v0.129.0 \u2014 a correct code for an earlier package stops being called wrong (R-311)\n\nYesterday's drill proved a retained escrow package opens a set-aside store and\nrestores planted files byte-identical, while this agent answered the customer's\ncorrect code with \"the recovery code did not open the sealed bundle\". Nothing had\never tried the retained packages, so a correct-but-earlier code and a mistype were\ngenuinely indistinguishable.\n\nOffsiteKeyRecoverer gains an optional FetchRetained, consulted ONLY after the\ncurrent package refuses, so the ordinary recovery pays nothing for it and cannot\nfail because of it. A match returns ErrCodeOpensRetained wrapped in a\nRetainedOpenedError carrying the supersession date - no material, no code, no\npassword. The local API answers 422: a FIFTH status added to the R-224 switch,\nnever a restructuring of it.\n\nFail-safe in every direction. Nil fetcher, a hub too old for the route (404 is a\nclean \"none\"), a transport failure, a malformed package: each leaves the original\nrefusal standing. Attempts bounded at 6 because each unwrap is ~1s of scrypt.\n\nSeven tests with REAL age crypto - the two situations are indistinguishable AT\nTHE UNWRAP, so a faked unwrap would prove nothing. Red-proof asserted applied:\nremove the retained lookup and the fail-closed wrong-code error returns, which is\nthe lie in those exact words.", + "Tags": [], + "Fingerprint": "1db56bf8379df68ee23e7b000c5ff01bd76b5c79:internal/escrow/recover_retained_test.go:generic-api-key:196" + }, + { + "RuleID": "generic-api-key", + "Description": "Detected a Generic API Key, potentially exposing access to various services and sensitive operations.", + "StartLine": 197, + "EndLine": 197, + "StartColumn": 40, + "EndColumn": 125, + "Secret": "REDACTED", + "File": "internal/escrow/recover_retained_test.go", + "SymlinkFile": "", + "Commit": "1db56bf8379df68ee23e7b000c5ff01bd76b5c79", + "Entropy": 3.97006, + "Date": "2026-08-12T16:40:00Z", + "Message": "v0.129.0 \u2014 a correct code for an earlier package stops being called wrong (R-311)\n\nYesterday's drill proved a retained escrow package opens a set-aside store and\nrestores planted files byte-identical, while this agent answered the customer's\ncorrect code with \"the recovery code did not open the sealed bundle\". Nothing had\never tried the retained packages, so a correct-but-earlier code and a mistype were\ngenuinely indistinguishable.\n\nOffsiteKeyRecoverer gains an optional FetchRetained, consulted ONLY after the\ncurrent package refuses, so the ordinary recovery pays nothing for it and cannot\nfail because of it. A match returns ErrCodeOpensRetained wrapped in a\nRetainedOpenedError carrying the supersession date - no material, no code, no\npassword. The local API answers 422: a FIFTH status added to the R-224 switch,\nnever a restructuring of it.\n\nFail-safe in every direction. Nil fetcher, a hub too old for the route (404 is a\nclean \"none\"), a transport failure, a malformed package: each leaves the original\nrefusal standing. Attempts bounded at 6 because each unwrap is ~1s of scrypt.\n\nSeven tests with REAL age crypto - the two situations are indistinguishable AT\nTHE UNWRAP, so a faked unwrap would prove nothing. Red-proof asserted applied:\nremove the retained lookup and the fail-closed wrong-code error returns, which is\nthe lie in those exact words.", + "Tags": [], + "Fingerprint": "1db56bf8379df68ee23e7b000c5ff01bd76b5c79:internal/escrow/recover_retained_test.go:generic-api-key:197" + }, + { + "RuleID": "generic-api-key", + "Description": "Detected a Generic API Key, potentially exposing access to various services and sensitive operations.", + "StartLine": 243, + "EndLine": 243, + "StartColumn": 40, + "EndColumn": 77, + "Secret": "REDACTED", + "File": "internal/escrow/recover_test.go", + "SymlinkFile": "", + "Commit": "a2e914f683bd1fddbc843c5ebf38e71500ebf0b9", + "Entropy": 4, + "Date": "2026-08-06T05:55:15Z", + "Message": "v0.126.0: a fetch failure is not a wrong recovery code (R-224)\n\nA hub the agent could not reach was reported to the customer as a bad recovery\ncode. Measured live 2026-08-05 (CAMPAIGN-11 F3): hub firewalled off, a CORRECT\ncurrent code, and the customer told it did not open their package \u2014 in 0.0556s\nagainst ~1.0s for a real unseal. No unseal was attempted.\n\nThe discriminator existed here and this boundary threw it away: recover.go\nfails at four distinguishable points and the local-api handler had cases for\ntwo, with a default answering 'the recovery code did not open the sealed\nbundle, OR the bundle could not be fetched'.\n\nescrow.ErrBundleFetch now joins the fetch leg and the handler routes it to 502\nwith its own words \u2014 the code was NOT used. 502 not 4xx: the request was not\nbad, an upstream dependency failed. Four situations, four statuses: 502 fetch /\n400 fetched-and-refused / 404 no bundle / 409 predates the field. The\ncontroller classifies on the STATUS and never parses the sentence.\n\nA GREEN TEST NAMED THIS DEFECT AND DID NOT PREVENT IT.\nTestRecoverOffsiteRepoPassword_FetchErrorIsDistinct has said since v0.125.0\nthat the operator must not be sent to re-read their code because the hub was\nunreachable \u2014 and passed throughout, because it asserted this package's error\nSTRING one layer below the merge, and a string is not something a caller can\nbranch on. Re-pointed at the sentinel, with a consequence-level twin asserting\nthe status.\n\nRed-proofs: removing the %w join fails the sentinel test; deleting the handler\ncase makes fetch and wrong-code both answer 400 with the wrong-code sentence.\n\n29 packages ok, vet clean, agent gates OK.", + "Tags": [], + "Fingerprint": "a2e914f683bd1fddbc843c5ebf38e71500ebf0b9:internal/escrow/recover_test.go:generic-api-key:243" + }, + { + "RuleID": "generic-api-key", + "Description": "Detected a Generic API Key, potentially exposing access to various services and sensitive operations.", + "StartLine": 128, + "EndLine": 128, + "StartColumn": 9, + "EndColumn": 46, + "Secret": "REDACTED", + "File": "internal/pbsdr/wrapper_read_test.go", + "SymlinkFile": "", + "Commit": "b2ca63ee9fe3eec9454b05c7d8d8dd2ace51b35e", + "Entropy": 4.3565583, + "Date": "2026-07-21T08:12:31Z", + "Message": "v0.91.0 \u2014 the DR tier can no longer be `applied` and dead at the same time (R-39 + R-50b(a))\n\nCloses the agent half of R-39's fleet fix. Requires hub >=0.68.0 for the re-arm signal;\nthat hub is safe for 0.90.0 agents (unknown key dropped), so it deploys first.\n\nThree compounding defects let a box report `applied` while every PBS request 401'd:\n\n1. The re-key was INVISIBLE. An ep0 re-issue rotates the secret of an existing token, so\n token_id/fingerprint/datastore/namespace come back byte-identical and the descriptor\n content hash never moved \u2014 the converged agent short-circuited and never consumed the\n fresh secret. WirePBSDR.SecretGeneration (field-exact with the hub) is what moves the\n hash now, because descriptorHash marshals this struct.\n\n2. The agent could not READ its own credential. It writes /etc/pve/priv/storage/.pw\n through the root wrapper, but that dir is 0700 root:www-data and the wrapper had no\n read verb \u2014 so the target resolver got \"permission denied\" every cycle, warned, and\n skipped. The one loop that could have caught the 401 was blind BY CONSTRUCTION. Adds a\n narrow `read` verb (+ exactly one sudoers line, + a pbsdr-read capability row): one\n secret to stdout, no network, no mutation, never in argv (sudo logs argv), traversal\n refused by the id grammar, the dir allowlist AND a resolved-path prefix assertion.\n\n3. Nothing probed AUTHENTICATION. pbs.ProbeAuth (GET /version + an ErrUnauthorized\n sentinel) runs on the 15-minute collect path and its verdict becomes a loud\n `auth_failed` the hub escalates to a fresh mint. /version needs no datastore, namespace\n or privilege, so a 401 means the CREDENTIAL is bad; 403 is deliberately NOT treated as\n unauthorized, since re-keying a too-narrow token would mint forever without fixing\n anything. A transport error is UNKNOWN, never a rejection \u2014 otherwise every network\n blip burns a credential. Recovery self-clears.\n\nR-50b(a): the report now carries the installed wrapper's sha256 so drift against the\nvouched manifest value is answerable. Empty = unknown, never drift.\n\nThree red-proofs, all at the assertion level. Removing SecretGeneration fails the re-arm\ntest with \"consume calls=1, want 2\". Swallowing the probe result leaves State:applied\nAuthFailed:false \u2014 the July-18 shape exactly. Notably, deleting the wrapper's id charset\nguard alone does NOT open a traversal hole (readlink + the prefix assertion still catch\nit), so the isolating red-proof removes BOTH and shows the out-of-tree secret printed \u2014\nthe layering is real, and a single-guard red-proof would have passed vacuously.", + "Tags": [], + "Fingerprint": "b2ca63ee9fe3eec9454b05c7d8d8dd2ace51b35e:internal/pbsdr/wrapper_read_test.go:generic-api-key:128" + }, + { + "RuleID": "generic-api-key", + "Description": "Detected a Generic API Key, potentially exposing access to various services and sensitive operations.", + "StartLine": 22, + "EndLine": 22, + "StartColumn": 9, + "EndColumn": 83, + "Secret": "REDACTED", + "File": "internal/localapi/escrow_stage_test.go", + "SymlinkFile": "", + "Commit": "0c22b9bbf3c6a6d1411f9527df0ce40b26c5236e", + "Entropy": 3.6241388, + "Date": "2026-07-09T12:56:09Z", + "Message": "v0.77.0: fork-4 \u2014 escrow the offsite restic repo password under R\n\nIdentityBundle gains ResticRepoPassword (rides existing age-under-R\nWrapIdentityBundle; custody spike febdc56 proved a recovered value opens the\nreal repo). POST /escrow/stage-secret (withGuest, scopedFromBody) transiently\nstages the controller-pushed password (0600, atomic, NEVER logged), which the\nescrow-create ceremony auto-injects then wipes. Adds AttachResticPassword +\nStagedResticPasswordPath + WipeStagedResticPassword; EscrowStagePath injectable\nfor tests. Tests: bundle carries pw byte-exact + not-in-blob + wrong-R fails\nclosed; stage 0600 + non-secret ack + cross-guest 403 + value-not-in-log.\nAdditive; PBS-K escrow untouched. NOT yet live-validated (supervised ceremony).\n\nCo-Authored-By: Claude Opus 4.8 \nClaude-Session: https://claude.ai/code/session_01PSK5g6qYLknKj8u3QAFEr6", + "Tags": [], + "Fingerprint": "0c22b9bbf3c6a6d1411f9527df0ce40b26c5236e:internal/localapi/escrow_stage_test.go:generic-api-key:22" + }, + { + "RuleID": "generic-api-key", + "Description": "Detected a Generic API Key, potentially exposing access to various services and sensitive operations.", + "StartLine": 49, + "EndLine": 49, + "StartColumn": 28, + "EndColumn": 69, + "Secret": "REDACTED", + "File": "internal/escrow/identity_test.go", + "SymlinkFile": "", + "Commit": "e4dfe5ccc7df4182255d44a0565ebcfe95aeb68a", + "Entropy": 4.060262, + "Date": "2026-06-11T07:48:36Z", + "Message": "slice 10D (agent): DR capstone \u2014 identity escrow + restore-mode consumption (v0.18.0)\n\nIdentity escrow wraps {tunnel_token,pbs_token} under the SAME R via age\n(scrypt+ChaCha20-Poly1305), reusing the K-escrow pty; wrong R fails closed.\nescrow.Create optionally emits the identity blob; escrow-create uploads it +\nthe non-secret directive; identity-consume recovers it (R by hand, never\nlogged). K-escrow + 10C Consume untouched. Closes slice 10 with hub v0.11.0;\noperator-side rotation model (hub holds no Cloudflare write-power).\n\nCo-Authored-By: Claude Opus 4.8 (1M context) ", + "Tags": [], + "Fingerprint": "e4dfe5ccc7df4182255d44a0565ebcfe95aeb68a:internal/escrow/identity_test.go:generic-api-key:49" + } + ] +} \ No newline at end of file diff --git a/documentation/audits/security-review-2026-10-12/scanners/gitleaks-felhom-controller.redacted.json b/documentation/audits/security-review-2026-10-12/scanners/gitleaks-felhom-controller.redacted.json new file mode 100644 index 00000000..3c503e0a --- /dev/null +++ b/documentation/audits/security-review-2026-10-12/scanners/gitleaks-felhom-controller.redacted.json @@ -0,0 +1,141 @@ +{ + "withheld_P1_entries": 4, + "findings": [ + { + "RuleID": "generic-api-key", + "Description": "Detected a Generic API Key, potentially exposing access to various services and sensitive operations.", + "StartLine": 272, + "EndLine": 272, + "StartColumn": 21, + "EndColumn": 52, + "Secret": "REDACTED", + "File": "controller/scripts/test_gate_decoys.py", + "SymlinkFile": "", + "Commit": "074ddda352e3e03388801c47f3848e5634379a1c", + "Entropy": 3.6168747, + "Date": "2026-10-05T19:54:41Z", + "Message": "R-576: go-parity gate also judges the CALL \u2014 arity vs printf verbs, and no key glued with +\n\nChecks 4 (ARITY) and 5 (NO-CONCAT) in i18n_go_parity.py: at every message-helper call\n(MsgError/MsgErrorf/Text/Msgf/msg/msgLang/msgHU/note) whose key is a literal hu.json knows,\nthe argument count must equal the Hungarian value's printf verbs; a known key literal may\nnever be an operand of +. 485 calls judged, 0 defects today. Decoys: a dropped argument and\na key+suffix concatenation on a real producer convict; a nested-paren argument is accepted.\n\nCo-Authored-By: Claude Opus 5.5 (1M context) \nClaude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS", + "Tags": [], + "Fingerprint": "074ddda352e3e03388801c47f3848e5634379a1c:controller/scripts/test_gate_decoys.py:generic-api-key:272" + }, + { + "RuleID": "generic-api-key", + "Description": "Detected a Generic API Key, potentially exposing access to various services and sensitive operations.", + "StartLine": 151, + "EndLine": 151, + "StartColumn": 16, + "EndColumn": 53, + "Secret": "REDACTED", + "File": "controller/scripts/test_gate_decoys.py", + "SymlinkFile": "", + "Commit": "612c4170242760ab56aea8f43398a7e772898051", + "Entropy": 3.6841838, + "Date": "2026-09-17T12:50:57Z", + "Message": "v0.247.0: i18n spike \u2014 the dashboard can speak English, Hungarian byte-identical\n\nMessage bundles (internal/i18n) expanded into templates before parsing, one\ntemplate set per language. Launcher, /backups, /apps/ and the layout\nconverted; household language setting, POST /settings/language, ?lang= override,\nreport field. Parity test against fixtures captured from unconverted templates;\ncopy gates read templates expanded; new i18n_missing_gate.\n\nCo-Authored-By: Claude Opus 5 \nClaude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS", + "Tags": [], + "Fingerprint": "612c4170242760ab56aea8f43398a7e772898051:controller/scripts/test_gate_decoys.py:generic-api-key:151" + }, + { + "RuleID": "generic-api-key", + "Description": "Detected a Generic API Key, potentially exposing access to various services and sensitive operations.", + "StartLine": 43, + "EndLine": 43, + "StartColumn": 8, + "EndColumn": 88, + "Secret": "REDACTED", + "File": "controller/internal/backup/offbox_offer_shapec_r241_test.go", + "SymlinkFile": "", + "Commit": "a491abef6c2043ff260fde5dd8a8c4be7d7456df", + "Entropy": 3.8961687, + "Date": "2026-08-07T09:33:42Z", + "Message": "R-241 part 2: the comparison the box already makes becomes the thing that offers recovery\n\nTHE FACT WAS COMPUTED EVERY CYCLE AND KEPT NOWHERE. EscrowAutoConfirmer.Reconcile\nhas compared the hub's restic_pw_sha256 against the local key on every ACK since\nSLICE 3. On the final-walk venue it logged, at 03:28:03Z and thirty-five minutes\nbefore the customer looked, \"the hub's escrow blob does not cover the CURRENT repo\npassword (hub hash 30ef574f != local 9b4a9a9d)\" - and dropped it. The recovery\nscreen, evaluating in the same process, went on asking a question that could not\nsee it.\n\nNow persisted: settings.HubEscrowKeySHA256 + HubEscrowKeyCheckedAt, recorded\nUNCONDITIONALLY in Reconcile beside RecordPresence and RecordSuperseded - same\nplace, same reason: the box that needs it most is the rebuilt one with no target,\non which every gate below returns early.\n\nOffsiteRecoveryOffer gains SHAPE (c): the hub holds a package for a key OTHER than\nthe one we are using. (a) and (b) are both proxies for that question and both have\nnow been wrong in opposite directions - (a) goes false the moment anything mints,\n(b) is unreachable while the escrow is pending.\n\nSEC 7.2, decided deliberately and stated in the code:\n - a KNOWN DIFFERENCE offers, however old the reading. Age is not gated on. Both\n sides are local; only the hub's half can be stale, and what the hub holds does\n not change without a ceremony THIS box runs, which refreshes the hash on the\n next ACK. Gating on age would make a box offline from the hub silently stop\n offering - the exact failure this session removes. CheckedAt is persisted for\n diagnosis, not as a gate.\n - an ABSENT hash falls back to (a)/(b) and does NOT offer. \"\" is the hub\n positively saying its package seals no repository password (legacy hash-less\n escrow). Nothing to compare, and offering would put a permanent screen in\n front of every legacy box.\n\nThe write damper: CheckedAt refreshes on every ack carrying a hash, but a save is\nskipped when both the hash and the UTC day are unchanged, so an idle box does not\nrewrite settings.json every fifteen minutes. It records WHEN WE LAST HEARD, not\nwhen it last changed - the R-100 distinction.\n\nTests: Scenario C (a differing key offers, with both proxies asserted false first),\nScenario D (a matching key offers nothing), fact 1 still required, shape (a) still\nworks, and both SEC 7.2 halves.\n\nRED-PROOFS, each with the mutation confirmed present in the file first:\n D) hubHash != localHash conjunct dropped -> Scenario D FAILS (a healthy box\n offered recovery forever); Scenario C still passes\n WIRING) RecordEscrowKeyHash removed from the EscrowAutoConfirmer literal in\n main.go -> TestMainWiresRecordEscrowKeyHash FAILS. This is the ships-inert\n shape: unwired, everything compiles, every test in the package passes, the\n auto-confirm still works, and shape (c) reads an empty hash forever.\n\nGreen: go build, go vet, go test ./... all pass.", + "Tags": [], + "Fingerprint": "a491abef6c2043ff260fde5dd8a8c4be7d7456df:controller/internal/backup/offbox_offer_shapec_r241_test.go:generic-api-key:43" + }, + { + "RuleID": "generic-api-key", + "Description": "Detected a Generic API Key, potentially exposing access to various services and sensitive operations.", + "StartLine": 85, + "EndLine": 85, + "StartColumn": 8, + "EndColumn": 89, + "Secret": "REDACTED", + "File": "REPORT.md", + "SymlinkFile": "", + "Commit": "3d3b4496f37708269b73f15772a66f6218f5f9ba", + "Entropy": 3.794148, + "Date": "2026-08-07T10:23:55Z", + "Message": "REPORT.md \u2014 R-241 fixed, deployed, live-validated on both demo boxes\n\nScenario A's live result first: on demo-hp in the rebuilt shape, no key was\nminted on the real start-up offsite-apply path, and the hub received the state\nit reports instead - offsite.state=awaiting_recovery_key with enabled:false.\nKey restored byte-identical afterwards.\n\nIncludes Q4's seven rows mapped to the three states, the SEC 7.2 choice and\nwhy, SEC 7.3's answer on the new-code button, every changed Hungarian string\nquoted, all nine red-proofs with what was mutated, the R-245 reasoning, and\nthree observations noticed but not acted on.", + "Tags": [], + "Fingerprint": "3d3b4496f37708269b73f15772a66f6218f5f9ba:REPORT.md:generic-api-key:85" + }, + { + "RuleID": "generic-api-key", + "Description": "Detected a Generic API Key, potentially exposing access to various services and sensitive operations.", + "StartLine": 86, + "EndLine": 86, + "StartColumn": 2, + "EndColumn": 89, + "Secret": "REDACTED", + "File": "REPORT.md", + "SymlinkFile": "", + "Commit": "3d3b4496f37708269b73f15772a66f6218f5f9ba", + "Entropy": 3.794148, + "Date": "2026-08-07T10:23:55Z", + "Message": "REPORT.md \u2014 R-241 fixed, deployed, live-validated on both demo boxes\n\nScenario A's live result first: on demo-hp in the rebuilt shape, no key was\nminted on the real start-up offsite-apply path, and the hub received the state\nit reports instead - offsite.state=awaiting_recovery_key with enabled:false.\nKey restored byte-identical afterwards.\n\nIncludes Q4's seven rows mapped to the three states, the SEC 7.2 choice and\nwhy, SEC 7.3's answer on the new-code button, every changed Hungarian string\nquoted, all nine red-proofs with what was mutated, the R-245 reasoning, and\nthree observations noticed but not acted on.", + "Tags": [], + "Fingerprint": "3d3b4496f37708269b73f15772a66f6218f5f9ba:REPORT.md:generic-api-key:86" + }, + { + "RuleID": "generic-api-key", + "Description": "Detected a Generic API Key, potentially exposing access to various services and sensitive operations.", + "StartLine": 258, + "EndLine": 258, + "StartColumn": 9, + "EndColumn": 34, + "Secret": "REDACTED", + "File": "controller/internal/stacks/samba_test.go", + "SymlinkFile": "", + "Commit": "0dcbea90b2b9fc2dc9194e6ae6b2db1796d77c1b", + "Entropy": 3.640224, + "Date": "2026-07-18T09:30:04Z", + "Message": "feat(samba): lifecycle \u2014 ensureSamba/ReconcileSamba/password/disable (R-7 slice 1, Part 2)\n\nensureSamba joins EnsureBaseStack after filebrowser, gated on SMB.Enabled\n(cloudflared conditional precedent); reconcile is idempotent (unchanged config +\nrunning container = ZERO compose calls, asserted via seam). Atomic tmp+fsync+\nrename config writes. Password applied via smbpasswd on STDIN (never argv/log/\nsettings). Disable = compose down, volumes + folders KEPT. samba added to\nIsProtectedStack in code (controller.yaml is golden-generated and predates it),\nwhich also makes the app-backup loops correctly skip it.", + "Tags": [], + "Fingerprint": "0dcbea90b2b9fc2dc9194e6ae6b2db1796d77c1b:controller/internal/stacks/samba_test.go:generic-api-key:258" + }, + { + "RuleID": "curl-auth-header", + "Description": "Discovered a potential authorization token provided in a curl command header, which could compromise the curl accessed resource.", + "StartLine": 1413, + "EndLine": 1416, + "StartColumn": 2, + "EndColumn": 97, + "Secret": "REDACTED", + "File": "TASK2.md", + "SymlinkFile": "", + "Commit": "6713df2186aa87b5ad0862d678b5f5ddb1cc349f", + "Entropy": 3.8710182, + "Date": "2026-02-19T12:16:46Z", + "Message": "v0.15.5: Disaster recovery \u2014 Hub-based infra backup, auto-mount, restore UI\n\nComplete DR implementation (TASK2.md Phases 1-4):\n- Hub infra-backup push/pull endpoints (controller.yaml, disk layout, stacks)\n- Fresh-deployment detection pulls config from Hub, auto-mounts drives by UUID\n- Full-page restore UI with drive status, app table, sequential restore\n- docker-setup.sh shows DR instructions when customer_id is configured\n\nNew files: disk_layout.go, restore_scan.go, restore_app_linux.go,\nrestore_drives_linux.go, infra_backup.go, infra_pull.go,\nhandler_restore.go, restore.html\n\nCo-Authored-By: Claude Opus 4.6 ", + "Tags": [], + "Fingerprint": "6713df2186aa87b5ad0862d678b5f5ddb1cc349f:TASK2.md:curl-auth-header:1413" + }, + { + "RuleID": "generic-api-key", + "Description": "Detected a Generic API Key, potentially exposing access to various services and sensitive operations.", + "StartLine": 1638, + "EndLine": 1638, + "StartColumn": 4, + "EndColumn": 78, + "Secret": "REDACTED", + "File": "scripts/docker-setup.sh", + "SymlinkFile": "", + "Commit": "cdaa13711843fc9bb9bccf31b784ee68a4108966", + "Entropy": 3.8710182, + "Date": "2026-02-19T12:33:39Z", + "Message": "docker-setup.sh v5.0: Config wizard, controller deployment, FileBrowser rewrite\n\nComplete TASK.md implementation:\n- \u00a71: Version bump to 5.0.0, updated banner and header comment\n- \u00a73+\u00a74: Remove --cf-tunnel-token and --hdd-path CLI options (deprecated)\n- \u00a75: Rewrite install_filebrowser() with auto drive discovery from /mnt/\n- \u00a76: New install_controller() deploys felhom-controller with compose\n- \u00a77: Interactive run_config_wizard() generates controller.yaml\n- \u00a79: install_cloudflare_tunnel() reads from wizard variable\n- \u00a710: New execution order: infra \u2192 wizard \u2192 tunnel \u2192 filebrowser \u2192 controller\n- \u00a711: Fix print_summary() \u2014 controller URL, hub status, fix CUSTOMER_ID bug\n- \u00a712: Update print_help() for new workflow\n\nCo-Authored-By: Claude Opus 4.6 ", + "Tags": [], + "Fingerprint": "cdaa13711843fc9bb9bccf31b784ee68a4108966:scripts/docker-setup.sh:generic-api-key:1638" + } + ] +} \ No newline at end of file diff --git a/documentation/audits/security-review-2026-10-12/scanners/gitleaks-felhom.eu.redacted.json b/documentation/audits/security-review-2026-10-12/scanners/gitleaks-felhom.eu.redacted.json new file mode 100644 index 00000000..2b2ae482 --- /dev/null +++ b/documentation/audits/security-review-2026-10-12/scanners/gitleaks-felhom.eu.redacted.json @@ -0,0 +1,719 @@ +{ + "withheld_P1_entries": 1, + "findings": [ + { + "RuleID": "generic-api-key", + "Description": "Detected a Generic API Key, potentially exposing access to various services and sensitive operations.", + "StartLine": 38, + "EndLine": 38, + "StartColumn": 287, + "EndColumn": 314, + "Secret": "REDACTED", + "File": "documentation/audits/r890-instructions-2026-10-06/tools/wgerwalk.py", + "SymlinkFile": "", + "Commit": "01d5dbd3e0325809147ccaf9fce4fa2efabf1c51", + "Entropy": 3.6168747, + "Date": "2026-10-06T12:03:28Z", + "Message": "Part C: R-644, R-763, R-764 closed (wger's fixes proven on 9202), R-762/R-717 stopped with reasons; STATUS, CONTEXT, REPORT (142 -> 137; 0 opened, 5 closed)\n\nCo-Authored-By: Claude Opus 5.5 (1M context) \nClaude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS", + "Tags": [], + "Fingerprint": "01d5dbd3e0325809147ccaf9fce4fa2efabf1c51:documentation/audits/r890-instructions-2026-10-06/tools/wgerwalk.py:generic-api-key:38" + }, + { + "RuleID": "generic-api-key", + "Description": "Detected a Generic API Key, potentially exposing access to various services and sensitive operations.", + "StartLine": 16, + "EndLine": 16, + "StartColumn": 3, + "EndColumn": 67, + "Secret": "REDACTED", + "File": "hub/internal/store/r879_box_seal_test.go", + "SymlinkFile": "", + "Commit": "5f060e3d1e669e8f0db89a88c14d18f7ac3a1141", + "Entropy": 4.4701757, + "Date": "2026-10-05T19:18:14Z", + "Message": "R-879: seal box API keys, owner passphrases, controller keys and PBS-DR tokens at rest\n\nhosts.api_key, customer_configs.api_key / retrieval_password and host_pbs_secrets.value now hold the\nR-821/R-133 seal (enc:v1:, OFFSITE_SECRET_KEY). The two API keys get an api_key_hash lookup twin\n(SHA-256, backfilled keyless in migrate()), so box authentication never needs the sealing key; a row\nwith no hash is matched on its plaintext only while it is plaintext. SealLegacyBoxSecrets seals legacy\nrows at start-up (idempotent, non-fatal). A sealed value that does not open sets SecretsUnreadable:\nserve/compare paths answer 500, saves refuse the record, the PBS token is not burned.\n\nCo-Authored-By: Claude Opus 5.5 (1M context) \nClaude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS", + "Tags": [], + "Fingerprint": "5f060e3d1e669e8f0db89a88c14d18f7ac3a1141:hub/internal/store/r879_box_seal_test.go:generic-api-key:16" + }, + { + "RuleID": "generic-api-key", + "Description": "Detected a Generic API Key, potentially exposing access to various services and sensitive operations.", + "StartLine": 5, + "EndLine": 5, + "StartColumn": 84, + "EndColumn": 138, + "Secret": "REDACTED", + "File": "documentation/audits/offsite-lock-build-2026-10-03/partD/demo-hp-migration.txt", + "SymlinkFile": "", + "Commit": "207ad197468a36783f5c93ae73a3e9aad6ffd0fa", + "Entropy": 4.8619704, + "Date": "2026-10-03T19:21:04Z", + "Message": "Off-site lock live: Parts D/E/F evidence, ep0 copy runbook, 06/07 facts, register (R-820/R-821/R-342 closed, R-825 opened+closed, R-95/R-822 narrowed, R-823/R-824/R-826/R-827/R-828/R-830 opened; 327 -> 330); hub window-sweep test (test-only)\n\nCo-Authored-By: Claude Opus 5.5 (1M context) \nClaude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS", + "Tags": [], + "Fingerprint": "207ad197468a36783f5c93ae73a3e9aad6ffd0fa:documentation/audits/offsite-lock-build-2026-10-03/partD/demo-hp-migration.txt:generic-api-key:5" + }, + { + "RuleID": "generic-api-key", + "Description": "Detected a Generic API Key, potentially exposing access to various services and sensitive operations.", + "StartLine": 7, + "EndLine": 7, + "StartColumn": 56, + "EndColumn": 110, + "Secret": "REDACTED", + "File": "documentation/audits/offsite-lock-build-2026-10-03/partD/demo-hp-migration.txt", + "SymlinkFile": "", + "Commit": "207ad197468a36783f5c93ae73a3e9aad6ffd0fa", + "Entropy": 4.8619704, + "Date": "2026-10-03T19:21:04Z", + "Message": "Off-site lock live: Parts D/E/F evidence, ep0 copy runbook, 06/07 facts, register (R-820/R-821/R-342 closed, R-825 opened+closed, R-95/R-822 narrowed, R-823/R-824/R-826/R-827/R-828/R-830 opened; 327 -> 330); hub window-sweep test (test-only)\n\nCo-Authored-By: Claude Opus 5.5 (1M context) \nClaude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS", + "Tags": [], + "Fingerprint": "207ad197468a36783f5c93ae73a3e9aad6ffd0fa:documentation/audits/offsite-lock-build-2026-10-03/partD/demo-hp-migration.txt:generic-api-key:7" + }, + { + "RuleID": "generic-api-key", + "Description": "Detected a Generic API Key, potentially exposing access to various services and sensitive operations.", + "StartLine": 8, + "EndLine": 8, + "StartColumn": 56, + "EndColumn": 110, + "Secret": "REDACTED", + "File": "documentation/audits/offsite-lock-build-2026-10-03/partD/demo-hp-migration.txt", + "SymlinkFile": "", + "Commit": "207ad197468a36783f5c93ae73a3e9aad6ffd0fa", + "Entropy": 4.8619704, + "Date": "2026-10-03T19:21:04Z", + "Message": "Off-site lock live: Parts D/E/F evidence, ep0 copy runbook, 06/07 facts, register (R-820/R-821/R-342 closed, R-825 opened+closed, R-95/R-822 narrowed, R-823/R-824/R-826/R-827/R-828/R-830 opened; 327 -> 330); hub window-sweep test (test-only)\n\nCo-Authored-By: Claude Opus 5.5 (1M context) \nClaude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS", + "Tags": [], + "Fingerprint": "207ad197468a36783f5c93ae73a3e9aad6ffd0fa:documentation/audits/offsite-lock-build-2026-10-03/partD/demo-hp-migration.txt:generic-api-key:8" + }, + { + "RuleID": "generic-api-key", + "Description": "Detected a Generic API Key, potentially exposing access to various services and sensitive operations.", + "StartLine": 14, + "EndLine": 14, + "StartColumn": 83, + "EndColumn": 126, + "Secret": "REDACTED", + "File": "documentation/audits/family-gate-2026-10-02/tools/fg_items.py", + "SymlinkFile": "", + "Commit": "e6d1ebd1525171a4e35c51d5d791af3a65e0707c", + "Entropy": 4.168296, + "Date": "2026-10-02T07:35:42Z", + "Message": "Family gate built + licence read: evidence (9202, bench, floor), licence table + SparkyFitness request draft (not sent), 01 \u00a75 family gate, 09 decision 64 built, capability map, register 422 -> 436 (R-767/R-780/R-787 closed; R-775/R-784 updated; R-788..R-801 opened), CONTEXT\n\nCo-Authored-By: Claude Opus 5.5 (1M context) \nClaude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS", + "Tags": [], + "Fingerprint": "e6d1ebd1525171a4e35c51d5d791af3a65e0707c:documentation/audits/family-gate-2026-10-02/tools/fg_items.py:generic-api-key:14" + }, + { + "RuleID": "generic-api-key", + "Description": "Detected a Generic API Key, potentially exposing access to various services and sensitive operations.", + "StartLine": 9, + "EndLine": 9, + "StartColumn": 83, + "EndColumn": 126, + "Secret": "REDACTED", + "File": "documentation/audits/permanent-gate-2026-10-01/tools/items12.py", + "SymlinkFile": "", + "Commit": "b50289074d92d6a23975fda65475adf8ba09bb73", + "Entropy": 4.168296, + "Date": "2026-10-01T19:26:23Z", + "Message": "Evidence: Part A (visitors apart \u2014 measurements, design, sweep, 9202 live) and the permanent-gate spike (items 1\u20136, VERDICT: PASS, build plan)\n\nCo-Authored-By: Claude Opus 5.5 (1M context) \nClaude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS", + "Tags": [], + "Fingerprint": "b50289074d92d6a23975fda65475adf8ba09bb73:documentation/audits/permanent-gate-2026-10-01/tools/items12.py:generic-api-key:9" + }, + { + "RuleID": "generic-api-key", + "Description": "Detected a Generic API Key, potentially exposing access to various services and sensitive operations.", + "StartLine": 184, + "EndLine": 184, + "StartColumn": 40, + "EndColumn": 67, + "Secret": "REDACTED", + "File": "documentation/audits/new-apps-2026-10-01/tools/newapp_box.py", + "SymlinkFile": "", + "Commit": "bc9c7b49346b664ed37aa60d52c1f9ee4c6acd1d", + "Entropy": 3.9068906, + "Date": "2026-10-01T17:52:32Z", + "Message": "New apps night: Radicale, Karakeep, Dawarich published; Grimmory held (R-775); fit table; R-765..R-775; STATUS, CONTEXT, report, evidence\n\nCo-Authored-By: Claude Opus 5.5 (1M context) \nClaude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS", + "Tags": [], + "Fingerprint": "bc9c7b49346b664ed37aa60d52c1f9ee4c6acd1d:documentation/audits/new-apps-2026-10-01/tools/newapp_box.py:generic-api-key:184" + }, + { + "RuleID": "generic-api-key", + "Description": "Detected a Generic API Key, potentially exposing access to various services and sensitive operations.", + "StartLine": 4, + "EndLine": 4, + "StartColumn": 14, + "EndColumn": 61, + "Secret": "REDACTED", + "File": "documentation/audits/night-rulings-2026-09-30/D/D3-wanderer-routes-probe.txt", + "SymlinkFile": "", + "Commit": "3159892fabbf5827c071c67cb5018e35223f55e0", + "Entropy": 4.0980687, + "Date": "2026-09-30T21:26:21Z", + "Message": "Both rulings built: same-tag re-tests (decision 52), image retention + the install hold (controller 0.284.2); golden 0.284.2\n\n- Decision 52: catalog 6a3ead9 (re-test entries, gates, decoys, the monthly command); proven end to end on 9202\n through the leg; runbook monthly-floating-retest.md; nothing to re-test on the engine lines today.\n- Decision 53 + R-741: controller v0.284.2 (0.284.0/0.284.1 never floored \u2014 two wiring faults found live on 9202);\n floor 0.284.2; one-time sweep 9202 26.6 -> 5.7 GB, demo-hp 24.3 -> 13.5 GB; the install hold proven as a stranger.\n- Golden 0.284.2 baked, round-trip identical, vouched (agent 0.138.0, min_agent 0.131.0); the gate prints OK.\n- Rows 377 -> 383: opened R-743..R-748, closed R-736, R-737, R-740, R-741, R-748; narrowed R-739, R-698, R-446.\n- register_shape_gate: a lettered id (R-88a) is a row too (R-748), with a decoy seen red.\n\nEvidence: documentation/audits/night-rulings-2026-09-30/, documentation/tests/golden-0.284.2-2026-09-30/.\nReport: REPORT-night-rulings-2026-09-30.md.\n\nCo-Authored-By: Claude Opus 5.5 (1M context) \nClaude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS", + "Tags": [], + "Fingerprint": "3159892fabbf5827c071c67cb5018e35223f55e0:documentation/audits/night-rulings-2026-09-30/D/D3-wanderer-routes-probe.txt:generic-api-key:4" + }, + { + "RuleID": "generic-api-key", + "Description": "Detected a Generic API Key, potentially exposing access to various services and sensitive operations.", + "StartLine": 2, + "EndLine": 2, + "StartColumn": 20, + "EndColumn": 78, + "Secret": "REDACTED", + "File": "documentation/audits/evidence-fixes-first-tester-2026-09-30/part0/cloudflare-dns.txt", + "SymlinkFile": "", + "Commit": "4951fc22836835b90b951cd1cbe21c797fc85ead", + "Entropy": 3.5413363, + "Date": "2026-09-30T07:49:41Z", + "Message": "Decisions 50 (apps off-site by default, R-720) and 51 (ep0 drill archives; restore test on own archives, R-727) recorded; Tester-2 read-only checklist\n\nCo-Authored-By: Claude Opus 5.5 (1M context) \nClaude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS", + "Tags": [], + "Fingerprint": "4951fc22836835b90b951cd1cbe21c797fc85ead:documentation/audits/evidence-fixes-first-tester-2026-09-30/part0/cloudflare-dns.txt:generic-api-key:2" + }, + { + "RuleID": "generic-api-key", + "Description": "Detected a Generic API Key, potentially exposing access to various services and sensitive operations.", + "StartLine": 5, + "EndLine": 5, + "StartColumn": 236, + "EndColumn": 259, + "Secret": "REDACTED", + "File": "documentation/audits/signup-lock-2026-09-29/B/wd.sh", + "SymlinkFile": "", + "Commit": "8cadacb553ba5003800eb6c861f766054b36c8c1", + "Entropy": 3.5849626, + "Date": "2026-09-29T15:19:43Z", + "Message": "Sign-up lock 2026-09-29 evening: decisions 48/49 outcomes, two locks, wanderer closable, R-714/715/716 closed, R-717/718 opened; STATUS, CONTEXT, report\n\nCo-Authored-By: Claude Opus 5.5 (1M context) \nClaude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS", + "Tags": [], + "Fingerprint": "8cadacb553ba5003800eb6c861f766054b36c8c1:documentation/audits/signup-lock-2026-09-29/B/wd.sh:generic-api-key:5" + }, + { + "RuleID": "generic-api-key", + "Description": "Detected a Generic API Key, potentially exposing access to various services and sensitive operations.", + "StartLine": 5, + "EndLine": 5, + "StartColumn": 262, + "EndColumn": 292, + "Secret": "REDACTED", + "File": "documentation/audits/signup-lock-2026-09-29/B/wd.sh", + "SymlinkFile": "", + "Commit": "8cadacb553ba5003800eb6c861f766054b36c8c1", + "Entropy": 3.5849626, + "Date": "2026-09-29T15:19:43Z", + "Message": "Sign-up lock 2026-09-29 evening: decisions 48/49 outcomes, two locks, wanderer closable, R-714/715/716 closed, R-717/718 opened; STATUS, CONTEXT, report\n\nCo-Authored-By: Claude Opus 5.5 (1M context) \nClaude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS", + "Tags": [], + "Fingerprint": "8cadacb553ba5003800eb6c861f766054b36c8c1:documentation/audits/signup-lock-2026-09-29/B/wd.sh:generic-api-key:5" + }, + { + "RuleID": "generic-api-key", + "Description": "Detected a Generic API Key, potentially exposing access to various services and sensitive operations.", + "StartLine": 6, + "EndLine": 6, + "StartColumn": 84, + "EndColumn": 128, + "Secret": "REDACTED", + "File": "documentation/audits/night-2026-09-23/chaos/round-01-run.txt", + "SymlinkFile": "", + "Commit": "3e58c184f62e3dc5048bbe935543c7fee0a55f0b", + "Entropy": 3.7709103, + "Date": "2026-09-23T22:24:04Z", + "Message": "night shift 2026-09-23: the record, the register, the morning note\n\nDRILL-night-2026-09-23.md: Parts A-E. 09 \u00a73 decisions 21 (operator word),\n22 and 23 (CC unattended, operator may reverse); \u00a76.4 parts 4 and 6\n(catalog half) shipped; \u00a76.1a residuals R-658/R-659. Register 330 -> 336:\nR-651..R-660 opened (R-658 and R-659 P1), R-650/R-640/R-499/R-626 closed.\nCapability map, nightly rotation (opengist), STATUS (one question: the\nfloor), CONTEXT, REPORT. The floor stays 0.266.0.\n\nCo-Authored-By: Claude Opus 5.5 (1M context) \nClaude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS", + "Tags": [], + "Fingerprint": "3e58c184f62e3dc5048bbe935543c7fee0a55f0b:documentation/audits/night-2026-09-23/chaos/round-01-run.txt:generic-api-key:6" + }, + { + "RuleID": "generic-api-key", + "Description": "Detected a Generic API Key, potentially exposing access to various services and sensitive operations.", + "StartLine": 6, + "EndLine": 6, + "StartColumn": 84, + "EndColumn": 128, + "Secret": "REDACTED", + "File": "documentation/audits/night-2026-09-23/chaos/round-01.log", + "SymlinkFile": "", + "Commit": "3e58c184f62e3dc5048bbe935543c7fee0a55f0b", + "Entropy": 3.7709103, + "Date": "2026-09-23T22:24:04Z", + "Message": "night shift 2026-09-23: the record, the register, the morning note\n\nDRILL-night-2026-09-23.md: Parts A-E. 09 \u00a73 decisions 21 (operator word),\n22 and 23 (CC unattended, operator may reverse); \u00a76.4 parts 4 and 6\n(catalog half) shipped; \u00a76.1a residuals R-658/R-659. Register 330 -> 336:\nR-651..R-660 opened (R-658 and R-659 P1), R-650/R-640/R-499/R-626 closed.\nCapability map, nightly rotation (opengist), STATUS (one question: the\nfloor), CONTEXT, REPORT. The floor stays 0.266.0.\n\nCo-Authored-By: Claude Opus 5.5 (1M context) \nClaude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS", + "Tags": [], + "Fingerprint": "3e58c184f62e3dc5048bbe935543c7fee0a55f0b:documentation/audits/night-2026-09-23/chaos/round-01.log:generic-api-key:6" + }, + { + "RuleID": "generic-api-key", + "Description": "Detected a Generic API Key, potentially exposing access to various services and sensitive operations.", + "StartLine": 5, + "EndLine": 5, + "StartColumn": 84, + "EndColumn": 128, + "Secret": "REDACTED", + "File": "documentation/audits/update-night-2026-09-21/apps/actualbudget/log.txt", + "SymlinkFile": "", + "Commit": "da20722e76a7367e311c7b5055038e5470f1586e", + "Entropy": 3.718129, + "Date": "2026-09-21T19:17:46Z", + "Message": "Update night 2026-09-21: Phase 0 and Phase 1 evidence, the drill method, and two instrument fixes\n\nINTERIM CHECKPOINT \u2014 evidence off the machine at the end of the phase that produced it (R-320),\nnot at the end of the session. Phases 2-5 follow in a later commit.\n\nPhase 0, all three mechanisms proven with their controls:\n- the fleet floor to 0.261.0 with its declared MinAgent \u2014 both demo boxes in 13 s, the hub\n logging `managed floor SERVED ... from declared (golden 0.258.0)`.\n- a PRIVATE DRILL CATALOG (admin/app-catalog-drill), so that broken, dummy, cross-repo and\n engine-major edges can be measured without the live catalog ever carrying one. Positive\n control quoted, and two negative controls: the live catalog's main and both real boxes'\n caches unchanged.\n- a throwaway image store on the scratch guest, which is what makes an UNATTENDED HOLD\n measurable at all: an edge that PASSES the within-a-major test and still fails.\n CompareImageRefs was proven to order host:port/ references by RUNNING it (4 positive cases\n + 1 negative control), not by reading it.\n\nPhase 1: real within-a-major upstream edges walked on guest 9202 through the product's own\nguarded Update, each app seeded and read back through its OWN front door (R-156), with a\nper-edge verdict record in 09's shape. `inconclusive` is never collapsed into `failed`.\n\nTWO INSTRUMENT FIXES, both in this repo's own evidence code:\n- 00-api-recipe.md said the app page is /app/; it is /apps/, and every call it described\n 404s. Corrected, with the session-expiry note that cost the same time.\n- unattended-caller.py's follow() read update_phase/updating off the API ENVELOPE, so both were\n always None and EVERY followed update ran to its 900 s timeout and was then recorded\n `timeout` and never-press-again. Fixed before B1 relied on it. R-623.\n\nNo controller, agent or hub code was written. The live catalog carries no broken reference.\n\nGates: repo_gates.py --fast \u2014 all 15 OK, exit 0.\n\nCo-Authored-By: Claude Opus 5 \nClaude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS", + "Tags": [], + "Fingerprint": "da20722e76a7367e311c7b5055038e5470f1586e:documentation/audits/update-night-2026-09-21/apps/actualbudget/log.txt:generic-api-key:5" + }, + { + "RuleID": "generic-api-key", + "Description": "Detected a Generic API Key, potentially exposing access to various services and sensitive operations.", + "StartLine": 52, + "EndLine": 52, + "StartColumn": 84, + "EndColumn": 128, + "Secret": "REDACTED", + "File": "documentation/audits/update-night-2026-09-21/batchA.log", + "SymlinkFile": "", + "Commit": "da20722e76a7367e311c7b5055038e5470f1586e", + "Entropy": 3.718129, + "Date": "2026-09-21T19:17:46Z", + "Message": "Update night 2026-09-21: Phase 0 and Phase 1 evidence, the drill method, and two instrument fixes\n\nINTERIM CHECKPOINT \u2014 evidence off the machine at the end of the phase that produced it (R-320),\nnot at the end of the session. Phases 2-5 follow in a later commit.\n\nPhase 0, all three mechanisms proven with their controls:\n- the fleet floor to 0.261.0 with its declared MinAgent \u2014 both demo boxes in 13 s, the hub\n logging `managed floor SERVED ... from declared (golden 0.258.0)`.\n- a PRIVATE DRILL CATALOG (admin/app-catalog-drill), so that broken, dummy, cross-repo and\n engine-major edges can be measured without the live catalog ever carrying one. Positive\n control quoted, and two negative controls: the live catalog's main and both real boxes'\n caches unchanged.\n- a throwaway image store on the scratch guest, which is what makes an UNATTENDED HOLD\n measurable at all: an edge that PASSES the within-a-major test and still fails.\n CompareImageRefs was proven to order host:port/ references by RUNNING it (4 positive cases\n + 1 negative control), not by reading it.\n\nPhase 1: real within-a-major upstream edges walked on guest 9202 through the product's own\nguarded Update, each app seeded and read back through its OWN front door (R-156), with a\nper-edge verdict record in 09's shape. `inconclusive` is never collapsed into `failed`.\n\nTWO INSTRUMENT FIXES, both in this repo's own evidence code:\n- 00-api-recipe.md said the app page is /app/; it is /apps/, and every call it described\n 404s. Corrected, with the session-expiry note that cost the same time.\n- unattended-caller.py's follow() read update_phase/updating off the API ENVELOPE, so both were\n always None and EVERY followed update ran to its 900 s timeout and was then recorded\n `timeout` and never-press-again. Fixed before B1 relied on it. R-623.\n\nNo controller, agent or hub code was written. The live catalog carries no broken reference.\n\nGates: repo_gates.py --fast \u2014 all 15 OK, exit 0.\n\nCo-Authored-By: Claude Opus 5 \nClaude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS", + "Tags": [], + "Fingerprint": "da20722e76a7367e311c7b5055038e5470f1586e:documentation/audits/update-night-2026-09-21/batchA.log:generic-api-key:52" + }, + { + "RuleID": "generic-api-key", + "Description": "Detected a Generic API Key, potentially exposing access to various services and sensitive operations.", + "StartLine": 25, + "EndLine": 25, + "StartColumn": 3, + "EndColumn": 45, + "Secret": "REDACTED", + "File": "hub/internal/web/bind_language_test.go", + "SymlinkFile": "", + "Commit": "9167cf53afbc9cf62fdc92ca248d37a493e915e7", + "Entropy": 4, + "Date": "2026-09-18T14:20:11Z", + "Message": "hub v0.118.0: the household's e-mails follow the household's language (R-558 Part A)\n\nThe hub has written every customer e-mail in Hungarian whatever the box was set\nto. The box has published its language since controller v0.247.0; nothing read\nit. Now it does.\n\nNothing an operator reads changes. The Hungarian mails are byte-identical, and\nthat is a diff rather than a reading: 56 goldens per language captured from\nv0.117.0 BEFORE any string moved, and all 56 Hungarian ones pass unchanged after\nevery sentence was routed through the new bundle.\n\n- internal/i18n: flat bundle, 79 keys, hu authoritative + hu fallback, ceiling 0.\n- customerMessages/severityLabels are DERIVED from the bundle, so a sentence is\n written in one place and all 40+ tests that read those maps still work.\n- Language order: last reported -> created-with -> hu. reports.language defaults\n to EMPTY, never hu: \"never told us\" is not \"chose Hungarian\".\n- message_customer on POST /api/v1/event, additive and optional forever, for the\n sentences the box composes and the hub cannot translate.\n- The bind page is per-language, and its `expired` state stays Hungarian: it is\n the state an unknown token lands in, so rendering a real English customer's\n token in English would make the LANGUAGE answer what the TEXT refuses to.\n\nTwo defects found inside the release:\n- R-581: the newest report was picked by received_at, which has SECOND\n granularity, so same-second reports tied and the winner was arbitrary. Ordered\n by the autoincrement id now. GetCustomers() still has the shape - row open.\n- R-582: the English copy-guard stems, ported word for word from Hungarian,\n convicted 141 honest sentences. The English claim is a phrase with a modal.\n\nR-555 closed: the language allowlist entry is out of wire_contract_gate.py.\nhub_copy_gate.py follows the sentences into the bundle - without that it would\nhave scanned four files that no longer hold any customer text and reported\nsuccess. Three new decoys incl. an innocent control.\n\nCo-Authored-By: Claude Opus 5 \nClaude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS", + "Tags": [], + "Fingerprint": "9167cf53afbc9cf62fdc92ca248d37a493e915e7:hub/internal/web/bind_language_test.go:generic-api-key:25" + }, + { + "RuleID": "generic-api-key", + "Description": "Detected a Generic API Key, potentially exposing access to various services and sensitive operations.", + "StartLine": 121, + "EndLine": 121, + "StartColumn": 11, + "EndColumn": 59, + "Secret": "REDACTED", + "File": "documentation/audits/evidence-rehearsal-2026-08-09/P1-demo-hp-after.txt", + "SymlinkFile": "", + "Commit": "b1afbb8a4d6c06e782da726785502323e4c163bb", + "Entropy": 4.851366, + "Date": "2026-08-09T08:59:44Z", + "Message": "Rehearsal 2026-08-09: the walk stops at P3 \u2014 R-273 blocks every install fleet-wide\n\nP1 uninstall, P2 preflight, P3 install. The install FAILED at step 5/8 in 44s,\nand the two rank-1 findings are both on the setting-up path a tester's visit is\nmade of. Eleven register rows minted (R-269..R-279); ceiling moves 268 -> 279.\n\nR-273 (RANK 1) \u2014 the hub vouches agent 0.128.0; that version was published as a\nGitea PACKAGE but never git-tagged. Since R-183 the installer correctly pins its\nconfig fetches to raw/tag/v, so every fresh install and every reinstall\nnow 404s as root, mid-install. Measured: main 200, v0.127.0 200, v0.128.0 404.\nThis is R-184 arriving; release-agent.sh:23 already documents the exact hazard.\nExisting boxes are fine (self-update takes the binary from the registry).\nNOT fixed here \u2014 publishing a release tag is outward-facing and the runbook says\nstop and report. One command unblocks it; it is in STATUS.md.\n\nR-272 (RANK 1) \u2014 Felhom's own uninstall leaves the condition that makes Felhom's\nown reinstall refuse. It installs dnsmasq at day-0, then on teardown removes the\nsnippet and RESTARTS the daemon unconstrained (process start time lands inside\nthe uninstall window), which grabs 0.0.0.0:53; the next preflight then refuses,\nand the message reads as though the owner's LAN DNS is at fault.\n\nR-274 \u2014 a local golden is adopted with no version and no sha check; the manifest\nvouch is consulted only on the fetch path. demo-hp's local copy is controller\n0.192.0 against a vouched 0.210.0, and below the 0.200.0 where the recovery\nscreen shipped. Not yet observed end-to-end (R-273 killed step 5 first).\n\nAlso: R-275 orphaned credential backups + uid reuse, R-276 the wg tunnel outlives\nthe uninstall, R-269/270/271 from the token rotation, R-277 three hub surfaces\nmisreport a healthy off-site tier, R-278 demo-felhom six days unprotected,\nR-279 no operator-triggerable off-site run.\n\nTwo hypotheses of mine were tested and REFUTED rather than shipped as findings:\nthe leftover sudoers file is inert (sudo skips dotted filenames), and demo-hp's\noff-site tier was healthy all along - I had misread the hub and said so.\n\nSTATUS.md records the three rulings \u00a78.3 asked for, with the floor CORRECTED to\nits live value 0.200.0 and the count corrected to twenty.", + "Tags": [], + "Fingerprint": "b1afbb8a4d6c06e782da726785502323e4c163bb:documentation/audits/evidence-rehearsal-2026-08-09/P1-demo-hp-after.txt:generic-api-key:121" + }, + { + "RuleID": "generic-api-key", + "Description": "Detected a Generic API Key, potentially exposing access to various services and sensitive operations.", + "StartLine": 194, + "EndLine": 194, + "StartColumn": 11, + "EndColumn": 59, + "Secret": "REDACTED", + "File": "documentation/audits/evidence-rehearsal-2026-08-09/GATE0-demo-hp-before.txt", + "SymlinkFile": "", + "Commit": "34646295dc27cf1b720ffea2bada87332aa8778b", + "Entropy": 4.851366, + "Date": "2026-08-09T08:34:57Z", + "Message": "Rehearsal 2026-08-09: pre-phase + Gate 0 recorded before the destructive walk\n\nVenue demo-hp, operator-approved at STOP 1. Records the state that P1 destroys,\nplus seven pre-walk findings, while they can still be checked against a live box.\n\nR-268 CLOSED \u2014 the leaked per-guest local-API token is rotated and the rotation\nis PROVEN in both directions (old refused, new accepted, channel up with a\npositive observable). Rotating it surfaced three defects:\n\n- an out-of-process rotation does NOT revoke the old token. The daemon serves\n Lookup from a stale index and re-reads only on a MISS, so a superseded token\n is a direct hit. Red-proved in a unit probe AND live on hardware; the shipped\n RemintCoherence test passes only because it looks up the NEW token first.\n- R-268's own recipe is incomplete: ensureLocalAPI returns early on a present\n local_api block, so writing bootstrap.json is not enough \u2014 the controller\n serves the old token from controller.yaml across restarts.\n- the agent-channel alarm never closes: the UP branch does not notify from an\n unseeded state, and the alarm's own remedy (\"re-bootstrap\") resets it.\n\nGate 0 complete: dataset planted in the Calibre library (coverage verified, not\nassumed) with two Hungarian accented filenames; the comparator watched FAILING\nthree ways including an NFC->NFD rename that renders identically; off-site run\ndriven through the product's own button; restore point recorded by identity as\nsnapshot 41c830db, confirmed to carry all four files.\n\nAlso corrects the record: demo-hp's off-site tier is HEALTHY. Three hub surfaces\nagreed it was absent and all three mislead \u2014 the panel showing 0 snapshots renders\nthe LOCAL tier, 162 KB rounds to 0.0 GB, and a two-day-old stuck event reads as\ncurrent. And the managed-update floor is live at 0.200.0, not 0.156.0.", + "Tags": [], + "Fingerprint": "34646295dc27cf1b720ffea2bada87332aa8778b:documentation/audits/evidence-rehearsal-2026-08-09/GATE0-demo-hp-before.txt:generic-api-key:194" + }, + { + "RuleID": "generic-api-key", + "Description": "Detected a Generic API Key, potentially exposing access to various services and sensitive operations.", + "StartLine": 366, + "EndLine": 366, + "StartColumn": 21, + "EndColumn": 108, + "Secret": "REDACTED", + "File": "documentation/tests/walk5-r201-2026-08-07/journal.md", + "SymlinkFile": "", + "Commit": "879007aaecea5b8123a3c6d0344063de16788535", + "Entropy": 3.8865879, + "Date": "2026-08-07T13:05:35Z", + "Message": "walk5 (R-201, fifth walk): Phase A journal \u2014 fixture built, sentinels proved by name\n\nWritten before the destruction, per \u00a79.9. A fresh install landed on the VOUCHED\nset with no hand upgrade (controller 0.206.0, agent 0.127.0) \u2014 R-239's delivery\ngap is closed for this run, which is the first of the five walks where the box\nunder test is the box a customer receives.\n\nBoth \u00a74.6 pre-destruction checks pass, neither previously exercised on a clean\nbox: the recovery offer is correctly SILENT (shape (c) compares equal \u2014 the two\nkey hashes are byte-identical on box and hub), and the restore page lists the app\nwith the future-backup toggle OFF (R-237's fix, which the last walk measured\nfailing).\n\nAlso recorded: the \u00a74.5 gate caught a harness fault (a toggle sent as enabled=1\nrather than enabled=on) that had produced a green 'ok' over a zero-snapshot\nrepository \u2014 the exact shape the gate exists for.", + "Tags": [], + "Fingerprint": "879007aaecea5b8123a3c6d0344063de16788535:documentation/tests/walk5-r201-2026-08-07/journal.md:generic-api-key:366" + }, + { + "RuleID": "generic-api-key", + "Description": "Detected a Generic API Key, potentially exposing access to various services and sensitive operations.", + "StartLine": 367, + "EndLine": 367, + "StartColumn": 8, + "EndColumn": 107, + "Secret": "REDACTED", + "File": "documentation/tests/walk5-r201-2026-08-07/journal.md", + "SymlinkFile": "", + "Commit": "879007aaecea5b8123a3c6d0344063de16788535", + "Entropy": 3.8865879, + "Date": "2026-08-07T13:05:35Z", + "Message": "walk5 (R-201, fifth walk): Phase A journal \u2014 fixture built, sentinels proved by name\n\nWritten before the destruction, per \u00a79.9. A fresh install landed on the VOUCHED\nset with no hand upgrade (controller 0.206.0, agent 0.127.0) \u2014 R-239's delivery\ngap is closed for this run, which is the first of the five walks where the box\nunder test is the box a customer receives.\n\nBoth \u00a74.6 pre-destruction checks pass, neither previously exercised on a clean\nbox: the recovery offer is correctly SILENT (shape (c) compares equal \u2014 the two\nkey hashes are byte-identical on box and hub), and the restore page lists the app\nwith the future-backup toggle OFF (R-237's fix, which the last walk measured\nfailing).\n\nAlso recorded: the \u00a74.5 gate caught a harness fault (a toggle sent as enabled=1\nrather than enabled=on) that had produced a green 'ok' over a zero-snapshot\nrepository \u2014 the exact shape the gate exists for.", + "Tags": [], + "Fingerprint": "879007aaecea5b8123a3c6d0344063de16788535:documentation/tests/walk5-r201-2026-08-07/journal.md:generic-api-key:367" + }, + { + "RuleID": "generic-api-key", + "Description": "Detected a Generic API Key, potentially exposing access to various services and sensitive operations.", + "StartLine": 129, + "EndLine": 129, + "StartColumn": 9, + "EndColumn": 52, + "Secret": "REDACTED", + "File": "hub/internal/web/render_test.go", + "SymlinkFile": "", + "Commit": "b93dd03f0a613e48422bc0745e4c2731ddbf9412", + "Entropy": 3.7487915, + "Date": "2026-07-09T06:23:41Z", + "Message": "GL-7 Part 1: passphrase hardening on the customer page (security)\n\nThe Setup Command panel rendered the per-customer retrieval passphrase (the\nsecret that fetches the WHOLE config) in cleartext twice \u2014 as #retrieval-pw\ntext and baked into the Option-3 curl's X-Retrieval-Password header \u2014 which\ncontradicts the panel's own \"never on the command line\" guidance. Now:\nthe retrieval password is MASKED by default (bullet run) with Reveal/Hide +\ncopy-secret controls (value lives in data-secret \u2014 the existing reveal\nmodel); the Option-3 debug command carries a \nplaceholder, never the secret. Render test asserts the secret is not baked\ninto any command + is masked by default; red-proof (bake it back) FAILS.\n(A zero-secret-in-DOM reveal-on-demand fetch is a noted follow-up, not this task.)\n\nCo-Authored-By: Claude Opus 4.8 \nClaude-Session: https://claude.ai/code/session_01PSK5g6qYLknKj8u3QAFEr6", + "Tags": [], + "Fingerprint": "b93dd03f0a613e48422bc0745e4c2731ddbf9412:hub/internal/web/render_test.go:generic-api-key:129" + }, + { + "RuleID": "generic-api-key", + "Description": "Detected a Generic API Key, potentially exposing access to various services and sensitive operations.", + "StartLine": 1, + "EndLine": 1, + "StartColumn": 36, + "EndColumn": 79, + "Secret": "REDACTED", + "File": "documentation/tests/campaign2-evidence-2026-07-07/evidence/T-DEPLOY-SET/values_vaultwarden.json", + "SymlinkFile": "", + "Commit": "7714f1f6e4f76c65c9d82c15a6e890b0c007ac49", + "Entropy": 4.164498, + "Date": "2026-07-07T12:26:52Z", + "Message": "docs(tests): Campaign 2 report + evidence \u2014 DR primitives, self-update, storage, faults, endurance\n\nFull-system validation on demo 9201 (controller v0.102.0 / agent v0.73.0). Headline:\nONE genuine pilot-critical finding \u2014 the non-root agent cannot pct-restore the\nstandard Felhom guest because it has bind-mount mountpoints (mp8 /mnt/felhom-drives,\nmp9 bootstrap) and pct restore refuses bind mounts unless root. This breaks BOTH\n--selftest=restore-test AND the offsite DR bring-up (R1), linked to a missing\nVM.Audit/VM.Allocate on the agent token (R2). The large raw FAIL count is dominated\nby one harness bug (auth-session expiry mis-scoring P3-P9) plus D1-injection/soak-probe/\ndryrun-journal/escrow-blob calibration issues; the product where actually exercised was\nhealthy with ZERO resource leaks over ~7h. Demo node healed to pre-campaign state\n(auth off, notifications restored, no scratch leaks). No production code changed.\n\nEvidence snapshot + README under campaign2-evidence-2026-07-07/ (cookie jars scrubbed).\n\n\ud83e\udd16 Generated with [Claude Code](https://claude.com/claude-code)\n\nCo-Authored-By: Claude Opus 4.8 \nClaude-Session: https://claude.ai/code/session_01PSK5g6qYLknKj8u3QAFEr6", + "Tags": [], + "Fingerprint": "7714f1f6e4f76c65c9d82c15a6e890b0c007ac49:documentation/tests/campaign2-evidence-2026-07-07/evidence/T-DEPLOY-SET/values_vaultwarden.json:generic-api-key:1" + }, + { + "RuleID": "generic-api-key", + "Description": "Detected a Generic API Key, potentially exposing access to various services and sensitive operations.", + "StartLine": 1, + "EndLine": 1, + "StartColumn": 36, + "EndColumn": 75, + "Secret": "REDACTED", + "File": "documentation/tests/campaign2-evidence-2026-07-07/evidence/T-DEPLOY-SET/values_bookstack.json", + "SymlinkFile": "", + "Commit": "7714f1f6e4f76c65c9d82c15a6e890b0c007ac49", + "Entropy": 4.324863, + "Date": "2026-07-07T12:26:52Z", + "Message": "docs(tests): Campaign 2 report + evidence \u2014 DR primitives, self-update, storage, faults, endurance\n\nFull-system validation on demo 9201 (controller v0.102.0 / agent v0.73.0). Headline:\nONE genuine pilot-critical finding \u2014 the non-root agent cannot pct-restore the\nstandard Felhom guest because it has bind-mount mountpoints (mp8 /mnt/felhom-drives,\nmp9 bootstrap) and pct restore refuses bind mounts unless root. This breaks BOTH\n--selftest=restore-test AND the offsite DR bring-up (R1), linked to a missing\nVM.Audit/VM.Allocate on the agent token (R2). The large raw FAIL count is dominated\nby one harness bug (auth-session expiry mis-scoring P3-P9) plus D1-injection/soak-probe/\ndryrun-journal/escrow-blob calibration issues; the product where actually exercised was\nhealthy with ZERO resource leaks over ~7h. Demo node healed to pre-campaign state\n(auth off, notifications restored, no scratch leaks). No production code changed.\n\nEvidence snapshot + README under campaign2-evidence-2026-07-07/ (cookie jars scrubbed).\n\n\ud83e\udd16 Generated with [Claude Code](https://claude.com/claude-code)\n\nCo-Authored-By: Claude Opus 4.8 \nClaude-Session: https://claude.ai/code/session_01PSK5g6qYLknKj8u3QAFEr6", + "Tags": [], + "Fingerprint": "7714f1f6e4f76c65c9d82c15a6e890b0c007ac49:documentation/tests/campaign2-evidence-2026-07-07/evidence/T-DEPLOY-SET/values_bookstack.json:generic-api-key:1" + }, + { + "RuleID": "generic-api-key", + "Description": "Detected a Generic API Key, potentially exposing access to various services and sensitive operations.", + "StartLine": 1, + "EndLine": 1, + "StartColumn": 79, + "EndColumn": 122, + "Secret": "REDACTED", + "File": "documentation/tests/campaign2-evidence-2026-07-07/evidence/T-DEPLOY-SET/values_bookstack.json", + "SymlinkFile": "", + "Commit": "7714f1f6e4f76c65c9d82c15a6e890b0c007ac49", + "Entropy": 4.324863, + "Date": "2026-07-07T12:26:52Z", + "Message": "docs(tests): Campaign 2 report + evidence \u2014 DR primitives, self-update, storage, faults, endurance\n\nFull-system validation on demo 9201 (controller v0.102.0 / agent v0.73.0). Headline:\nONE genuine pilot-critical finding \u2014 the non-root agent cannot pct-restore the\nstandard Felhom guest because it has bind-mount mountpoints (mp8 /mnt/felhom-drives,\nmp9 bootstrap) and pct restore refuses bind mounts unless root. This breaks BOTH\n--selftest=restore-test AND the offsite DR bring-up (R1), linked to a missing\nVM.Audit/VM.Allocate on the agent token (R2). The large raw FAIL count is dominated\nby one harness bug (auth-session expiry mis-scoring P3-P9) plus D1-injection/soak-probe/\ndryrun-journal/escrow-blob calibration issues; the product where actually exercised was\nhealthy with ZERO resource leaks over ~7h. Demo node healed to pre-campaign state\n(auth off, notifications restored, no scratch leaks). No production code changed.\n\nEvidence snapshot + README under campaign2-evidence-2026-07-07/ (cookie jars scrubbed).\n\n\ud83e\udd16 Generated with [Claude Code](https://claude.com/claude-code)\n\nCo-Authored-By: Claude Opus 4.8 \nClaude-Session: https://claude.ai/code/session_01PSK5g6qYLknKj8u3QAFEr6", + "Tags": [], + "Fingerprint": "7714f1f6e4f76c65c9d82c15a6e890b0c007ac49:documentation/tests/campaign2-evidence-2026-07-07/evidence/T-DEPLOY-SET/values_bookstack.json:generic-api-key:1" + }, + { + "RuleID": "generic-api-key", + "Description": "Detected a Generic API Key, potentially exposing access to various services and sensitive operations.", + "StartLine": 1, + "EndLine": 1, + "StartColumn": 35, + "EndColumn": 78, + "Secret": "REDACTED", + "File": "documentation/tests/campaign2-evidence-2026-07-07/evidence/T-DEPLOY-SET/values_paperless-ngx.json", + "SymlinkFile": "", + "Commit": "7714f1f6e4f76c65c9d82c15a6e890b0c007ac49", + "Entropy": 4.235926, + "Date": "2026-07-07T12:26:52Z", + "Message": "docs(tests): Campaign 2 report + evidence \u2014 DR primitives, self-update, storage, faults, endurance\n\nFull-system validation on demo 9201 (controller v0.102.0 / agent v0.73.0). Headline:\nONE genuine pilot-critical finding \u2014 the non-root agent cannot pct-restore the\nstandard Felhom guest because it has bind-mount mountpoints (mp8 /mnt/felhom-drives,\nmp9 bootstrap) and pct restore refuses bind mounts unless root. This breaks BOTH\n--selftest=restore-test AND the offsite DR bring-up (R1), linked to a missing\nVM.Audit/VM.Allocate on the agent token (R2). The large raw FAIL count is dominated\nby one harness bug (auth-session expiry mis-scoring P3-P9) plus D1-injection/soak-probe/\ndryrun-journal/escrow-blob calibration issues; the product where actually exercised was\nhealthy with ZERO resource leaks over ~7h. Demo node healed to pre-campaign state\n(auth off, notifications restored, no scratch leaks). No production code changed.\n\nEvidence snapshot + README under campaign2-evidence-2026-07-07/ (cookie jars scrubbed).\n\n\ud83e\udd16 Generated with [Claude Code](https://claude.com/claude-code)\n\nCo-Authored-By: Claude Opus 4.8 \nClaude-Session: https://claude.ai/code/session_01PSK5g6qYLknKj8u3QAFEr6", + "Tags": [], + "Fingerprint": "7714f1f6e4f76c65c9d82c15a6e890b0c007ac49:documentation/tests/campaign2-evidence-2026-07-07/evidence/T-DEPLOY-SET/values_paperless-ngx.json:generic-api-key:1" + }, + { + "RuleID": "generic-api-key", + "Description": "Detected a Generic API Key, potentially exposing access to various services and sensitive operations.", + "StartLine": 1, + "EndLine": 1, + "StartColumn": 82, + "EndColumn": 134, + "Secret": "REDACTED", + "File": "documentation/tests/campaign2-evidence-2026-07-07/evidence/T-DEPLOY-SET/values_paperless-ngx.json", + "SymlinkFile": "", + "Commit": "7714f1f6e4f76c65c9d82c15a6e890b0c007ac49", + "Entropy": 4.235926, + "Date": "2026-07-07T12:26:52Z", + "Message": "docs(tests): Campaign 2 report + evidence \u2014 DR primitives, self-update, storage, faults, endurance\n\nFull-system validation on demo 9201 (controller v0.102.0 / agent v0.73.0). Headline:\nONE genuine pilot-critical finding \u2014 the non-root agent cannot pct-restore the\nstandard Felhom guest because it has bind-mount mountpoints (mp8 /mnt/felhom-drives,\nmp9 bootstrap) and pct restore refuses bind mounts unless root. This breaks BOTH\n--selftest=restore-test AND the offsite DR bring-up (R1), linked to a missing\nVM.Audit/VM.Allocate on the agent token (R2). The large raw FAIL count is dominated\nby one harness bug (auth-session expiry mis-scoring P3-P9) plus D1-injection/soak-probe/\ndryrun-journal/escrow-blob calibration issues; the product where actually exercised was\nhealthy with ZERO resource leaks over ~7h. Demo node healed to pre-campaign state\n(auth off, notifications restored, no scratch leaks). No production code changed.\n\nEvidence snapshot + README under campaign2-evidence-2026-07-07/ (cookie jars scrubbed).\n\n\ud83e\udd16 Generated with [Claude Code](https://claude.com/claude-code)\n\nCo-Authored-By: Claude Opus 4.8 \nClaude-Session: https://claude.ai/code/session_01PSK5g6qYLknKj8u3QAFEr6", + "Tags": [], + "Fingerprint": "7714f1f6e4f76c65c9d82c15a6e890b0c007ac49:documentation/tests/campaign2-evidence-2026-07-07/evidence/T-DEPLOY-SET/values_paperless-ngx.json:generic-api-key:1" + }, + { + "RuleID": "generic-api-key", + "Description": "Detected a Generic API Key, potentially exposing access to various services and sensitive operations.", + "StartLine": 1, + "EndLine": 1, + "StartColumn": 138, + "EndColumn": 194, + "Secret": "REDACTED", + "File": "documentation/tests/campaign2-evidence-2026-07-07/evidence/T-DEPLOY-SET/values_paperless-ngx.json", + "SymlinkFile": "", + "Commit": "7714f1f6e4f76c65c9d82c15a6e890b0c007ac49", + "Entropy": 4.235926, + "Date": "2026-07-07T12:26:52Z", + "Message": "docs(tests): Campaign 2 report + evidence \u2014 DR primitives, self-update, storage, faults, endurance\n\nFull-system validation on demo 9201 (controller v0.102.0 / agent v0.73.0). Headline:\nONE genuine pilot-critical finding \u2014 the non-root agent cannot pct-restore the\nstandard Felhom guest because it has bind-mount mountpoints (mp8 /mnt/felhom-drives,\nmp9 bootstrap) and pct restore refuses bind mounts unless root. This breaks BOTH\n--selftest=restore-test AND the offsite DR bring-up (R1), linked to a missing\nVM.Audit/VM.Allocate on the agent token (R2). The large raw FAIL count is dominated\nby one harness bug (auth-session expiry mis-scoring P3-P9) plus D1-injection/soak-probe/\ndryrun-journal/escrow-blob calibration issues; the product where actually exercised was\nhealthy with ZERO resource leaks over ~7h. Demo node healed to pre-campaign state\n(auth off, notifications restored, no scratch leaks). No production code changed.\n\nEvidence snapshot + README under campaign2-evidence-2026-07-07/ (cookie jars scrubbed).\n\n\ud83e\udd16 Generated with [Claude Code](https://claude.com/claude-code)\n\nCo-Authored-By: Claude Opus 4.8 \nClaude-Session: https://claude.ai/code/session_01PSK5g6qYLknKj8u3QAFEr6", + "Tags": [], + "Fingerprint": "7714f1f6e4f76c65c9d82c15a6e890b0c007ac49:documentation/tests/campaign2-evidence-2026-07-07/evidence/T-DEPLOY-SET/values_paperless-ngx.json:generic-api-key:1" + }, + { + "RuleID": "generic-api-key", + "Description": "Detected a Generic API Key, potentially exposing access to various services and sensitive operations.", + "StartLine": 28, + "EndLine": 28, + "StartColumn": 119, + "EndColumn": 162, + "Secret": "REDACTED", + "File": "documentation/tests/campaign2-evidence-2026-07-07/state/runner.log", + "SymlinkFile": "", + "Commit": "7714f1f6e4f76c65c9d82c15a6e890b0c007ac49", + "Entropy": 4.164498, + "Date": "2026-07-07T12:26:52Z", + "Message": "docs(tests): Campaign 2 report + evidence \u2014 DR primitives, self-update, storage, faults, endurance\n\nFull-system validation on demo 9201 (controller v0.102.0 / agent v0.73.0). Headline:\nONE genuine pilot-critical finding \u2014 the non-root agent cannot pct-restore the\nstandard Felhom guest because it has bind-mount mountpoints (mp8 /mnt/felhom-drives,\nmp9 bootstrap) and pct restore refuses bind mounts unless root. This breaks BOTH\n--selftest=restore-test AND the offsite DR bring-up (R1), linked to a missing\nVM.Audit/VM.Allocate on the agent token (R2). The large raw FAIL count is dominated\nby one harness bug (auth-session expiry mis-scoring P3-P9) plus D1-injection/soak-probe/\ndryrun-journal/escrow-blob calibration issues; the product where actually exercised was\nhealthy with ZERO resource leaks over ~7h. Demo node healed to pre-campaign state\n(auth off, notifications restored, no scratch leaks). No production code changed.\n\nEvidence snapshot + README under campaign2-evidence-2026-07-07/ (cookie jars scrubbed).\n\n\ud83e\udd16 Generated with [Claude Code](https://claude.com/claude-code)\n\nCo-Authored-By: Claude Opus 4.8 \nClaude-Session: https://claude.ai/code/session_01PSK5g6qYLknKj8u3QAFEr6", + "Tags": [], + "Fingerprint": "7714f1f6e4f76c65c9d82c15a6e890b0c007ac49:documentation/tests/campaign2-evidence-2026-07-07/state/runner.log:generic-api-key:28" + }, + { + "RuleID": "generic-api-key", + "Description": "Detected a Generic API Key, potentially exposing access to various services and sensitive operations.", + "StartLine": 37, + "EndLine": 37, + "StartColumn": 120, + "EndColumn": 163, + "Secret": "REDACTED", + "File": "documentation/tests/campaign2-evidence-2026-07-07/state/runner.log", + "SymlinkFile": "", + "Commit": "7714f1f6e4f76c65c9d82c15a6e890b0c007ac49", + "Entropy": 4.2803946, + "Date": "2026-07-07T12:26:52Z", + "Message": "docs(tests): Campaign 2 report + evidence \u2014 DR primitives, self-update, storage, faults, endurance\n\nFull-system validation on demo 9201 (controller v0.102.0 / agent v0.73.0). Headline:\nONE genuine pilot-critical finding \u2014 the non-root agent cannot pct-restore the\nstandard Felhom guest because it has bind-mount mountpoints (mp8 /mnt/felhom-drives,\nmp9 bootstrap) and pct restore refuses bind mounts unless root. This breaks BOTH\n--selftest=restore-test AND the offsite DR bring-up (R1), linked to a missing\nVM.Audit/VM.Allocate on the agent token (R2). The large raw FAIL count is dominated\nby one harness bug (auth-session expiry mis-scoring P3-P9) plus D1-injection/soak-probe/\ndryrun-journal/escrow-blob calibration issues; the product where actually exercised was\nhealthy with ZERO resource leaks over ~7h. Demo node healed to pre-campaign state\n(auth off, notifications restored, no scratch leaks). No production code changed.\n\nEvidence snapshot + README under campaign2-evidence-2026-07-07/ (cookie jars scrubbed).\n\n\ud83e\udd16 Generated with [Claude Code](https://claude.com/claude-code)\n\nCo-Authored-By: Claude Opus 4.8 \nClaude-Session: https://claude.ai/code/session_01PSK5g6qYLknKj8u3QAFEr6", + "Tags": [], + "Fingerprint": "7714f1f6e4f76c65c9d82c15a6e890b0c007ac49:documentation/tests/campaign2-evidence-2026-07-07/state/runner.log:generic-api-key:37" + }, + { + "RuleID": "generic-api-key", + "Description": "Detected a Generic API Key, potentially exposing access to various services and sensitive operations.", + "StartLine": 37, + "EndLine": 37, + "StartColumn": 167, + "EndColumn": 205, + "Secret": "REDACTED", + "File": "documentation/tests/campaign2-evidence-2026-07-07/state/runner.log", + "SymlinkFile": "", + "Commit": "7714f1f6e4f76c65c9d82c15a6e890b0c007ac49", + "Entropy": 3.640224, + "Date": "2026-07-07T12:26:52Z", + "Message": "docs(tests): Campaign 2 report + evidence \u2014 DR primitives, self-update, storage, faults, endurance\n\nFull-system validation on demo 9201 (controller v0.102.0 / agent v0.73.0). Headline:\nONE genuine pilot-critical finding \u2014 the non-root agent cannot pct-restore the\nstandard Felhom guest because it has bind-mount mountpoints (mp8 /mnt/felhom-drives,\nmp9 bootstrap) and pct restore refuses bind mounts unless root. This breaks BOTH\n--selftest=restore-test AND the offsite DR bring-up (R1), linked to a missing\nVM.Audit/VM.Allocate on the agent token (R2). The large raw FAIL count is dominated\nby one harness bug (auth-session expiry mis-scoring P3-P9) plus D1-injection/soak-probe/\ndryrun-journal/escrow-blob calibration issues; the product where actually exercised was\nhealthy with ZERO resource leaks over ~7h. Demo node healed to pre-campaign state\n(auth off, notifications restored, no scratch leaks). No production code changed.\n\nEvidence snapshot + README under campaign2-evidence-2026-07-07/ (cookie jars scrubbed).\n\n\ud83e\udd16 Generated with [Claude Code](https://claude.com/claude-code)\n\nCo-Authored-By: Claude Opus 4.8 \nClaude-Session: https://claude.ai/code/session_01PSK5g6qYLknKj8u3QAFEr6", + "Tags": [], + "Fingerprint": "7714f1f6e4f76c65c9d82c15a6e890b0c007ac49:documentation/tests/campaign2-evidence-2026-07-07/state/runner.log:generic-api-key:37" + }, + { + "RuleID": "generic-api-key", + "Description": "Detected a Generic API Key, potentially exposing access to various services and sensitive operations.", + "StartLine": 43, + "EndLine": 43, + "StartColumn": 117, + "EndColumn": 156, + "Secret": "REDACTED", + "File": "documentation/tests/campaign2-evidence-2026-07-07/state/runner.log", + "SymlinkFile": "", + "Commit": "7714f1f6e4f76c65c9d82c15a6e890b0c007ac49", + "Entropy": 4.324863, + "Date": "2026-07-07T12:26:52Z", + "Message": "docs(tests): Campaign 2 report + evidence \u2014 DR primitives, self-update, storage, faults, endurance\n\nFull-system validation on demo 9201 (controller v0.102.0 / agent v0.73.0). Headline:\nONE genuine pilot-critical finding \u2014 the non-root agent cannot pct-restore the\nstandard Felhom guest because it has bind-mount mountpoints (mp8 /mnt/felhom-drives,\nmp9 bootstrap) and pct restore refuses bind mounts unless root. This breaks BOTH\n--selftest=restore-test AND the offsite DR bring-up (R1), linked to a missing\nVM.Audit/VM.Allocate on the agent token (R2). The large raw FAIL count is dominated\nby one harness bug (auth-session expiry mis-scoring P3-P9) plus D1-injection/soak-probe/\ndryrun-journal/escrow-blob calibration issues; the product where actually exercised was\nhealthy with ZERO resource leaks over ~7h. Demo node healed to pre-campaign state\n(auth off, notifications restored, no scratch leaks). No production code changed.\n\nEvidence snapshot + README under campaign2-evidence-2026-07-07/ (cookie jars scrubbed).\n\n\ud83e\udd16 Generated with [Claude Code](https://claude.com/claude-code)\n\nCo-Authored-By: Claude Opus 4.8 \nClaude-Session: https://claude.ai/code/session_01PSK5g6qYLknKj8u3QAFEr6", + "Tags": [], + "Fingerprint": "7714f1f6e4f76c65c9d82c15a6e890b0c007ac49:documentation/tests/campaign2-evidence-2026-07-07/state/runner.log:generic-api-key:43" + }, + { + "RuleID": "generic-api-key", + "Description": "Detected a Generic API Key, potentially exposing access to various services and sensitive operations.", + "StartLine": 43, + "EndLine": 43, + "StartColumn": 160, + "EndColumn": 201, + "Secret": "REDACTED", + "File": "documentation/tests/campaign2-evidence-2026-07-07/state/runner.log", + "SymlinkFile": "", + "Commit": "7714f1f6e4f76c65c9d82c15a6e890b0c007ac49", + "Entropy": 4.3285995, + "Date": "2026-07-07T12:26:52Z", + "Message": "docs(tests): Campaign 2 report + evidence \u2014 DR primitives, self-update, storage, faults, endurance\n\nFull-system validation on demo 9201 (controller v0.102.0 / agent v0.73.0). Headline:\nONE genuine pilot-critical finding \u2014 the non-root agent cannot pct-restore the\nstandard Felhom guest because it has bind-mount mountpoints (mp8 /mnt/felhom-drives,\nmp9 bootstrap) and pct restore refuses bind mounts unless root. This breaks BOTH\n--selftest=restore-test AND the offsite DR bring-up (R1), linked to a missing\nVM.Audit/VM.Allocate on the agent token (R2). The large raw FAIL count is dominated\nby one harness bug (auth-session expiry mis-scoring P3-P9) plus D1-injection/soak-probe/\ndryrun-journal/escrow-blob calibration issues; the product where actually exercised was\nhealthy with ZERO resource leaks over ~7h. Demo node healed to pre-campaign state\n(auth off, notifications restored, no scratch leaks). No production code changed.\n\nEvidence snapshot + README under campaign2-evidence-2026-07-07/ (cookie jars scrubbed).\n\n\ud83e\udd16 Generated with [Claude Code](https://claude.com/claude-code)\n\nCo-Authored-By: Claude Opus 4.8 \nClaude-Session: https://claude.ai/code/session_01PSK5g6qYLknKj8u3QAFEr6", + "Tags": [], + "Fingerprint": "7714f1f6e4f76c65c9d82c15a6e890b0c007ac49:documentation/tests/campaign2-evidence-2026-07-07/state/runner.log:generic-api-key:43" + }, + { + "RuleID": "generic-api-key", + "Description": "Detected a Generic API Key, potentially exposing access to various services and sensitive operations.", + "StartLine": 79, + "EndLine": 79, + "StartColumn": 120, + "EndColumn": 163, + "Secret": "REDACTED", + "File": "documentation/tests/campaign2-evidence-2026-07-07/state/runner.log", + "SymlinkFile": "", + "Commit": "7714f1f6e4f76c65c9d82c15a6e890b0c007ac49", + "Entropy": 4.235926, + "Date": "2026-07-07T12:26:52Z", + "Message": "docs(tests): Campaign 2 report + evidence \u2014 DR primitives, self-update, storage, faults, endurance\n\nFull-system validation on demo 9201 (controller v0.102.0 / agent v0.73.0). Headline:\nONE genuine pilot-critical finding \u2014 the non-root agent cannot pct-restore the\nstandard Felhom guest because it has bind-mount mountpoints (mp8 /mnt/felhom-drives,\nmp9 bootstrap) and pct restore refuses bind mounts unless root. This breaks BOTH\n--selftest=restore-test AND the offsite DR bring-up (R1), linked to a missing\nVM.Audit/VM.Allocate on the agent token (R2). The large raw FAIL count is dominated\nby one harness bug (auth-session expiry mis-scoring P3-P9) plus D1-injection/soak-probe/\ndryrun-journal/escrow-blob calibration issues; the product where actually exercised was\nhealthy with ZERO resource leaks over ~7h. Demo node healed to pre-campaign state\n(auth off, notifications restored, no scratch leaks). No production code changed.\n\nEvidence snapshot + README under campaign2-evidence-2026-07-07/ (cookie jars scrubbed).\n\n\ud83e\udd16 Generated with [Claude Code](https://claude.com/claude-code)\n\nCo-Authored-By: Claude Opus 4.8 \nClaude-Session: https://claude.ai/code/session_01PSK5g6qYLknKj8u3QAFEr6", + "Tags": [], + "Fingerprint": "7714f1f6e4f76c65c9d82c15a6e890b0c007ac49:documentation/tests/campaign2-evidence-2026-07-07/state/runner.log:generic-api-key:79" + }, + { + "RuleID": "generic-api-key", + "Description": "Detected a Generic API Key, potentially exposing access to various services and sensitive operations.", + "StartLine": 79, + "EndLine": 79, + "StartColumn": 167, + "EndColumn": 205, + "Secret": "REDACTED", + "File": "documentation/tests/campaign2-evidence-2026-07-07/state/runner.log", + "SymlinkFile": "", + "Commit": "7714f1f6e4f76c65c9d82c15a6e890b0c007ac49", + "Entropy": 3.589898, + "Date": "2026-07-07T12:26:52Z", + "Message": "docs(tests): Campaign 2 report + evidence \u2014 DR primitives, self-update, storage, faults, endurance\n\nFull-system validation on demo 9201 (controller v0.102.0 / agent v0.73.0). Headline:\nONE genuine pilot-critical finding \u2014 the non-root agent cannot pct-restore the\nstandard Felhom guest because it has bind-mount mountpoints (mp8 /mnt/felhom-drives,\nmp9 bootstrap) and pct restore refuses bind mounts unless root. This breaks BOTH\n--selftest=restore-test AND the offsite DR bring-up (R1), linked to a missing\nVM.Audit/VM.Allocate on the agent token (R2). The large raw FAIL count is dominated\nby one harness bug (auth-session expiry mis-scoring P3-P9) plus D1-injection/soak-probe/\ndryrun-journal/escrow-blob calibration issues; the product where actually exercised was\nhealthy with ZERO resource leaks over ~7h. Demo node healed to pre-campaign state\n(auth off, notifications restored, no scratch leaks). No production code changed.\n\nEvidence snapshot + README under campaign2-evidence-2026-07-07/ (cookie jars scrubbed).\n\n\ud83e\udd16 Generated with [Claude Code](https://claude.com/claude-code)\n\nCo-Authored-By: Claude Opus 4.8 \nClaude-Session: https://claude.ai/code/session_01PSK5g6qYLknKj8u3QAFEr6", + "Tags": [], + "Fingerprint": "7714f1f6e4f76c65c9d82c15a6e890b0c007ac49:documentation/tests/campaign2-evidence-2026-07-07/state/runner.log:generic-api-key:79" + }, + { + "RuleID": "generic-api-key", + "Description": "Detected a Generic API Key, potentially exposing access to various services and sensitive operations.", + "StartLine": 88, + "EndLine": 88, + "StartColumn": 8, + "EndColumn": 56, + "Secret": "REDACTED", + "File": "manifests/hub.yaml", + "SymlinkFile": "", + "Commit": "0fcc7d8e6f97f68600842aa9483d1152efb633c8", + "Entropy": 3.7495818, + "Date": "2026-02-20T13:03:39Z", + "Message": "docs: add hub CHANGELOG.md, update ConfigMap with registry section\n\n- hub/CHANGELOG.md: new file with v0.2.0 and prior version history\n- manifests/hub.yaml: add registry config (version checker + template fetcher),\n pin image to v0.2.0, remove stale /healthz TODO comment\n\nCo-Authored-By: Claude Opus 4.6 ", + "Tags": [], + "Fingerprint": "0fcc7d8e6f97f68600842aa9483d1152efb633c8:manifests/hub.yaml:generic-api-key:88" + }, + { + "RuleID": "generic-api-key", + "Description": "Detected a Generic API Key, potentially exposing access to various services and sensitive operations.", + "StartLine": 84, + "EndLine": 84, + "StartColumn": 8, + "EndColumn": 61, + "Secret": "REDACTED", + "File": "manifests/hub.yaml", + "SymlinkFile": "", + "Commit": "c9abc6bb9e56291603c7a27f3060d8288e5bac97", + "Entropy": 4.572431, + "Date": "2026-02-16T18:45:09Z", + "Message": "added resend api key", + "Tags": [], + "Fingerprint": "c9abc6bb9e56291603c7a27f3060d8288e5bac97:manifests/hub.yaml:generic-api-key:84" + }, + { + "RuleID": "generic-api-key", + "Description": "Detected a Generic API Key, potentially exposing access to various services and sensitive operations.", + "StartLine": 10, + "EndLine": 10, + "StartColumn": 4, + "EndColumn": 84, + "Secret": "REDACTED", + "File": "manifests/felhom.secret.yaml", + "SymlinkFile": "", + "Commit": "0b144a4d244afc3a9b06c5d0dc31c7e3a0fef141", + "Entropy": 5.356988, + "Date": "2026-02-11T07:50:08Z", + "Message": "initial move to gitea", + "Tags": [], + "Fingerprint": "0b144a4d244afc3a9b06c5d0dc31c7e3a0fef141:manifests/felhom.secret.yaml:generic-api-key:10" + }, + { + "RuleID": "generic-api-key", + "Description": "Detected a Generic API Key, potentially exposing access to various services and sensitive operations.", + "StartLine": 20, + "EndLine": 20, + "StartColumn": 4, + "EndColumn": 62, + "Secret": "REDACTED", + "File": "manifests/felhom.secret.yaml", + "SymlinkFile": "", + "Commit": "0b144a4d244afc3a9b06c5d0dc31c7e3a0fef141", + "Entropy": 4.572431, + "Date": "2026-02-11T07:50:08Z", + "Message": "initial move to gitea", + "Tags": [], + "Fingerprint": "0b144a4d244afc3a9b06c5d0dc31c7e3a0fef141:manifests/felhom.secret.yaml:generic-api-key:20" + }, + { + "RuleID": "generic-api-key", + "Description": "Detected a Generic API Key, potentially exposing access to various services and sensitive operations.", + "StartLine": 32, + "EndLine": 32, + "StartColumn": 4, + "EndColumn": 57, + "Secret": "REDACTED", + "File": "manifests/felhom.secret.yaml", + "SymlinkFile": "", + "Commit": "0b144a4d244afc3a9b06c5d0dc31c7e3a0fef141", + "Entropy": 4.572431, + "Date": "2026-02-11T07:50:08Z", + "Message": "initial move to gitea", + "Tags": [], + "Fingerprint": "0b144a4d244afc3a9b06c5d0dc31c7e3a0fef141:manifests/felhom.secret.yaml:generic-api-key:32" + }, + { + "RuleID": "generic-api-key", + "Description": "Detected a Generic API Key, potentially exposing access to various services and sensitive operations.", + "StartLine": 41, + "EndLine": 41, + "StartColumn": 4, + "EndColumn": 81, + "Secret": "REDACTED", + "File": "manifests/felhom.secret.yaml", + "SymlinkFile": "", + "Commit": "0b144a4d244afc3a9b06c5d0dc31c7e3a0fef141", + "Entropy": 3.8505487, + "Date": "2026-02-11T07:50:08Z", + "Message": "initial move to gitea", + "Tags": [], + "Fingerprint": "0b144a4d244afc3a9b06c5d0dc31c7e3a0fef141:manifests/felhom.secret.yaml:generic-api-key:41" + }, + { + "RuleID": "generic-api-key", + "Description": "Detected a Generic API Key, potentially exposing access to various services and sensitive operations.", + "StartLine": 42, + "EndLine": 42, + "StartColumn": 4, + "EndColumn": 56, + "Secret": "REDACTED", + "File": "manifests/felhom.secret.yaml", + "SymlinkFile": "", + "Commit": "0b144a4d244afc3a9b06c5d0dc31c7e3a0fef141", + "Entropy": 3.628928, + "Date": "2026-02-11T07:50:08Z", + "Message": "initial move to gitea", + "Tags": [], + "Fingerprint": "0b144a4d244afc3a9b06c5d0dc31c7e3a0fef141:manifests/felhom.secret.yaml:generic-api-key:42" + } + ] +} \ No newline at end of file diff --git a/documentation/audits/security-review-2026-10-12/scanners/gitleaks-homelab-manifests.count.json b/documentation/audits/security-review-2026-10-12/scanners/gitleaks-homelab-manifests.count.json new file mode 100644 index 00000000..9ef08054 --- /dev/null +++ b/documentation/audits/security-review-2026-10-12/scanners/gitleaks-homelab-manifests.count.json @@ -0,0 +1,4 @@ +{ + "note": "homelab-manifests is a PRIVATE repo (anonymous 404); its 17 hit locations are kept off-git on DooPlex: /mnt/5_hdd/felhom.eu/evidence/security-review-2026-10-12-PRIVATE/", + "hits": 17 +} \ No newline at end of file diff --git a/documentation/audits/security-review-2026-10-12/scanners/gosec-felhom-agent.json b/documentation/audits/security-review-2026-10-12/scanners/gosec-felhom-agent.json new file mode 100644 index 00000000..2282f883 --- /dev/null +++ b/documentation/audits/security-review-2026-10-12/scanners/gosec-felhom-agent.json @@ -0,0 +1,1884 @@ +{ + "Golang errors": {}, + "Issues": [ + { + "severity": "HIGH", + "confidence": "MEDIUM", + "cwe": { + "id": "190", + "url": "https://cwe.mitre.org/data/definitions/190.html" + }, + "rule_id": "G115", + "details": "integer overflow conversion uint64 -\u003e int64", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-agent/internal/localapi/capacity_linux.go", + "code": "19: \t}\n20: \tfree := int64(st.Bfree) * bs\n21: \tused = total - free\n", + "line": "20", + "column": "15", + "nosec": false, + "suppressions": null + }, + { + "severity": "HIGH", + "confidence": "MEDIUM", + "cwe": { + "id": "190", + "url": "https://cwe.mitre.org/data/definitions/190.html" + }, + "rule_id": "G115", + "details": "integer overflow conversion uint64 -\u003e int64", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-agent/internal/localapi/capacity_linux.go", + "code": "15: \tbs := int64(st.Bsize)\n16: \ttotal = int64(st.Blocks) * bs\n17: \tif total \u003c= 0 {\n", + "line": "16", + "column": "15", + "nosec": false, + "suppressions": null + }, + { + "severity": "HIGH", + "confidence": "MEDIUM", + "cwe": { + "id": "190", + "url": "https://cwe.mitre.org/data/definitions/190.html" + }, + "rule_id": "G115", + "details": "integer overflow conversion int -\u003e uint16", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-agent/internal/poke/poke.go", + "code": "130: func (l *Listener) serve(ctx context.Context, addr netip.Addr) error {\n131: \tbind := netip.AddrPortFrom(addr, uint16(l.port)).String()\n132: \tvar lc net.ListenConfig\n", + "line": "131", + "column": "41", + "nosec": false, + "suppressions": null + }, + { + "severity": "HIGH", + "confidence": "HIGH", + "cwe": { + "id": "295", + "url": "https://cwe.mitre.org/data/definitions/295.html" + }, + "rule_id": "G402", + "details": "TLS MinVersion too low.", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-agent/internal/proxmox/tls.go", + "code": "72: \tdefault:\n73: \t\treturn \u0026tls.Config{}, nil // system roots; safe default\n74: \t}\n", + "line": "73", + "column": "11", + "nosec": false, + "suppressions": null + }, + { + "severity": "HIGH", + "confidence": "HIGH", + "cwe": { + "id": "295", + "url": "https://cwe.mitre.org/data/definitions/295.html" + }, + "rule_id": "G402", + "details": "TLS MinVersion too low.", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-agent/internal/proxmox/tls.go", + "code": "69: \t\t}\n70: \t\treturn \u0026tls.Config{RootCAs: pool}, nil\n71: \n", + "line": "70", + "column": "11", + "nosec": false, + "suppressions": null + }, + { + "severity": "HIGH", + "confidence": "HIGH", + "cwe": { + "id": "295", + "url": "https://cwe.mitre.org/data/definitions/295.html" + }, + "rule_id": "G402", + "details": "TLS MinVersion too low.", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-agent/internal/hub/client.go", + "code": "40: \t}\n41: \ttlsCfg := \u0026tls.Config{} // system roots\n42: \tif cfg.CAFile != \"\" {\n", + "line": "41", + "column": "13", + "nosec": false, + "suppressions": null + }, + { + "severity": "HIGH", + "confidence": "HIGH", + "cwe": { + "id": "295", + "url": "https://cwe.mitre.org/data/definitions/295.html" + }, + "rule_id": "G402", + "details": "TLS InsecureSkipVerify set true.", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-agent/internal/proxmox/tls.go", + "code": "47: \t\treturn \u0026tls.Config{\n48: \t\t\tInsecureSkipVerify: true, //nolint:gosec // replaced by the pin check below\n49: \t\t\tVerifyPeerCertificate: func(rawCerts [][]byte, _ [][]*x509.Certificate) error {\n", + "line": "48", + "column": "24", + "nosec": false, + "suppressions": null + }, + { + "severity": "HIGH", + "confidence": "HIGH", + "cwe": { + "id": "295", + "url": "https://cwe.mitre.org/data/definitions/295.html" + }, + "rule_id": "G402", + "details": "TLS InsecureSkipVerify set true.", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-agent/internal/proxmox/tls.go", + "code": "36: \t\t// Caller opted in explicitly and by an honestly-named field.\n37: \t\treturn \u0026tls.Config{InsecureSkipVerify: true}, nil //nolint:gosec // documented, config-gated, off by default\n38: \n", + "line": "37", + "column": "42", + "nosec": false, + "suppressions": null + }, + { + "severity": "HIGH", + "confidence": "HIGH", + "cwe": { + "id": "295", + "url": "https://cwe.mitre.org/data/definitions/295.html" + }, + "rule_id": "G402", + "details": "TLS InsecureSkipVerify set true.", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-agent/internal/pbs/pin.go", + "code": "22: \treturn \u0026tls.Config{\n23: \t\tInsecureSkipVerify: true, //nolint:gosec // replaced by the exact-cert pin below\n24: \t\tVerifyPeerCertificate: func(rawCerts [][]byte, _ [][]*x509.Certificate) error {\n", + "line": "23", + "column": "23", + "nosec": false, + "suppressions": null + }, + { + "severity": "HIGH", + "confidence": "LOW", + "cwe": { + "id": "798", + "url": "https://cwe.mitre.org/data/definitions/798.html" + }, + "rule_id": "G101", + "details": "Potential hardcoded credentials", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-agent/internal/localapi/netstorage.go", + "code": "33: // git, never in a plaintext registry, never logged — same posture as the rotated Resend key).\n34: const defaultSmbCredsDir = \"/var/lib/felhom-agent/smb-creds\"\n35: \n", + "line": "34", + "column": "7", + "nosec": false, + "suppressions": null + }, + { + "severity": "HIGH", + "confidence": "LOW", + "cwe": { + "id": "798", + "url": "https://cwe.mitre.org/data/definitions/798.html" + }, + "rule_id": "G101", + "details": "Potential hardcoded credentials", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-agent/internal/config/config.go", + "code": "264: \tdefaultLocalAPICert = \"/var/lib/felhom-agent/local-api.crt\"\n265: \tdefaultLocalAPIKey = \"/var/lib/felhom-agent/local-api.key\"\n266: )\n", + "line": "265", + "column": "2", + "nosec": false, + "suppressions": null + }, + { + "severity": "HIGH", + "confidence": "LOW", + "cwe": { + "id": "798", + "url": "https://cwe.mitre.org/data/definitions/798.html" + }, + "rule_id": "G101", + "details": "Potential hardcoded credentials", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-agent/internal/config/config.go", + "code": "262: const (\n263: \tdefaultLocalAPITokenStore = \"/var/lib/felhom-agent/local-tokens.log\"\n264: \tdefaultLocalAPICert = \"/var/lib/felhom-agent/local-api.crt\"\n", + "line": "263", + "column": "2", + "nosec": false, + "suppressions": null + }, + { + "severity": "MEDIUM", + "confidence": "HIGH", + "cwe": { + "id": "78", + "url": "https://cwe.mitre.org/data/definitions/78.html" + }, + "rule_id": "G204", + "details": "Subprocess launched with variable", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-agent/internal/proxmox/privileged.go", + "code": "78: \t\t}\n79: \t\tcmd = exec.CommandContext(ctx, sudo, append([]string{\"-n\", name}, args...)...)\n80: \t} else {\n", + "line": "79", + "column": "9", + "nosec": false, + "suppressions": null + }, + { + "severity": "MEDIUM", + "confidence": "HIGH", + "cwe": { + "id": "78", + "url": "https://cwe.mitre.org/data/definitions/78.html" + }, + "rule_id": "G204", + "details": "Subprocess launched with variable", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-agent/internal/privapplytest/check.go", + "code": "31: \t}\n32: \tout, _ := exec.Command(py, append(args, f)...).CombinedOutput()\n33: \treturn strings.TrimSpace(string(out))\n", + "line": "32", + "column": "12", + "nosec": false, + "suppressions": null + }, + { + "severity": "MEDIUM", + "confidence": "HIGH", + "cwe": { + "id": "78", + "url": "https://cwe.mitre.org/data/definitions/78.html" + }, + "rule_id": "G204", + "details": "Subprocess launched with variable", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-agent/internal/localapi/escrow_ceremony.go", + "code": "424: \t\targs := append([]string{\"-n\", \"-l\", \"--\", escrow.CeremonyBinary}, escrow.CeremonyArgs()...)\n425: \t\treturn exec.CommandContext(ctx, sudoPath, args...).Run()\n426: \t}\n", + "line": "425", + "column": "10", + "nosec": false, + "suppressions": null + }, + { + "severity": "MEDIUM", + "confidence": "HIGH", + "cwe": { + "id": "78", + "url": "https://cwe.mitre.org/data/definitions/78.html" + }, + "rule_id": "G204", + "details": "Subprocess launched with variable", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-agent/internal/localapi/escrow_ceremony.go", + "code": "98: \t\targs := append([]string{\"-n\", escrow.CeremonyBinary}, escrow.CeremonyArgs()...)\n99: \t\tcmd := exec.CommandContext(ctx, sudoPath, args...)\n100: \t\tvar stdout, stderr bytes.Buffer\n", + "line": "99", + "column": "10", + "nosec": false, + "suppressions": null + }, + { + "severity": "MEDIUM", + "confidence": "HIGH", + "cwe": { + "id": "78", + "url": "https://cwe.mitre.org/data/definitions/78.html" + }, + "rule_id": "G204", + "details": "Subprocess launched with a potential tainted input or cmd arguments", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-agent/internal/felhomsshd/manager.go", + "code": "217: \tp := strconv.Itoa(port)\n218: \tout, err := exec.Command(\"ss\", \"-Htln\", \"sport = :\"+p).Output()\n219: \tif err == nil \u0026\u0026 strings.TrimSpace(string(out)) != \"\" {\n", + "line": "218", + "column": "14", + "nosec": false, + "suppressions": null + }, + { + "severity": "MEDIUM", + "confidence": "HIGH", + "cwe": { + "id": "78", + "url": "https://cwe.mitre.org/data/definitions/78.html" + }, + "rule_id": "G204", + "details": "Subprocess launched with a potential tainted input or cmd arguments", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-agent/internal/felhomsshd/health.go", + "code": "144: func listenerPresent(port int) bool {\n145: \tout, err := exec.Command(\"ss\", \"-Htln\", \"sport = :\"+strconv.Itoa(port)).Output()\n146: \treturn err == nil \u0026\u0026 strings.TrimSpace(string(out)) != \"\"\n", + "line": "145", + "column": "14", + "nosec": false, + "suppressions": null + }, + { + "severity": "MEDIUM", + "confidence": "HIGH", + "cwe": { + "id": "78", + "url": "https://cwe.mitre.org/data/definitions/78.html" + }, + "rule_id": "G204", + "details": "Subprocess launched with a potential tainted input or cmd arguments", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-agent/cmd/felhom-opsign/main.go", + "code": "194: \t}\n195: \tcmd := exec.Command(\"ssh-keygen\", \"-Y\", \"sign\", \"-n\", authz.Namespace, \"-f\", keyFile, msgPath)\n196: \tvar stderr bytes.Buffer\n", + "line": "195", + "column": "9", + "nosec": false, + "suppressions": null + }, + { + "severity": "MEDIUM", + "confidence": "HIGH", + "cwe": { + "id": "78", + "url": "https://cwe.mitre.org/data/definitions/78.html" + }, + "rule_id": "G204", + "details": "Subprocess launched with a potential tainted input or cmd arguments", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-agent/cmd/felhom-agent/main.go", + "code": "1588: \tdir := filepath.Dir(cfg.Backup.PBSSecretPath(storageID))\n1589: \tcmd := exec.CommandContext(ctx, \"sudo\", \"-n\", pbsdr.WrapperPath, \"read\", storageID, dir)\n1590: \tvar out, errb bytes.Buffer\n", + "line": "1589", + "column": "9", + "nosec": false, + "suppressions": null + }, + { + "severity": "MEDIUM", + "confidence": "HIGH", + "cwe": { + "id": "22", + "url": "https://cwe.mitre.org/data/definitions/22.html" + }, + "rule_id": "G304", + "details": "Potential file inclusion via variable", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-agent/internal/wgtunnel/manager.go", + "code": "194: func LoadAssignedAddr(stateDir string) (netip.Addr, bool) {\n195: \traw, err := os.ReadFile(filepath.Join(stateDir, \"wg\", markerName))\n196: \tif err != nil {\n", + "line": "195", + "column": "14", + "nosec": false, + "suppressions": null + }, + { + "severity": "MEDIUM", + "confidence": "HIGH", + "cwe": { + "id": "22", + "url": "https://cwe.mitre.org/data/definitions/22.html" + }, + "rule_id": "G304", + "details": "Potential file inclusion via variable", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-agent/internal/wgtunnel/key.go", + "code": "54: \n55: \tif raw, rerr := os.ReadFile(path); rerr == nil {\n56: \t\tpriv, derr := decodeKey(raw)\n", + "line": "55", + "column": "18", + "nosec": false, + "suppressions": null + }, + { + "severity": "MEDIUM", + "confidence": "HIGH", + "cwe": { + "id": "22", + "url": "https://cwe.mitre.org/data/definitions/22.html" + }, + "rule_id": "G304", + "details": "Potential file inclusion via variable", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-agent/internal/storage/registry_known.go", + "code": "98: \t\t}\n99: \t\tdata, rerr := os.ReadFile(filepath.Join(unitDir, e.Name()))\n100: \t\tif rerr != nil {\n", + "line": "99", + "column": "17", + "nosec": false, + "suppressions": null + }, + { + "severity": "MEDIUM", + "confidence": "HIGH", + "cwe": { + "id": "22", + "url": "https://cwe.mitre.org/data/definitions/22.html" + }, + "rule_id": "G304", + "details": "Potential file inclusion via variable", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-agent/internal/storage/netmount.go", + "code": "528: \t\tautomountName := strings.TrimSuffix(e.Name(), \".mount\") + \".automount\"\n529: \t\tautomountData, aerr := os.ReadFile(filepath.Join(h.unitDir, automountName))\n530: \t\tif aerr != nil {\n", + "line": "529", + "column": "26", + "nosec": false, + "suppressions": null + }, + { + "severity": "MEDIUM", + "confidence": "HIGH", + "cwe": { + "id": "22", + "url": "https://cwe.mitre.org/data/definitions/22.html" + }, + "rule_id": "G304", + "details": "Potential file inclusion via variable", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-agent/internal/storage/netmount.go", + "code": "523: \t\tmountPath := filepath.Join(h.unitDir, e.Name())\n524: \t\tmountData, rerr := os.ReadFile(mountPath)\n525: \t\tif rerr != nil || !strings.Contains(string(mountData), netUnitMarker) {\n", + "line": "524", + "column": "22", + "nosec": false, + "suppressions": null + }, + { + "severity": "MEDIUM", + "confidence": "HIGH", + "cwe": { + "id": "22", + "url": "https://cwe.mitre.org/data/definitions/22.html" + }, + "rule_id": "G304", + "details": "Potential file inclusion via variable", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-agent/internal/storage/intent.go", + "code": "50: \ts := \u0026IntentStore{path: path, m: map[string]DriveIntent{}}\n51: \tdata, err := os.ReadFile(path)\n52: \tif err != nil {\n", + "line": "51", + "column": "15", + "nosec": false, + "suppressions": null + }, + { + "severity": "MEDIUM", + "confidence": "HIGH", + "cwe": { + "id": "22", + "url": "https://cwe.mitre.org/data/definitions/22.html" + }, + "rule_id": "G304", + "details": "Potential file inclusion via variable", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-agent/internal/storage/hostread.go", + "code": "150: \t}\n151: \tb, err := os.ReadFile(filepath.Join(r.sysBlockDir(), disk, \"removable\"))\n152: \tif err != nil {\n", + "line": "151", + "column": "12", + "nosec": false, + "suppressions": null + }, + { + "severity": "MEDIUM", + "confidence": "HIGH", + "cwe": { + "id": "22", + "url": "https://cwe.mitre.org/data/definitions/22.html" + }, + "rule_id": "G304", + "details": "Potential file inclusion via variable", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-agent/internal/storage/hostread.go", + "code": "131: \t}\n132: \tb, err := os.ReadFile(filepath.Join(r.sysBlockDir(), disk, \"queue\", \"rotational\"))\n133: \tif err != nil {\n", + "line": "132", + "column": "12", + "nosec": false, + "suppressions": null + }, + { + "severity": "MEDIUM", + "confidence": "HIGH", + "cwe": { + "id": "22", + "url": "https://cwe.mitre.org/data/definitions/22.html" + }, + "rule_id": "G304", + "details": "Potential file inclusion via variable", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-agent/internal/storage/claim.go", + "code": "221: \tname := filepath.Base(wholeDisk)\n222: \tb, err := os.ReadFile(filepath.Join(\"/sys/block\", name, \"ro\"))\n223: \tif err != nil {\n", + "line": "222", + "column": "12", + "nosec": false, + "suppressions": null + }, + { + "severity": "MEDIUM", + "confidence": "HIGH", + "cwe": { + "id": "22", + "url": "https://cwe.mitre.org/data/definitions/22.html" + }, + "rule_id": "G304", + "details": "Potential file inclusion via variable", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-agent/internal/storage/candidates.go", + "code": "105: func readSysBlockModel(name string) string {\n106: \tb, err := os.ReadFile(filepath.Join(\"/sys/block\", name, \"device\", \"model\"))\n107: \tif err != nil {\n", + "line": "106", + "column": "12", + "nosec": false, + "suppressions": null + }, + { + "severity": "MEDIUM", + "confidence": "HIGH", + "cwe": { + "id": "22", + "url": "https://cwe.mitre.org/data/definitions/22.html" + }, + "rule_id": "G304", + "details": "Potential file inclusion via variable", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-agent/internal/storage/candidates.go", + "code": "92: func readSysBlockSize(name string) int64 {\n93: \tb, err := os.ReadFile(filepath.Join(\"/sys/block\", name, \"size\"))\n94: \tif err != nil {\n", + "line": "93", + "column": "12", + "nosec": false, + "suppressions": null + }, + { + "severity": "MEDIUM", + "confidence": "HIGH", + "cwe": { + "id": "22", + "url": "https://cwe.mitre.org/data/definitions/22.html" + }, + "rule_id": "G304", + "details": "Potential file inclusion via variable", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-agent/internal/selfupdate/executor.go", + "code": "212: \t}\n213: \tf, err := os.OpenFile(dest, os.O_CREATE|os.O_TRUNC|os.O_WRONLY, 0o644)\n214: \tif err != nil {\n", + "line": "213", + "column": "12", + "nosec": false, + "suppressions": null + }, + { + "severity": "MEDIUM", + "confidence": "HIGH", + "cwe": { + "id": "22", + "url": "https://cwe.mitre.org/data/definitions/22.html" + }, + "rule_id": "G304", + "details": "Potential file inclusion via variable", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-agent/internal/restorespace/restorespace.go", + "code": "49: \t}\n50: \treturn os.ReadFile(name)\n51: }\n", + "line": "50", + "column": "9", + "nosec": false, + "suppressions": null + }, + { + "severity": "MEDIUM", + "confidence": "HIGH", + "cwe": { + "id": "22", + "url": "https://cwe.mitre.org/data/definitions/22.html" + }, + "rule_id": "G304", + "details": "Potential file inclusion via variable", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-agent/internal/reconcile/journal.go", + "code": "197: func syncJournalDir(dir string) {\n198: \tif d, err := os.Open(dir); err == nil {\n199: \t\t_ = d.Sync()\n", + "line": "198", + "column": "15", + "nosec": false, + "suppressions": null + }, + { + "severity": "MEDIUM", + "confidence": "HIGH", + "cwe": { + "id": "22", + "url": "https://cwe.mitre.org/data/definitions/22.html" + }, + "rule_id": "G304", + "details": "Potential file inclusion via variable", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-agent/internal/reconcile/journal.go", + "code": "91: \t}\n92: \tf, err := os.OpenFile(path, os.O_CREATE|os.O_WRONLY|os.O_APPEND, 0o600)\n93: \tif err != nil {\n", + "line": "92", + "column": "12", + "nosec": false, + "suppressions": null + }, + { + "severity": "MEDIUM", + "confidence": "HIGH", + "cwe": { + "id": "22", + "url": "https://cwe.mitre.org/data/definitions/22.html" + }, + "rule_id": "G304", + "details": "Potential file inclusion via variable", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-agent/internal/osupdate/unsent.go", + "code": "90: \tfor _, f := range files {\n91: \t\tb, err := os.ReadFile(f)\n92: \t\tif err != nil {\n", + "line": "91", + "column": "13", + "nosec": false, + "suppressions": null + }, + { + "severity": "MEDIUM", + "confidence": "HIGH", + "cwe": { + "id": "22", + "url": "https://cwe.mitre.org/data/definitions/22.html" + }, + "rule_id": "G304", + "details": "Potential file inclusion via variable", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-agent/internal/osupdate/unsent.go", + "code": "37: \t_ = os.MkdirAll(dir, 0o700)\n38: \tf, err := os.OpenFile(filepath.Join(dir, \"pass.lock\"), os.O_CREATE|os.O_RDWR, 0o600)\n39: \tif err != nil {\n", + "line": "38", + "column": "12", + "nosec": false, + "suppressions": null + }, + { + "severity": "MEDIUM", + "confidence": "HIGH", + "cwe": { + "id": "22", + "url": "https://cwe.mitre.org/data/definitions/22.html" + }, + "rule_id": "G304", + "details": "Potential file inclusion via variable", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-agent/internal/osupdate/leg.go", + "code": "260: func LoadSavedBlock(dir string) (b *hub.WireOSUpdate, savedAt time.Time, ok bool) {\n261: \traw, err := os.ReadFile(filepath.Join(dir, SavedBlockFile))\n262: \tif err != nil {\n", + "line": "261", + "column": "14", + "nosec": false, + "suppressions": null + }, + { + "severity": "MEDIUM", + "confidence": "HIGH", + "cwe": { + "id": "22", + "url": "https://cwe.mitre.org/data/definitions/22.html" + }, + "rule_id": "G304", + "details": "Potential file inclusion via variable", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-agent/internal/osupdate/bundle.go", + "code": "142: \t}\n143: \tf, err := os.OpenFile(dest, os.O_CREATE|os.O_TRUNC|os.O_WRONLY, 0o600)\n144: \tif err != nil {\n", + "line": "143", + "column": "12", + "nosec": false, + "suppressions": null + }, + { + "severity": "MEDIUM", + "confidence": "HIGH", + "cwe": { + "id": "22", + "url": "https://cwe.mitre.org/data/definitions/22.html" + }, + "rule_id": "G304", + "details": "Potential file inclusion via variable", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-agent/internal/mgmtplane/mgmtplane.go", + "code": "96: func readMarkerFile(path string) (string, bool) {\n97: \traw, err := os.ReadFile(path)\n98: \tif err != nil {\n", + "line": "97", + "column": "14", + "nosec": false, + "suppressions": null + }, + { + "severity": "MEDIUM", + "confidence": "HIGH", + "cwe": { + "id": "22", + "url": "https://cwe.mitre.org/data/definitions/22.html" + }, + "rule_id": "G304", + "details": "Potential file inclusion via variable", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-agent/internal/localapi/tokenstore.go", + "code": "226: func syncDir(dir string) {\n227: \tif d, err := os.Open(dir); err == nil {\n228: \t\t_ = d.Sync()\n", + "line": "227", + "column": "15", + "nosec": false, + "suppressions": null + }, + { + "severity": "MEDIUM", + "confidence": "HIGH", + "cwe": { + "id": "22", + "url": "https://cwe.mitre.org/data/definitions/22.html" + }, + "rule_id": "G304", + "details": "Potential file inclusion via variable", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-agent/internal/localapi/tokenstore.go", + "code": "66: \t}\n67: \tf, err := os.OpenFile(path, os.O_CREATE|os.O_WRONLY|os.O_APPEND, 0o600)\n68: \tif err != nil {\n", + "line": "67", + "column": "12", + "nosec": false, + "suppressions": null + }, + { + "severity": "MEDIUM", + "confidence": "HIGH", + "cwe": { + "id": "22", + "url": "https://cwe.mitre.org/data/definitions/22.html" + }, + "rule_id": "G304", + "details": "Potential file inclusion via variable", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-agent/internal/localapi/intermediary.go", + "code": "309: func procStarttime(pid string) string {\n310: \tdata, err := os.ReadFile(\"/proc/\" + pid + \"/stat\")\n311: \tif err != nil {\n", + "line": "310", + "column": "15", + "nosec": false, + "suppressions": null + }, + { + "severity": "MEDIUM", + "confidence": "HIGH", + "cwe": { + "id": "22", + "url": "https://cwe.mitre.org/data/definitions/22.html" + }, + "rule_id": "G304", + "details": "Potential file inclusion via variable", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-agent/internal/localapi/intermediary.go", + "code": "159: \t}\n160: \tif cur, err := os.ReadFile(scriptPath); err != nil || string(cur) != sharedParentScript {\n161: \t\treturn true\n", + "line": "160", + "column": "17", + "nosec": false, + "suppressions": null + }, + { + "severity": "MEDIUM", + "confidence": "HIGH", + "cwe": { + "id": "22", + "url": "https://cwe.mitre.org/data/definitions/22.html" + }, + "rule_id": "G304", + "details": "Potential file inclusion via variable", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-agent/internal/localapi/intermediary.go", + "code": "156: func sharedParentInstallStale(unitPath, scriptPath string) bool {\n157: \tif cur, err := os.ReadFile(unitPath); err != nil || string(cur) != sharedParentUnit {\n158: \t\treturn true\n", + "line": "157", + "column": "17", + "nosec": false, + "suppressions": null + }, + { + "severity": "MEDIUM", + "confidence": "HIGH", + "cwe": { + "id": "22", + "url": "https://cwe.mitre.org/data/definitions/22.html" + }, + "rule_id": "G304", + "details": "Potential file inclusion via variable", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-agent/internal/localapi/guestbindstore.go", + "code": "31: \ts := \u0026GuestBindStore{path: path, m: map[int][]string{}}\n32: \tdata, err := os.ReadFile(path)\n33: \tif err != nil {\n", + "line": "32", + "column": "15", + "nosec": false, + "suppressions": null + }, + { + "severity": "MEDIUM", + "confidence": "HIGH", + "cwe": { + "id": "22", + "url": "https://cwe.mitre.org/data/definitions/22.html" + }, + "rule_id": "G304", + "details": "Potential file inclusion via variable", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-agent/internal/localapi/formatjob.go", + "code": "49: \ts := \u0026FormatJobStore{path: path}\n50: \tdata, err := os.ReadFile(path)\n51: \tif err != nil {\n", + "line": "50", + "column": "15", + "nosec": false, + "suppressions": null + }, + { + "severity": "MEDIUM", + "confidence": "HIGH", + "cwe": { + "id": "22", + "url": "https://cwe.mitre.org/data/definitions/22.html" + }, + "rule_id": "G304", + "details": "Potential file inclusion via variable", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-agent/internal/localapi/crashguard.go", + "code": "52: func readCrashGuardState(path string) (resp CrashGuardResponse, ok bool, reason string) {\n53: \tf, err := os.Open(path)\n54: \tif err != nil {\n", + "line": "53", + "column": "12", + "nosec": false, + "suppressions": null + }, + { + "severity": "MEDIUM", + "confidence": "HIGH", + "cwe": { + "id": "22", + "url": "https://cwe.mitre.org/data/definitions/22.html" + }, + "rule_id": "G304", + "details": "Potential file inclusion via variable", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-agent/internal/localapi/backup_target.go", + "code": "190: \t}\n191: \tf, err := os.OpenFile(path, os.O_WRONLY|os.O_TRUNC, st.Mode().Perm())\n192: \tif err != nil {\n", + "line": "191", + "column": "12", + "nosec": false, + "suppressions": null + }, + { + "severity": "MEDIUM", + "confidence": "HIGH", + "cwe": { + "id": "22", + "url": "https://cwe.mitre.org/data/definitions/22.html" + }, + "rule_id": "G304", + "details": "Potential file inclusion via variable", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-agent/internal/localapi/backup_target.go", + "code": "154: \t}\n155: \traw, err := os.ReadFile(path)\n156: \tif err != nil {\n", + "line": "155", + "column": "14", + "nosec": false, + "suppressions": null + }, + { + "severity": "MEDIUM", + "confidence": "HIGH", + "cwe": { + "id": "22", + "url": "https://cwe.mitre.org/data/definitions/22.html" + }, + "rule_id": "G304", + "details": "Potential file inclusion via variable", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-agent/internal/lanresolver/loop.go", + "code": "103: func readCustomerID(path string) string {\n104: \tdata, err := os.ReadFile(path)\n105: \tif err != nil {\n", + "line": "104", + "column": "15", + "nosec": false, + "suppressions": null + }, + { + "severity": "MEDIUM", + "confidence": "HIGH", + "cwe": { + "id": "22", + "url": "https://cwe.mitre.org/data/definitions/22.html" + }, + "rule_id": "G304", + "details": "Potential file inclusion via variable", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-agent/internal/lanresolver/lanresolver.go", + "code": "277: func (m *Manager) writeFileIfChanged(ctx context.Context, path, content, mode string) (bool, error) {\n278: \tif cur, err := os.ReadFile(path); err == nil \u0026\u0026 string(cur) == content {\n279: \t\treturn false, nil\n", + "line": "278", + "column": "17", + "nosec": false, + "suppressions": null + }, + { + "severity": "MEDIUM", + "confidence": "HIGH", + "cwe": { + "id": "22", + "url": "https://cwe.mitre.org/data/definitions/22.html" + }, + "rule_id": "G304", + "details": "Potential file inclusion via variable", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-agent/internal/hub/cputemp.go", + "code": "173: func readFileTrim(path string) string {\n174: \tb, err := os.ReadFile(path)\n175: \tif err != nil {\n", + "line": "174", + "column": "12", + "nosec": false, + "suppressions": null + }, + { + "severity": "MEDIUM", + "confidence": "HIGH", + "cwe": { + "id": "22", + "url": "https://cwe.mitre.org/data/definitions/22.html" + }, + "rule_id": "G304", + "details": "Potential file inclusion via variable", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-agent/internal/hub/collect.go", + "code": "500: func fileSHA256(path string) string {\n501: \tf, err := os.Open(path)\n502: \tif err != nil {\n", + "line": "501", + "column": "12", + "nosec": false, + "suppressions": null + }, + { + "severity": "MEDIUM", + "confidence": "HIGH", + "cwe": { + "id": "22", + "url": "https://cwe.mitre.org/data/definitions/22.html" + }, + "rule_id": "G304", + "details": "Potential file inclusion via variable", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-agent/internal/hub/collect.go", + "code": "311: \t}\n312: \tb, err := os.ReadFile(path)\n313: \tif os.IsNotExist(err) {\n", + "line": "312", + "column": "12", + "nosec": false, + "suppressions": null + }, + { + "severity": "MEDIUM", + "confidence": "HIGH", + "cwe": { + "id": "22", + "url": "https://cwe.mitre.org/data/definitions/22.html" + }, + "rule_id": "G304", + "details": "Potential file inclusion via variable", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-agent/internal/guesthook/netreassert.go", + "code": "82: \t}\n83: \tdata, err := os.ReadFile(\"/proc/\" + pid + \"/mountinfo\")\n84: \tif err != nil {\n", + "line": "83", + "column": "15", + "nosec": false, + "suppressions": null + }, + { + "severity": "MEDIUM", + "confidence": "HIGH", + "cwe": { + "id": "22", + "url": "https://cwe.mitre.org/data/definitions/22.html" + }, + "rule_id": "G304", + "details": "Potential file inclusion via variable", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-agent/internal/guesthook/install.go", + "code": "54: \t}\n55: \tb, err := os.ReadFile(path)\n56: \tif err != nil {\n", + "line": "55", + "column": "12", + "nosec": false, + "suppressions": null + }, + { + "severity": "MEDIUM", + "confidence": "HIGH", + "cwe": { + "id": "22", + "url": "https://cwe.mitre.org/data/definitions/22.html" + }, + "rule_id": "G304", + "details": "Potential file inclusion via variable", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-agent/internal/guesthook/heal.go", + "code": "116: func Heal(confPath string) (created []string, err error) {\n117: \tdata, readErr := os.ReadFile(confPath)\n118: \tif readErr != nil {\n", + "line": "117", + "column": "19", + "nosec": false, + "suppressions": null + }, + { + "severity": "MEDIUM", + "confidence": "HIGH", + "cwe": { + "id": "22", + "url": "https://cwe.mitre.org/data/definitions/22.html" + }, + "rule_id": "G304", + "details": "Potential file inclusion via variable", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-agent/internal/escrow/identity.go", + "code": "160: \t}\n161: \treturn os.ReadFile(out)\n162: }\n", + "line": "161", + "column": "9", + "nosec": false, + "suppressions": null + }, + { + "severity": "MEDIUM", + "confidence": "HIGH", + "cwe": { + "id": "22", + "url": "https://cwe.mitre.org/data/definitions/22.html" + }, + "rule_id": "G304", + "details": "Potential file inclusion via variable", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-agent/internal/escrow/identity.go", + "code": "135: \t}\n136: \treturn os.ReadFile(out)\n137: }\n", + "line": "136", + "column": "9", + "nosec": false, + "suppressions": null + }, + { + "severity": "MEDIUM", + "confidence": "HIGH", + "cwe": { + "id": "22", + "url": "https://cwe.mitre.org/data/definitions/22.html" + }, + "rule_id": "G304", + "details": "Potential file inclusion via variable", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-agent/internal/escrow/escrow.go", + "code": "194: func copyFile(src, dst string, mode os.FileMode) error {\n195: \tb, err := os.ReadFile(src)\n196: \tif err != nil {\n", + "line": "195", + "column": "12", + "nosec": false, + "suppressions": null + }, + { + "severity": "MEDIUM", + "confidence": "HIGH", + "cwe": { + "id": "22", + "url": "https://cwe.mitre.org/data/definitions/22.html" + }, + "rule_id": "G304", + "details": "Potential file inclusion via variable", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-agent/internal/escrow/escrow.go", + "code": "112: \n113: \tblob, err := os.ReadFile(blobPath)\n114: \tif err != nil {\n", + "line": "113", + "column": "15", + "nosec": false, + "suppressions": null + }, + { + "severity": "MEDIUM", + "confidence": "HIGH", + "cwe": { + "id": "22", + "url": "https://cwe.mitre.org/data/definitions/22.html" + }, + "rule_id": "G304", + "details": "Potential file inclusion via variable", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-agent/internal/escrow/consume.go", + "code": "102: \ttmp := dest + \".tmp-\" + hex.EncodeToString(rnd[:])\n103: \tf, err := os.OpenFile(tmp, os.O_CREATE|os.O_WRONLY|os.O_EXCL, 0o600)\n104: \tif err != nil {\n", + "line": "103", + "column": "12", + "nosec": false, + "suppressions": null + }, + { + "severity": "MEDIUM", + "confidence": "HIGH", + "cwe": { + "id": "22", + "url": "https://cwe.mitre.org/data/definitions/22.html" + }, + "rule_id": "G304", + "details": "Potential file inclusion via variable", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-agent/internal/escrow/consume.go", + "code": "95: \t}\n96: \tb, err := os.ReadFile(recovered)\n97: \tif err != nil {\n", + "line": "96", + "column": "12", + "nosec": false, + "suppressions": null + }, + { + "severity": "MEDIUM", + "confidence": "HIGH", + "cwe": { + "id": "22", + "url": "https://cwe.mitre.org/data/definitions/22.html" + }, + "rule_id": "G304", + "details": "Potential file inclusion via variable", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-agent/internal/config/config.go", + "code": "858: \tif path != \"\" {\n859: \t\tb, err := os.ReadFile(path)\n860: \t\tif err != nil {\n", + "line": "859", + "column": "13", + "nosec": false, + "suppressions": null + }, + { + "severity": "MEDIUM", + "confidence": "HIGH", + "cwe": { + "id": "22", + "url": "https://cwe.mitre.org/data/definitions/22.html" + }, + "rule_id": "G304", + "details": "Potential file inclusion via variable", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-agent/internal/backup/restoretest_state.go", + "code": "108: \ts := \u0026RestoreTestState{path: path, last: map[string]provenTier{}}\n109: \tdata, err := os.ReadFile(path)\n110: \tif err != nil {\n", + "line": "109", + "column": "15", + "nosec": false, + "suppressions": null + }, + { + "severity": "MEDIUM", + "confidence": "HIGH", + "cwe": { + "id": "22", + "url": "https://cwe.mitre.org/data/definitions/22.html" + }, + "rule_id": "G304", + "details": "Potential file inclusion via variable", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-agent/internal/backup/backup_state.go", + "code": "56: \ts := \u0026BackupSuccessState{path: path, last: map[string]savedSuccess{}}\n57: \tdata, err := os.ReadFile(path)\n58: \tif err != nil {\n", + "line": "57", + "column": "15", + "nosec": false, + "suppressions": null + }, + { + "severity": "MEDIUM", + "confidence": "HIGH", + "cwe": { + "id": "22", + "url": "https://cwe.mitre.org/data/definitions/22.html" + }, + "rule_id": "G304", + "details": "Potential file inclusion via variable", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-agent/internal/authz/noncestore.go", + "code": "190: func syncDir(dir string) {\n191: \tif d, err := os.Open(dir); err == nil {\n192: \t\t_ = d.Sync()\n", + "line": "191", + "column": "15", + "nosec": false, + "suppressions": null + }, + { + "severity": "MEDIUM", + "confidence": "HIGH", + "cwe": { + "id": "22", + "url": "https://cwe.mitre.org/data/definitions/22.html" + }, + "rule_id": "G304", + "details": "Potential file inclusion via variable", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-agent/internal/authz/noncestore.go", + "code": "172: \t}\n173: \tif tf, err := os.OpenFile(tmp, os.O_WRONLY, 0o600); err == nil {\n174: \t\t_ = tf.Sync()\n", + "line": "173", + "column": "16", + "nosec": false, + "suppressions": null + }, + { + "severity": "MEDIUM", + "confidence": "HIGH", + "cwe": { + "id": "22", + "url": "https://cwe.mitre.org/data/definitions/22.html" + }, + "rule_id": "G304", + "details": "Potential file inclusion via variable", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-agent/internal/authz/noncestore.go", + "code": "82: \t}\n83: \tf, err := os.OpenFile(path, os.O_CREATE|os.O_WRONLY|os.O_APPEND, 0o600)\n84: \tif err != nil {\n", + "line": "83", + "column": "12", + "nosec": false, + "suppressions": null + }, + { + "severity": "MEDIUM", + "confidence": "HIGH", + "cwe": { + "id": "22", + "url": "https://cwe.mitre.org/data/definitions/22.html" + }, + "rule_id": "G304", + "details": "Potential file inclusion via variable", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-agent/cmd/felhom-opsign/main.go", + "code": "200: \t}\n201: \tsig, err := os.ReadFile(msgPath + \".sig\")\n202: \tif err != nil {\n", + "line": "201", + "column": "14", + "nosec": false, + "suppressions": null + }, + { + "severity": "MEDIUM", + "confidence": "HIGH", + "cwe": { + "id": "22", + "url": "https://cwe.mitre.org/data/definitions/22.html" + }, + "rule_id": "G304", + "details": "Potential file inclusion via variable", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-agent/cmd/felhom-agent/main.go", + "code": "3064: \t}\n3065: \tblob, err := os.ReadFile(blobPath)\n3066: \tif err != nil {\n", + "line": "3065", + "column": "15", + "nosec": false, + "suppressions": null + }, + { + "severity": "MEDIUM", + "confidence": "HIGH", + "cwe": { + "id": "22", + "url": "https://cwe.mitre.org/data/definitions/22.html" + }, + "rule_id": "G304", + "details": "Potential file inclusion via variable", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-agent/cmd/felhom-agent/main.go", + "code": "3031: \t}\n3032: \tblob, err := os.ReadFile(blobPath)\n3033: \tif err != nil {\n", + "line": "3032", + "column": "15", + "nosec": false, + "suppressions": null + }, + { + "severity": "MEDIUM", + "confidence": "HIGH", + "cwe": { + "id": "22", + "url": "https://cwe.mitre.org/data/definitions/22.html" + }, + "rule_id": "G304", + "details": "Potential file inclusion via variable", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-agent/cmd/felhom-agent/main.go", + "code": "1690: func readTrimmed(path string) (string, error) {\n1691: \tb, err := os.ReadFile(path)\n1692: \tif err != nil {\n", + "line": "1691", + "column": "12", + "nosec": false, + "suppressions": null + }, + { + "severity": "MEDIUM", + "confidence": "HIGH", + "cwe": { + "id": "276", + "url": "https://cwe.mitre.org/data/definitions/276.html" + }, + "rule_id": "G302", + "details": "Expect file permissions to be 0600 or less", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-agent/internal/selfupdate/executor.go", + "code": "212: \t}\n213: \tf, err := os.OpenFile(dest, os.O_CREATE|os.O_TRUNC|os.O_WRONLY, 0o644)\n214: \tif err != nil {\n", + "line": "213", + "column": "12", + "nosec": false, + "suppressions": null + }, + { + "severity": "MEDIUM", + "confidence": "HIGH", + "cwe": { + "id": "276", + "url": "https://cwe.mitre.org/data/definitions/276.html" + }, + "rule_id": "G302", + "details": "Expect file permissions to be 0600 or less", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-agent/internal/selfupdate/executor.go", + "code": "126: \t}\n127: \tif err := os.Chmod(staged, 0o755); err != nil {\n128: \t\t_ = os.Remove(staged)\n", + "line": "127", + "column": "12", + "nosec": false, + "suppressions": null + }, + { + "severity": "MEDIUM", + "confidence": "HIGH", + "cwe": { + "id": "276", + "url": "https://cwe.mitre.org/data/definitions/276.html" + }, + "rule_id": "G301", + "details": "Expect directory permissions to be 0750 or less", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-agent/internal/storage/intent.go", + "code": "121: \t}\n122: \tif err := os.MkdirAll(filepath.Dir(s.path), 0o755); err != nil {\n123: \t\treturn err\n", + "line": "122", + "column": "12", + "nosec": false, + "suppressions": null + }, + { + "severity": "MEDIUM", + "confidence": "HIGH", + "cwe": { + "id": "276", + "url": "https://cwe.mitre.org/data/definitions/276.html" + }, + "rule_id": "G301", + "details": "Expect directory permissions to be 0750 or less", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-agent/internal/localapi/guestbindstore.go", + "code": "124: \t}\n125: \tif err := os.MkdirAll(filepath.Dir(s.path), 0o755); err != nil {\n126: \t\treturn err\n", + "line": "125", + "column": "12", + "nosec": false, + "suppressions": null + }, + { + "severity": "MEDIUM", + "confidence": "HIGH", + "cwe": { + "id": "276", + "url": "https://cwe.mitre.org/data/definitions/276.html" + }, + "rule_id": "G301", + "details": "Expect directory permissions to be 0750 or less", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-agent/internal/localapi/formatjob.go", + "code": "85: \t}\n86: \tif err := os.MkdirAll(filepath.Dir(s.path), 0o755); err != nil {\n87: \t\treturn err\n", + "line": "86", + "column": "12", + "nosec": false, + "suppressions": null + }, + { + "severity": "MEDIUM", + "confidence": "HIGH", + "cwe": { + "id": "276", + "url": "https://cwe.mitre.org/data/definitions/276.html" + }, + "rule_id": "G301", + "details": "Expect directory permissions to be 0750 or less", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-agent/internal/localapi/controllerswap.go", + "code": "97: \tst.UpdatedAt = time.Now().UTC().Format(time.RFC3339)\n98: \tif err := os.MkdirAll(c.stateDir, 0o755); err != nil {\n99: \t\tc.logger.Error(\"controller-swap: mkdir state dir\", \"err\", err)\n", + "line": "98", + "column": "12", + "nosec": false, + "suppressions": null + }, + { + "severity": "MEDIUM", + "confidence": "HIGH", + "cwe": { + "id": "276", + "url": "https://cwe.mitre.org/data/definitions/276.html" + }, + "rule_id": "G301", + "details": "Expect directory permissions to be 0750 or less", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-agent/internal/fstrim/fstrim.go", + "code": "143: \t}\n144: \tif err := os.MkdirAll(filepath.Dir(t.statePath), 0o755); err != nil {\n145: \t\treturn err\n", + "line": "144", + "column": "12", + "nosec": false, + "suppressions": null + }, + { + "severity": "MEDIUM", + "confidence": "HIGH", + "cwe": { + "id": "276", + "url": "https://cwe.mitre.org/data/definitions/276.html" + }, + "rule_id": "G301", + "details": "Expect directory permissions to be 0750 or less", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-agent/internal/backup/restoretest_state.go", + "code": "279: \t}\n280: \tif err := os.MkdirAll(filepath.Dir(s.path), 0o755); err != nil {\n281: \t\treturn err\n", + "line": "280", + "column": "12", + "nosec": false, + "suppressions": null + }, + { + "severity": "MEDIUM", + "confidence": "HIGH", + "cwe": { + "id": "276", + "url": "https://cwe.mitre.org/data/definitions/276.html" + }, + "rule_id": "G301", + "details": "Expect directory permissions to be 0750 or less", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-agent/internal/backup/backup_state.go", + "code": "144: \t}\n145: \tif err := os.MkdirAll(filepath.Dir(s.path), 0o755); err != nil {\n146: \t\treturn err\n", + "line": "145", + "column": "12", + "nosec": false, + "suppressions": null + }, + { + "severity": "MEDIUM", + "confidence": "HIGH", + "cwe": { + "id": "276", + "url": "https://cwe.mitre.org/data/definitions/276.html" + }, + "rule_id": "G306", + "details": "Expect WriteFile permissions to be 0600 or less", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-agent/internal/storage/netmount.go", + "code": "412: \tstagePath := filepath.Join(h.stageDir, unitName)\n413: \tif err := os.WriteFile(stagePath, []byte(content), 0o644); err != nil {\n414: \t\treturn fmt.Errorf(\"netmount: staging unit %s: %w\", unitName, err)\n", + "line": "413", + "column": "12", + "nosec": false, + "suppressions": null + }, + { + "severity": "MEDIUM", + "confidence": "HIGH", + "cwe": { + "id": "276", + "url": "https://cwe.mitre.org/data/definitions/276.html" + }, + "rule_id": "G306", + "details": "Expect WriteFile permissions to be 0600 or less", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-agent/internal/storage/hostops.go", + "code": "255: \tstagePath := filepath.Join(h.stageDir, unitName)\n256: \tif err := os.WriteFile(stagePath, []byte(content), 0o644); err != nil {\n257: \t\treturn fmt.Errorf(\"storage: staging unit: %w\", err)\n", + "line": "256", + "column": "12", + "nosec": false, + "suppressions": null + }, + { + "severity": "MEDIUM", + "confidence": "HIGH", + "cwe": { + "id": "276", + "url": "https://cwe.mitre.org/data/definitions/276.html" + }, + "rule_id": "G306", + "details": "Expect WriteFile permissions to be 0600 or less", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-agent/internal/localapi/cert.go", + "code": "96: \tkeyPEM := pem.EncodeToMemory(\u0026pem.Block{Type: \"EC PRIVATE KEY\", Bytes: keyDER})\n97: \tif err := os.WriteFile(certPath, certPEM, 0o644); err != nil {\n98: \t\treturn tls.Certificate{}, \"\", fmt.Errorf(\"localapi: write cert: %w\", err)\n", + "line": "97", + "column": "12", + "nosec": false, + "suppressions": null + }, + { + "severity": "MEDIUM", + "confidence": "HIGH", + "cwe": { + "id": "276", + "url": "https://cwe.mitre.org/data/definitions/276.html" + }, + "rule_id": "G306", + "details": "Expect WriteFile permissions to be 0600 or less", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-agent/internal/felhomsshd/health.go", + "code": "45: \t// record the heal (best-effort; a failed marker write never fails the heal)\n46: \t_ = os.WriteFile(HealMarkerPath, []byte(now.UTC().Format(time.RFC3339)+\"\\n\"), 0o644)\n47: \tm.logger.Warn(\"felhomsshd: was down with a valid config — restarted (heal)\", \"port\", port)\n", + "line": "46", + "column": "6", + "nosec": false, + "suppressions": null + }, + { + "severity": "LOW", + "confidence": "HIGH", + "cwe": { + "id": "703", + "url": "https://cwe.mitre.org/data/definitions/703.html" + }, + "rule_id": "G104", + "details": "Errors unhandled", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-agent/internal/wgtunnel/manager.go", + "code": "460: \t}\n461: \tos.Remove(m.lastAppliedPath())\n462: }\n", + "line": "461", + "column": "2", + "nosec": false, + "suppressions": null + }, + { + "severity": "LOW", + "confidence": "HIGH", + "cwe": { + "id": "703", + "url": "https://cwe.mitre.org/data/definitions/703.html" + }, + "rule_id": "G104", + "details": "Errors unhandled", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-agent/internal/storage/intent.go", + "code": "126: \tif err := os.WriteFile(tmp, data, 0o600); err != nil {\n127: \t\tos.Remove(tmp)\n128: \t\treturn err\n", + "line": "127", + "column": "3", + "nosec": false, + "suppressions": null + }, + { + "severity": "LOW", + "confidence": "HIGH", + "cwe": { + "id": "703", + "url": "https://cwe.mitre.org/data/definitions/703.html" + }, + "rule_id": "G104", + "details": "Errors unhandled", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-agent/internal/selfupdate/executor.go", + "code": "222: \tif err := f.Sync(); err != nil {\n223: \t\tf.Close()\n224: \t\treturn \"\", err\n", + "line": "223", + "column": "3", + "nosec": false, + "suppressions": null + }, + { + "severity": "LOW", + "confidence": "HIGH", + "cwe": { + "id": "703", + "url": "https://cwe.mitre.org/data/definitions/703.html" + }, + "rule_id": "G104", + "details": "Errors unhandled", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-agent/internal/selfupdate/executor.go", + "code": "218: \tif _, err := io.Copy(io.MultiWriter(f, h), resp.Body); err != nil {\n219: \t\tf.Close()\n220: \t\treturn \"\", err\n", + "line": "219", + "column": "3", + "nosec": false, + "suppressions": null + }, + { + "severity": "LOW", + "confidence": "HIGH", + "cwe": { + "id": "703", + "url": "https://cwe.mitre.org/data/definitions/703.html" + }, + "rule_id": "G104", + "details": "Errors unhandled", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-agent/internal/poke/poke.go", + "code": "153: \t\t\u003c-ctx.Done()\n154: \t\tpc.Close()\n155: \t}()\n", + "line": "154", + "column": "3", + "nosec": false, + "suppressions": null + }, + { + "severity": "LOW", + "confidence": "HIGH", + "cwe": { + "id": "703", + "url": "https://cwe.mitre.org/data/definitions/703.html" + }, + "rule_id": "G104", + "details": "Errors unhandled", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-agent/internal/pbsdr/manager.go", + "code": "549: \tif _, err := f.Write(out); err != nil {\n550: \t\tf.Close()\n551: \t\treturn err\n", + "line": "550", + "column": "3", + "nosec": false, + "suppressions": null + }, + { + "severity": "LOW", + "confidence": "HIGH", + "cwe": { + "id": "703", + "url": "https://cwe.mitre.org/data/definitions/703.html" + }, + "rule_id": "G104", + "details": "Errors unhandled", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-agent/internal/pbsdr/manager.go", + "code": "460: \t}\n461: \tos.Remove(m.consumedFailedPath())\n462: \tmsg := \"\"\n", + "line": "461", + "column": "2", + "nosec": false, + "suppressions": null + }, + { + "severity": "LOW", + "confidence": "HIGH", + "cwe": { + "id": "703", + "url": "https://cwe.mitre.org/data/definitions/703.html" + }, + "rule_id": "G104", + "details": "Errors unhandled", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-agent/internal/pbs/probe.go", + "code": "44: \t}\n45: \tconn.Close()\n46: \treturn nil\n", + "line": "45", + "column": "2", + "nosec": false, + "suppressions": null + }, + { + "severity": "LOW", + "confidence": "HIGH", + "cwe": { + "id": "703", + "url": "https://cwe.mitre.org/data/definitions/703.html" + }, + "rule_id": "G104", + "details": "Errors unhandled", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-agent/internal/pbs/probe.go", + "code": "38: \t} else {\n39: \t\traw.SetDeadline(time.Now().Add(15 * time.Second))\n40: \t}\n", + "line": "39", + "column": "3", + "nosec": false, + "suppressions": null + }, + { + "severity": "LOW", + "confidence": "HIGH", + "cwe": { + "id": "703", + "url": "https://cwe.mitre.org/data/definitions/703.html" + }, + "rule_id": "G104", + "details": "Errors unhandled", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-agent/internal/pbs/probe.go", + "code": "36: \tif dl, ok := ctx.Deadline(); ok {\n37: \t\traw.SetDeadline(dl)\n38: \t} else {\n", + "line": "37", + "column": "3", + "nosec": false, + "suppressions": null + }, + { + "severity": "LOW", + "confidence": "HIGH", + "cwe": { + "id": "703", + "url": "https://cwe.mitre.org/data/definitions/703.html" + }, + "rule_id": "G104", + "details": "Errors unhandled", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-agent/internal/osupdate/unsent.go", + "code": "50: \t}\n51: \treturn func() { _ = syscall.Flock(int(f.Fd()), syscall.LOCK_UN); f.Close() }, true\n52: }\n", + "line": "51", + "column": "67", + "nosec": false, + "suppressions": null + }, + { + "severity": "LOW", + "confidence": "HIGH", + "cwe": { + "id": "703", + "url": "https://cwe.mitre.org/data/definitions/703.html" + }, + "rule_id": "G104", + "details": "Errors unhandled", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-agent/internal/osupdate/unsent.go", + "code": "47: \tif err := syscall.Flock(int(f.Fd()), how); err != nil {\n48: \t\tf.Close()\n49: \t\treturn func() {}, false\n", + "line": "48", + "column": "3", + "nosec": false, + "suppressions": null + }, + { + "severity": "LOW", + "confidence": "HIGH", + "cwe": { + "id": "703", + "url": "https://cwe.mitre.org/data/definitions/703.html" + }, + "rule_id": "G104", + "details": "Errors unhandled", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-agent/internal/osupdate/bundle.go", + "code": "149: \tif _, err := io.Copy(io.MultiWriter(f, h), io.LimitReader(resp.Body, 4*1024*1024+1)); err != nil {\n150: \t\tf.Close()\n151: \t\treturn \"\", err\n", + "line": "150", + "column": "3", + "nosec": false, + "suppressions": null + }, + { + "severity": "LOW", + "confidence": "HIGH", + "cwe": { + "id": "703", + "url": "https://cwe.mitre.org/data/definitions/703.html" + }, + "rule_id": "G104", + "details": "Errors unhandled", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-agent/internal/localapi/guestbindstore.go", + "code": "129: \tif err := os.WriteFile(tmp, data, 0o600); err != nil {\n130: \t\tos.Remove(tmp)\n131: \t\treturn err\n", + "line": "130", + "column": "3", + "nosec": false, + "suppressions": null + }, + { + "severity": "LOW", + "confidence": "HIGH", + "cwe": { + "id": "703", + "url": "https://cwe.mitre.org/data/definitions/703.html" + }, + "rule_id": "G104", + "details": "Errors unhandled", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-agent/internal/localapi/formatjob.go", + "code": "90: \tif err := os.WriteFile(tmp, data, 0o600); err != nil {\n91: \t\tos.Remove(tmp)\n92: \t\treturn err\n", + "line": "91", + "column": "3", + "nosec": false, + "suppressions": null + }, + { + "severity": "LOW", + "confidence": "HIGH", + "cwe": { + "id": "703", + "url": "https://cwe.mitre.org/data/definitions/703.html" + }, + "rule_id": "G104", + "details": "Errors unhandled", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-agent/internal/localapi/debuglogs.go", + "code": "33: \t\t\tw.Write([]byte(line))\n34: \t\t\tw.Write([]byte(\"\\n\"))\n35: \t\t}\n", + "line": "34", + "column": "4", + "nosec": false, + "suppressions": null + }, + { + "severity": "LOW", + "confidence": "HIGH", + "cwe": { + "id": "703", + "url": "https://cwe.mitre.org/data/definitions/703.html" + }, + "rule_id": "G104", + "details": "Errors unhandled", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-agent/internal/localapi/debuglogs.go", + "code": "32: \t\tfor _, line := range s.logRing.Lines(0) {\n33: \t\t\tw.Write([]byte(line))\n34: \t\t\tw.Write([]byte(\"\\n\"))\n", + "line": "33", + "column": "4", + "nosec": false, + "suppressions": null + }, + { + "severity": "LOW", + "confidence": "HIGH", + "cwe": { + "id": "703", + "url": "https://cwe.mitre.org/data/definitions/703.html" + }, + "rule_id": "G104", + "details": "Errors unhandled", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-agent/internal/localapi/backup_target.go", + "code": "195: \tif _, err := f.Write(out); err != nil {\n196: \t\tf.Close()\n197: \t\treturn err\n", + "line": "196", + "column": "3", + "nosec": false, + "suppressions": null + }, + { + "severity": "LOW", + "confidence": "HIGH", + "cwe": { + "id": "703", + "url": "https://cwe.mitre.org/data/definitions/703.html" + }, + "rule_id": "G104", + "details": "Errors unhandled", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-agent/internal/lanresolver/lanresolver.go", + "code": "290: \t}\n291: \ttmp.Close()\n292: \t// R-861 (v0.146.0): a dnsmasq drop-in reaches /etc/dnsmasq.d only through the root checker, which allows exactly\n", + "line": "291", + "column": "2", + "nosec": false, + "suppressions": null + }, + { + "severity": "LOW", + "confidence": "HIGH", + "cwe": { + "id": "703", + "url": "https://cwe.mitre.org/data/definitions/703.html" + }, + "rule_id": "G104", + "details": "Errors unhandled", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-agent/internal/lanresolver/lanresolver.go", + "code": "287: \tif _, err := tmp.WriteString(content); err != nil {\n288: \t\ttmp.Close()\n289: \t\treturn false, fmt.Errorf(\"write temp: %w\", err)\n", + "line": "288", + "column": "3", + "nosec": false, + "suppressions": null + }, + { + "severity": "LOW", + "confidence": "HIGH", + "cwe": { + "id": "703", + "url": "https://cwe.mitre.org/data/definitions/703.html" + }, + "rule_id": "G104", + "details": "Errors unhandled", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-agent/internal/fstrim/fstrim.go", + "code": "148: \tif err := os.WriteFile(tmp, data, 0o600); err != nil {\n149: \t\tos.Remove(tmp)\n150: \t\treturn err\n", + "line": "149", + "column": "3", + "nosec": false, + "suppressions": null + }, + { + "severity": "LOW", + "confidence": "HIGH", + "cwe": { + "id": "703", + "url": "https://cwe.mitre.org/data/definitions/703.html" + }, + "rule_id": "G104", + "details": "Errors unhandled", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-agent/internal/escrow/identity.go", + "code": "208: \t\tfd, err := syscall.Openat(dirfd, part, flags, 0)\n209: \t\tsyscall.Close(dirfd)\n210: \t\tif err != nil {\n", + "line": "209", + "column": "3", + "nosec": false, + "suppressions": null + }, + { + "severity": "LOW", + "confidence": "HIGH", + "cwe": { + "id": "703", + "url": "https://cwe.mitre.org/data/definitions/703.html" + }, + "rule_id": "G104", + "details": "Errors unhandled", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-agent/internal/escrow/consume.go", + "code": "121: \tif err := os.Rename(tmp, dest); err != nil {\n122: \t\tos.Remove(tmp)\n123: \t\treturn err\n", + "line": "122", + "column": "3", + "nosec": false, + "suppressions": null + }, + { + "severity": "LOW", + "confidence": "HIGH", + "cwe": { + "id": "703", + "url": "https://cwe.mitre.org/data/definitions/703.html" + }, + "rule_id": "G104", + "details": "Errors unhandled", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-agent/internal/escrow/consume.go", + "code": "117: \tif err := f.Close(); err != nil {\n118: \t\tos.Remove(tmp)\n119: \t\treturn err\n", + "line": "118", + "column": "3", + "nosec": false, + "suppressions": null + }, + { + "severity": "LOW", + "confidence": "HIGH", + "cwe": { + "id": "703", + "url": "https://cwe.mitre.org/data/definitions/703.html" + }, + "rule_id": "G104", + "details": "Errors unhandled", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-agent/internal/escrow/consume.go", + "code": "113: \t\tf.Close()\n114: \t\tos.Remove(tmp)\n115: \t\treturn err\n", + "line": "114", + "column": "3", + "nosec": false, + "suppressions": null + }, + { + "severity": "LOW", + "confidence": "HIGH", + "cwe": { + "id": "703", + "url": "https://cwe.mitre.org/data/definitions/703.html" + }, + "rule_id": "G104", + "details": "Errors unhandled", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-agent/internal/escrow/consume.go", + "code": "112: \tif err := f.Sync(); err != nil {\n113: \t\tf.Close()\n114: \t\tos.Remove(tmp)\n", + "line": "113", + "column": "3", + "nosec": false, + "suppressions": null + }, + { + "severity": "LOW", + "confidence": "HIGH", + "cwe": { + "id": "703", + "url": "https://cwe.mitre.org/data/definitions/703.html" + }, + "rule_id": "G104", + "details": "Errors unhandled", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-agent/internal/escrow/consume.go", + "code": "108: \t\tf.Close()\n109: \t\tos.Remove(tmp)\n110: \t\treturn err\n", + "line": "109", + "column": "3", + "nosec": false, + "suppressions": null + }, + { + "severity": "LOW", + "confidence": "HIGH", + "cwe": { + "id": "703", + "url": "https://cwe.mitre.org/data/definitions/703.html" + }, + "rule_id": "G104", + "details": "Errors unhandled", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-agent/internal/escrow/consume.go", + "code": "107: \tif _, err := f.Write(b); err != nil {\n108: \t\tf.Close()\n109: \t\tos.Remove(tmp)\n", + "line": "108", + "column": "3", + "nosec": false, + "suppressions": null + }, + { + "severity": "LOW", + "confidence": "HIGH", + "cwe": { + "id": "703", + "url": "https://cwe.mitre.org/data/definitions/703.html" + }, + "rule_id": "G104", + "details": "Errors unhandled", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-agent/internal/backup/restoretest_state.go", + "code": "284: \tif err := os.WriteFile(tmp, data, 0o600); err != nil {\n285: \t\tos.Remove(tmp)\n286: \t\treturn err\n", + "line": "285", + "column": "3", + "nosec": false, + "suppressions": null + }, + { + "severity": "LOW", + "confidence": "HIGH", + "cwe": { + "id": "703", + "url": "https://cwe.mitre.org/data/definitions/703.html" + }, + "rule_id": "G104", + "details": "Errors unhandled", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-agent/internal/backup/backup_state.go", + "code": "149: \tif err := os.WriteFile(tmp, data, 0o600); err != nil {\n150: \t\tos.Remove(tmp)\n151: \t\treturn err\n", + "line": "150", + "column": "3", + "nosec": false, + "suppressions": null + } + ], + "Stats": { + "files": 161, + "lines": 39508, + "nosec": 0, + "found": 117 + }, + "GosecVersion": "dev" +} \ No newline at end of file diff --git a/documentation/audits/security-review-2026-10-12/scanners/gosec-felhom-controller.json b/documentation/audits/security-review-2026-10-12/scanners/gosec-felhom-controller.json new file mode 100644 index 00000000..5a2d650f --- /dev/null +++ b/documentation/audits/security-review-2026-10-12/scanners/gosec-felhom-controller.json @@ -0,0 +1,7532 @@ +{ + "Golang errors": {}, + "Issues": [ + { + "severity": "HIGH", + "confidence": "MEDIUM", + "cwe": { + "id": "190", + "url": "https://cwe.mitre.org/data/definitions/190.html" + }, + "rule_id": "G115", + "details": "integer overflow conversion uint64 -\u003e int64", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/stacks/pgconvert.go", + "code": "305: \t}\n306: \treturn int64(s.Bavail) * int64(s.Bsize), true\n307: }\n", + "line": "306", + "column": "14", + "nosec": false, + "suppressions": null + }, + { + "severity": "HIGH", + "confidence": "MEDIUM", + "cwe": { + "id": "190", + "url": "https://cwe.mitre.org/data/definitions/190.html" + }, + "rule_id": "G115", + "details": "integer overflow conversion uint64 -\u003e int64", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/backup/tier2_whole.go", + "code": "351: \t}\n352: \treturn int64(st.Bavail) * int64(st.Bsize)\n353: }\n", + "line": "352", + "column": "14", + "nosec": false, + "suppressions": null + }, + { + "severity": "HIGH", + "confidence": "MEDIUM", + "cwe": { + "id": "190", + "url": "https://cwe.mitre.org/data/definitions/190.html" + }, + "rule_id": "G115", + "details": "integer overflow conversion uint64 -\u003e int", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/system/info_linux.go", + "code": "190: \tif v, ok := guestMemTotalMB(); ok \u0026\u0026 v \u003e 0 {\n191: \t\treturn int(v), true\n192: \t}\n", + "line": "191", + "column": "13", + "nosec": false, + "suppressions": null + }, + { + "severity": "HIGH", + "confidence": "MEDIUM", + "cwe": { + "id": "190", + "url": "https://cwe.mitre.org/data/definitions/190.html" + }, + "rule_id": "G115", + "details": "integer overflow conversion uint64 -\u003e int", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/system/info_linux.go", + "code": "187: \tif v, ok := readCgroupMemLimitMB(cgroupRoot); ok \u0026\u0026 v \u003e 0 {\n188: \t\treturn int(v), true\n189: \t}\n", + "line": "188", + "column": "13", + "nosec": false, + "suppressions": null + }, + { + "severity": "HIGH", + "confidence": "MEDIUM", + "cwe": { + "id": "190", + "url": "https://cwe.mitre.org/data/definitions/190.html" + }, + "rule_id": "G115", + "details": "integer overflow conversion uint64 -\u003e int", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/system/info_linux.go", + "code": "79: \t}\n80: \treturn int(info.TotalMemMB), int(info.UsedMemMB), nil\n81: }\n", + "line": "80", + "column": "12", + "nosec": false, + "suppressions": null + }, + { + "severity": "HIGH", + "confidence": "MEDIUM", + "cwe": { + "id": "190", + "url": "https://cwe.mitre.org/data/definitions/190.html" + }, + "rule_id": "G115", + "details": "integer overflow conversion uint64 -\u003e int", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/system/info_linux.go", + "code": "79: \t}\n80: \treturn int(info.TotalMemMB), int(info.UsedMemMB), nil\n81: }\n", + "line": "80", + "column": "34", + "nosec": false, + "suppressions": null + }, + { + "severity": "HIGH", + "confidence": "MEDIUM", + "cwe": { + "id": "190", + "url": "https://cwe.mitre.org/data/definitions/190.html" + }, + "rule_id": "G115", + "details": "integer overflow conversion uint64 -\u003e int", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/system/info_linux.go", + "code": "69: \t}\n70: \treturn int(info.TotalMemMB), nil\n71: }\n", + "line": "70", + "column": "12", + "nosec": false, + "suppressions": null + }, + { + "severity": "HIGH", + "confidence": "MEDIUM", + "cwe": { + "id": "190", + "url": "https://cwe.mitre.org/data/definitions/190.html" + }, + "rule_id": "G115", + "details": "integer overflow conversion uint64 -\u003e int", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/metrics/collector.go", + "code": "86: \t\tMemUsedMB: int(info.UsedMemMB),\n87: \t\tMemTotalMB: int(info.TotalMemMB),\n88: \t\tTempCelsius: info.TemperatureCelsius,\n", + "line": "87", + "column": "19", + "nosec": false, + "suppressions": null + }, + { + "severity": "HIGH", + "confidence": "MEDIUM", + "cwe": { + "id": "190", + "url": "https://cwe.mitre.org/data/definitions/190.html" + }, + "rule_id": "G115", + "details": "integer overflow conversion uint64 -\u003e int", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/metrics/collector.go", + "code": "85: \t\tCPUPercent: info.CPUPercent,\n86: \t\tMemUsedMB: int(info.UsedMemMB),\n87: \t\tMemTotalMB: int(info.TotalMemMB),\n", + "line": "86", + "column": "19", + "nosec": false, + "suppressions": null + }, + { + "severity": "HIGH", + "confidence": "MEDIUM", + "cwe": { + "id": "190", + "url": "https://cwe.mitre.org/data/definitions/190.html" + }, + "rule_id": "G115", + "details": "integer overflow conversion int64 -\u003e uint64", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/system/mounts_linux.go", + "code": "72: \n73: \tbsize := uint64(stat.Bsize)\n74: \ttotal := stat.Blocks * bsize\n", + "line": "73", + "column": "17", + "nosec": false, + "suppressions": null + }, + { + "severity": "HIGH", + "confidence": "MEDIUM", + "cwe": { + "id": "190", + "url": "https://cwe.mitre.org/data/definitions/190.html" + }, + "rule_id": "G115", + "details": "integer overflow conversion int64 -\u003e uint64", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/system/info_linux.go", + "code": "271: \n272: \tbsize := uint64(stat.Bsize)\n273: \ttotal := stat.Blocks * bsize\n", + "line": "272", + "column": "17", + "nosec": false, + "suppressions": null + }, + { + "severity": "HIGH", + "confidence": "MEDIUM", + "cwe": { + "id": "190", + "url": "https://cwe.mitre.org/data/definitions/190.html" + }, + "rule_id": "G115", + "details": "integer overflow conversion int64 -\u003e uint64", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/system/fsclass.go", + "code": "31: func classifyFSMagic(ftype int64) string {\n32: \tu := uint64(ftype) \u0026 0xFFFFFFFF\n33: \tswitch u {\n", + "line": "32", + "column": "13", + "nosec": false, + "suppressions": null + }, + { + "severity": "HIGH", + "confidence": "MEDIUM", + "cwe": { + "id": "190", + "url": "https://cwe.mitre.org/data/definitions/190.html" + }, + "rule_id": "G115", + "details": "integer overflow conversion int64 -\u003e uint32", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/appexport/restore.go", + "code": "1174: \t\t\toutFile.Close()\n1175: \t\t\tos.Chmod(target, os.FileMode(hdr.Mode))\n1176: \t\t}\n", + "line": "1175", + "column": "32", + "nosec": false, + "suppressions": null + }, + { + "severity": "HIGH", + "confidence": "MEDIUM", + "cwe": { + "id": "190", + "url": "https://cwe.mitre.org/data/definitions/190.html" + }, + "rule_id": "G115", + "details": "integer overflow conversion int64 -\u003e uint32", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/appexport/restore.go", + "code": "1158: \t\tcase tar.TypeDir:\n1159: \t\t\tif err := os.MkdirAll(target, os.FileMode(hdr.Mode)); err != nil {\n1160: \t\t\t\treturn err\n", + "line": "1159", + "column": "45", + "nosec": false, + "suppressions": null + }, + { + "severity": "HIGH", + "confidence": "MEDIUM", + "cwe": { + "id": "190", + "url": "https://cwe.mitre.org/data/definitions/190.html" + }, + "rule_id": "G115", + "details": "integer overflow conversion int64 -\u003e uint32", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/appexport/restore.go", + "code": "1126: \t\t\toutFile.Close()\n1127: \t\t\tos.Chmod(target, os.FileMode(hdr.Mode))\n1128: \t\t}\n", + "line": "1127", + "column": "32", + "nosec": false, + "suppressions": null + }, + { + "severity": "HIGH", + "confidence": "MEDIUM", + "cwe": { + "id": "190", + "url": "https://cwe.mitre.org/data/definitions/190.html" + }, + "rule_id": "G115", + "details": "integer overflow conversion int64 -\u003e uint32", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/appexport/restore.go", + "code": "1110: \t\tcase tar.TypeDir:\n1111: \t\t\tif err := os.MkdirAll(target, os.FileMode(hdr.Mode)); err != nil {\n1112: \t\t\t\treturn err\n", + "line": "1111", + "column": "45", + "nosec": false, + "suppressions": null + }, + { + "severity": "HIGH", + "confidence": "MEDIUM", + "cwe": { + "id": "190", + "url": "https://cwe.mitre.org/data/definitions/190.html" + }, + "rule_id": "G115", + "details": "integer overflow conversion int -\u003e uint", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/quiesce/breaker.go", + "code": "107: \t}\n108: \td := breakerBaseDelay \u003c\u003c uint(shift)\n109: \tif d \u003e breakerMaxDelay {\n", + "line": "108", + "column": "31", + "nosec": false, + "suppressions": null + }, + { + "severity": "HIGH", + "confidence": "MEDIUM", + "cwe": { + "id": "338", + "url": "https://cwe.mitre.org/data/definitions/338.html" + }, + "rule_id": "G404", + "details": "Use of weak random number generator (math/rand or math/rand/v2 instead of crypto/rand)", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/report/waiter.go", + "code": "200: \t}\n201: \treturn w.jitterMin + time.Duration(rand.Int63n(int64(span)))\n202: }\n", + "line": "201", + "column": "37", + "nosec": false, + "suppressions": null + }, + { + "severity": "HIGH", + "confidence": "HIGH", + "cwe": { + "id": "1204", + "url": "https://cwe.mitre.org/data/definitions/1204.html" + }, + "rule_id": "G407", + "details": "Use of hardcoded IV/nonce for encryption by passing hardcoded slice/array", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/appexport/crypto.go", + "code": "183: \t}\n184: \tstream := cipher.NewCTR(block, iv)\n185: \n", + "line": "184", + "column": "25", + "nosec": false, + "suppressions": null + }, + { + "severity": "HIGH", + "confidence": "HIGH", + "cwe": { + "id": "1204", + "url": "https://cwe.mitre.org/data/definitions/1204.html" + }, + "rule_id": "G407", + "details": "Use of hardcoded IV/nonce for encryption by passing hardcoded slice/array", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/appexport/crypto.go", + "code": "87: \t}\n88: \tstream := cipher.NewCTR(block, iv)\n89: \tmac := hmac.New(sha256.New, hmKey)\n", + "line": "88", + "column": "25", + "nosec": false, + "suppressions": null + }, + { + "severity": "HIGH", + "confidence": "HIGH", + "cwe": { + "id": "295", + "url": "https://cwe.mitre.org/data/definitions/295.html" + }, + "rule_id": "G402", + "details": "TLS InsecureSkipVerify set true.", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/agentapi/client.go", + "code": "117: \ttlsCfg := \u0026tls.Config{\n118: \t\tInsecureSkipVerify: true, // self-signed leaf — the pin below is the real check\n119: \t\tVerifyPeerCertificate: func(rawCerts [][]byte, _ [][]*x509.Certificate) error {\n", + "line": "118", + "column": "23", + "nosec": false, + "suppressions": null + }, + { + "severity": "HIGH", + "confidence": "LOW", + "cwe": { + "id": "798", + "url": "https://cwe.mitre.org/data/definitions/798.html" + }, + "rule_id": "G101", + "details": "Potential hardcoded credentials", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/infra/samba.go", + "code": "50: \tSambaPassdbVolume = \"samba-passdb\"\n51: \tSambaPassdbMount = \"/var/lib/samba\"\n52: )\n", + "line": "51", + "column": "2", + "nosec": false, + "suppressions": null + }, + { + "severity": "HIGH", + "confidence": "LOW", + "cwe": { + "id": "798", + "url": "https://cwe.mitre.org/data/definitions/798.html" + }, + "rule_id": "G101", + "details": "Potential hardcoded credentials", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/backup/offbox.go", + "code": "1654: // That was the last of the four manual interventions the 2026-08-04 drill needed.\n1655: const OffsiteStateNeedsCredential = \"needs_credential\"\n1656: \n", + "line": "1655", + "column": "7", + "nosec": false, + "suppressions": null + }, + { + "severity": "MEDIUM", + "confidence": "LOW", + "cwe": { + "id": "79", + "url": "https://cwe.mitre.org/data/definitions/79.html" + }, + "rule_id": "G203", + "details": "The used method does not auto-escape HTML. This can potentially lead to 'Cross-site Scripting' vulnerabilities, in case the attacker controls the input.", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/web/funcmap.go", + "code": "429: \t\t\tb, _ := json.Marshal(v)\n430: \t\t\treturn template.JS(b)\n431: \t\t},\n", + "line": "430", + "column": "11", + "nosec": false, + "suppressions": null + }, + { + "severity": "MEDIUM", + "confidence": "LOW", + "cwe": { + "id": "79", + "url": "https://cwe.mitre.org/data/definitions/79.html" + }, + "rule_id": "G203", + "details": "The used method does not auto-escape HTML. This can potentially lead to 'Cross-site Scripting' vulnerabilities, in case the attacker controls the input.", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/web/funcmap.go", + "code": "39: \thue := h.Sum32() % 360\n40: \treturn template.CSS(fmt.Sprintf(\"hsl(%d, 45%%, 38%%)\", hue))\n41: }\n", + "line": "40", + "column": "9", + "nosec": false, + "suppressions": null + }, + { + "severity": "MEDIUM", + "confidence": "LOW", + "cwe": { + "id": "79", + "url": "https://cwe.mitre.org/data/definitions/79.html" + }, + "rule_id": "G203", + "details": "The used method does not auto-escape HTML. This can potentially lead to 'Cross-site Scripting' vulnerabilities, in case the attacker controls the input.", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/web/funcmap.go", + "code": "34: \tif hexColorRe.MatchString(brand) {\n35: \t\treturn template.CSS(brand)\n36: \t}\n", + "line": "35", + "column": "10", + "nosec": false, + "suppressions": null + }, + { + "severity": "MEDIUM", + "confidence": "LOW", + "cwe": { + "id": "79", + "url": "https://cwe.mitre.org/data/definitions/79.html" + }, + "rule_id": "G203", + "details": "The used method does not auto-escape HTML. This can potentially lead to 'Cross-site Scripting' vulnerabilities, in case the attacker controls the input.", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/web/csrf.go", + "code": "118: \ttoken := s.csrfToken(r)\n119: \treturn template.HTML(`\u003cinput type=\"hidden\" name=\"` + csrfFormField + `\" value=\"` + template.HTMLEscapeString(token) + `\"\u003e`)\n120: }\n", + "line": "119", + "column": "9", + "nosec": false, + "suppressions": null + }, + { + "severity": "MEDIUM", + "confidence": "HIGH", + "cwe": { + "id": "78", + "url": "https://cwe.mitre.org/data/definitions/78.html" + }, + "rule_id": "G204", + "details": "Subprocess launched with variable", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/web/netprobe_linux.go", + "code": "35: \tdefer cancel()\n36: \tcmd := exec.CommandContext(pctx, exe, \"--netprobe\", dir)\n37: \tcmd.SysProcAttr = \u0026syscall.SysProcAttr{\n", + "line": "36", + "column": "9", + "nosec": false, + "suppressions": null + }, + { + "severity": "MEDIUM", + "confidence": "HIGH", + "cwe": { + "id": "78", + "url": "https://cwe.mitre.org/data/definitions/78.html" + }, + "rule_id": "G204", + "details": "Subprocess launched with variable", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/backup/offbox.go", + "code": "282: \t}\n283: \tcmd := exec.CommandContext(ctx, \"ssh\", args...)\n284: \treturn cmd.CombinedOutput()\n", + "line": "283", + "column": "9", + "nosec": false, + "suppressions": null + }, + { + "severity": "MEDIUM", + "confidence": "HIGH", + "cwe": { + "id": "78", + "url": "https://cwe.mitre.org/data/definitions/78.html" + }, + "rule_id": "G204", + "details": "Subprocess launched with a potential tainted input or cmd arguments", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/stacks/migrate.go", + "code": "893: \tdefer cancel()\n894: \tcmd := exec.CommandContext(cctx, \"rsync\", \"-a\", \"-n\", \"-i\", \"--checksum\",\n895: \t\tstrings.TrimRight(src, \"/\")+\"/\", strings.TrimRight(dst, \"/\")+\"/\")\n896: \tout, err := cmd.CombinedOutput()\n", + "line": "894-895", + "column": "9", + "nosec": false, + "suppressions": null + }, + { + "severity": "MEDIUM", + "confidence": "HIGH", + "cwe": { + "id": "78", + "url": "https://cwe.mitre.org/data/definitions/78.html" + }, + "rule_id": "G204", + "details": "Subprocess launched with a potential tainted input or cmd arguments", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/stacks/migrate.go", + "code": "865: \tdefer cancel()\n866: \tcmd := exec.CommandContext(cctx, \"rsync\", \"-a\", \"--checksum\", \"--info=progress2\",\n867: \t\tstrings.TrimRight(src, \"/\")+\"/\", strings.TrimRight(dst, \"/\")+\"/\")\n868: \tstdout, err := cmd.StdoutPipe()\n", + "line": "866-867", + "column": "9", + "nosec": false, + "suppressions": null + }, + { + "severity": "MEDIUM", + "confidence": "HIGH", + "cwe": { + "id": "78", + "url": "https://cwe.mitre.org/data/definitions/78.html" + }, + "rule_id": "G204", + "details": "Subprocess launched with a potential tainted input or cmd arguments", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/backup/tier2_restore.go", + "code": "469: \t// Trailing slashes: copy the CONTENTS of src into dst (same shape as rsyncMirror).\n470: \tcmd := exec.CommandContext(ctx, \"rsync\", \"-a\", \"--ignore-existing\", \"--itemize-changes\",\n471: \t\tstrings.TrimRight(src, \"/\")+\"/\", strings.TrimRight(dst, \"/\")+\"/\")\n472: \tout, err := cmd.CombinedOutput()\n", + "line": "470-471", + "column": "9", + "nosec": false, + "suppressions": null + }, + { + "severity": "MEDIUM", + "confidence": "HIGH", + "cwe": { + "id": "78", + "url": "https://cwe.mitre.org/data/definitions/78.html" + }, + "rule_id": "G204", + "details": "Subprocess launched with a potential tainted input or cmd arguments", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/backup/tier2.go", + "code": "699: \t// Trailing slashes: copy the CONTENTS of src into dst.\n700: \tcmd := exec.CommandContext(ctx, \"rsync\", \"-a\", \"--delete\", strings.TrimRight(src, \"/\")+\"/\", strings.TrimRight(dst, \"/\")+\"/\")\n701: \tout, err := cmd.CombinedOutput()\n", + "line": "700", + "column": "9", + "nosec": false, + "suppressions": null + }, + { + "severity": "MEDIUM", + "confidence": "HIGH", + "cwe": { + "id": "78", + "url": "https://cwe.mitre.org/data/definitions/78.html" + }, + "rule_id": "G204", + "details": "Subprocess launched with a potential tainted input or cmd arguments", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/backup/offbox_reconstitute.go", + "code": "121: \tdefer cancel()\n122: \tcmd := exec.CommandContext(ctx, \"rsync\", \"-a\", \"--itemize-changes\",\n123: \t\tstrings.TrimRight(src, \"/\")+\"/\", strings.TrimRight(dst, \"/\")+\"/\")\n124: \tout, err := cmd.CombinedOutput()\n", + "line": "122-123", + "column": "9", + "nosec": false, + "suppressions": null + }, + { + "severity": "MEDIUM", + "confidence": "HIGH", + "cwe": { + "id": "22", + "url": "https://cwe.mitre.org/data/definitions/22.html" + }, + "rule_id": "G304", + "details": "Potential file inclusion via variable", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/web/session_store.go", + "code": "161: \ttmp := path + \".tmp\"\n162: \tfh, err := os.OpenFile(tmp, os.O_CREATE|os.O_TRUNC|os.O_WRONLY, 0o600)\n163: \tif err != nil {\n", + "line": "162", + "column": "13", + "nosec": false, + "suppressions": null + }, + { + "severity": "MEDIUM", + "confidence": "HIGH", + "cwe": { + "id": "22", + "url": "https://cwe.mitre.org/data/definitions/22.html" + }, + "rule_id": "G304", + "details": "Potential file inclusion via variable", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/web/session_store.go", + "code": "78: \t}\n79: \tb, err := os.ReadFile(path)\n80: \tif err != nil {\n", + "line": "79", + "column": "12", + "nosec": false, + "suppressions": null + }, + { + "severity": "MEDIUM", + "confidence": "HIGH", + "cwe": { + "id": "22", + "url": "https://cwe.mitre.org/data/definitions/22.html" + }, + "rule_id": "G304", + "details": "Potential file inclusion via variable", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/web/recovery_older_mail.go", + "code": "50: \tif p != \"\" {\n51: \t\tif b, err := os.ReadFile(p); err == nil {\n52: \t\t\tlast = strings.TrimSpace(string(b))\n", + "line": "51", + "column": "16", + "nosec": false, + "suppressions": null + }, + { + "severity": "MEDIUM", + "confidence": "HIGH", + "cwe": { + "id": "22", + "url": "https://cwe.mitre.org/data/definitions/22.html" + }, + "rule_id": "G304", + "details": "Potential file inclusion via variable", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/web/logbuffer.go", + "code": "221: func (lb *LogBuffer) LoadFrom(path string) {\n222: \tf, err := os.Open(path)\n223: \tif err != nil {\n", + "line": "222", + "column": "12", + "nosec": false, + "suppressions": null + }, + { + "severity": "MEDIUM", + "confidence": "HIGH", + "cwe": { + "id": "22", + "url": "https://cwe.mitre.org/data/definitions/22.html" + }, + "rule_id": "G304", + "details": "Potential file inclusion via variable", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/web/logbuffer.go", + "code": "185: \ttmp := path + \".tmp\"\n186: \tf, err := os.Create(tmp)\n187: \tif err != nil {\n", + "line": "186", + "column": "12", + "nosec": false, + "suppressions": null + }, + { + "severity": "MEDIUM", + "confidence": "HIGH", + "cwe": { + "id": "22", + "url": "https://cwe.mitre.org/data/definitions/22.html" + }, + "rule_id": "G304", + "details": "Potential file inclusion via variable", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/web/handler_export_download.go", + "code": "135: \t}\n136: \tf, err := os.Open(path)\n137: \tif err != nil {\n", + "line": "136", + "column": "12", + "nosec": false, + "suppressions": null + }, + { + "severity": "MEDIUM", + "confidence": "HIGH", + "cwe": { + "id": "22", + "url": "https://cwe.mitre.org/data/definitions/22.html" + }, + "rule_id": "G304", + "details": "Potential file inclusion via variable", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/web/disk_health_state.go", + "code": "103: \t}\n104: \tdata, err := os.ReadFile(path)\n105: \tif err != nil {\n", + "line": "104", + "column": "15", + "nosec": false, + "suppressions": null + }, + { + "severity": "MEDIUM", + "confidence": "HIGH", + "cwe": { + "id": "22", + "url": "https://cwe.mitre.org/data/definitions/22.html" + }, + "rule_id": "G304", + "details": "Potential file inclusion via variable", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/system/mounts_linux.go", + "code": "398: func HasFelhomRawMount(fstabPath, mountPath string) (rawPath string, ok bool) {\n399: \tf, err := os.Open(fstabPath)\n400: \tif err != nil {\n", + "line": "399", + "column": "12", + "nosec": false, + "suppressions": null + }, + { + "severity": "MEDIUM", + "confidence": "HIGH", + "cwe": { + "id": "22", + "url": "https://cwe.mitre.org/data/definitions/22.html" + }, + "rule_id": "G304", + "details": "Potential file inclusion via variable", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/system/mounts_linux.go", + "code": "366: func ParseFstabUUID(fstabPath, mountPath string) string {\n367: \tf, err := os.Open(fstabPath)\n368: \tif err != nil {\n", + "line": "367", + "column": "12", + "nosec": false, + "suppressions": null + }, + { + "severity": "MEDIUM", + "confidence": "HIGH", + "cwe": { + "id": "22", + "url": "https://cwe.mitre.org/data/definitions/22.html" + }, + "rule_id": "G304", + "details": "Potential file inclusion via variable", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/system/mounts_linux.go", + "code": "267: \tmodelPath := \"/sys/block/\" + disk + \"/device/model\"\n268: \tdata, err := os.ReadFile(modelPath)\n269: \tif err != nil {\n", + "line": "268", + "column": "15", + "nosec": false, + "suppressions": null + }, + { + "severity": "MEDIUM", + "confidence": "HIGH", + "cwe": { + "id": "22", + "url": "https://cwe.mitre.org/data/definitions/22.html" + }, + "rule_id": "G304", + "details": "Potential file inclusion via variable", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/system/mounts_linux.go", + "code": "33: \ttestFile := filepath.Join(path, \".felhom-write-test\")\n34: \tf, err := os.Create(testFile)\n35: \tif err != nil {\n", + "line": "34", + "column": "12", + "nosec": false, + "suppressions": null + }, + { + "severity": "MEDIUM", + "confidence": "HIGH", + "cwe": { + "id": "22", + "url": "https://cwe.mitre.org/data/definitions/22.html" + }, + "rule_id": "G304", + "details": "Potential file inclusion via variable", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/system/info_linux.go", + "code": "383: \tfor _, tempPath := range matches {\n384: \t\tdata, err := os.ReadFile(tempPath)\n385: \t\tif err != nil {\n", + "line": "384", + "column": "16", + "nosec": false, + "suppressions": null + }, + { + "severity": "MEDIUM", + "confidence": "HIGH", + "cwe": { + "id": "22", + "url": "https://cwe.mitre.org/data/definitions/22.html" + }, + "rule_id": "G304", + "details": "Potential file inclusion via variable", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/system/info_linux.go", + "code": "352: \t\ttypePath := filepath.Join(zoneDir, \"type\")\n353: \t\ttypeData, err := os.ReadFile(typePath)\n354: \t\tsource := strings.TrimSpace(string(typeData))\n", + "line": "353", + "column": "20", + "nosec": false, + "suppressions": null + }, + { + "severity": "MEDIUM", + "confidence": "HIGH", + "cwe": { + "id": "22", + "url": "https://cwe.mitre.org/data/definitions/22.html" + }, + "rule_id": "G304", + "details": "Potential file inclusion via variable", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/system/info_linux.go", + "code": "337: \tfor _, tempPath := range matches {\n338: \t\tdata, err := os.ReadFile(tempPath)\n339: \t\tif err != nil {\n", + "line": "338", + "column": "16", + "nosec": false, + "suppressions": null + }, + { + "severity": "MEDIUM", + "confidence": "HIGH", + "cwe": { + "id": "22", + "url": "https://cwe.mitre.org/data/definitions/22.html" + }, + "rule_id": "G304", + "details": "Potential file inclusion via variable", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/system/info_linux.go", + "code": "230: \t} {\n231: \t\tif b, err := os.ReadFile(p); err == nil {\n232: \t\t\tif v, err := strconv.ParseUint(strings.TrimSpace(string(b)), 10, 64); err == nil {\n", + "line": "231", + "column": "16", + "nosec": false, + "suppressions": null + }, + { + "severity": "MEDIUM", + "confidence": "HIGH", + "cwe": { + "id": "22", + "url": "https://cwe.mitre.org/data/definitions/22.html" + }, + "rule_id": "G304", + "details": "Potential file inclusion via variable", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/system/info_linux.go", + "code": "210: \t// cgroup v1\n211: \tif b, err := os.ReadFile(filepath.Join(root, \"memory\", \"memory.limit_in_bytes\")); err == nil {\n212: \t\ts := strings.TrimSpace(string(b))\n", + "line": "211", + "column": "15", + "nosec": false, + "suppressions": null + }, + { + "severity": "MEDIUM", + "confidence": "HIGH", + "cwe": { + "id": "22", + "url": "https://cwe.mitre.org/data/definitions/22.html" + }, + "rule_id": "G304", + "details": "Potential file inclusion via variable", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/system/info_linux.go", + "code": "200: \t// cgroup v2\n201: \tif b, err := os.ReadFile(filepath.Join(root, \"memory.max\")); err == nil {\n202: \t\ts := strings.TrimSpace(string(b))\n", + "line": "201", + "column": "15", + "nosec": false, + "suppressions": null + }, + { + "severity": "MEDIUM", + "confidence": "HIGH", + "cwe": { + "id": "22", + "url": "https://cwe.mitre.org/data/definitions/22.html" + }, + "rule_id": "G304", + "details": "Potential file inclusion via variable", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/sync/sync.go", + "code": "669: \t// Check if dst exists and has same content\n670: \tdstData, err := os.ReadFile(dst)\n671: \tif err == nil {\n", + "line": "670", + "column": "18", + "nosec": false, + "suppressions": null + }, + { + "severity": "MEDIUM", + "confidence": "HIGH", + "cwe": { + "id": "22", + "url": "https://cwe.mitre.org/data/definitions/22.html" + }, + "rule_id": "G304", + "details": "Potential file inclusion via variable", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/sync/sync.go", + "code": "663: func copyIfChanged(src, dst string) (bool, error) {\n664: \tsrcData, err := os.ReadFile(src)\n665: \tif err != nil {\n", + "line": "664", + "column": "18", + "nosec": false, + "suppressions": null + }, + { + "severity": "MEDIUM", + "confidence": "HIGH", + "cwe": { + "id": "22", + "url": "https://cwe.mitre.org/data/definitions/22.html" + }, + "rule_id": "G304", + "details": "Potential file inclusion via variable", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/sync/sync.go", + "code": "651: func writeIfChanged(data []byte, dst string) (bool, error) {\n652: \tif cur, err := os.ReadFile(dst); err == nil \u0026\u0026 sha256.Sum256(cur) == sha256.Sum256(data) {\n653: \t\treturn false, nil\n", + "line": "652", + "column": "17", + "nosec": false, + "suppressions": null + }, + { + "severity": "MEDIUM", + "confidence": "HIGH", + "cwe": { + "id": "22", + "url": "https://cwe.mitre.org/data/definitions/22.html" + }, + "rule_id": "G304", + "details": "Potential file inclusion via variable", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/sync/sync.go", + "code": "640: \tsrcHash := sha256.Sum256(srcData)\n641: \tdstData, err := os.ReadFile(dst)\n642: \tif err != nil {\n", + "line": "641", + "column": "18", + "nosec": false, + "suppressions": null + }, + { + "severity": "MEDIUM", + "confidence": "HIGH", + "cwe": { + "id": "22", + "url": "https://cwe.mitre.org/data/definitions/22.html" + }, + "rule_id": "G304", + "details": "Potential file inclusion via variable", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/sync/sync.go", + "code": "635: func (s *Syncer) logFileHashes(appName, filename, src, dst string) {\n636: \tsrcData, err := os.ReadFile(src)\n637: \tif err != nil {\n", + "line": "636", + "column": "18", + "nosec": false, + "suppressions": null + }, + { + "severity": "MEDIUM", + "confidence": "HIGH", + "cwe": { + "id": "22", + "url": "https://cwe.mitre.org/data/definitions/22.html" + }, + "rule_id": "G304", + "details": "Potential file inclusion via variable", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/sync/sync.go", + "code": "509: \t\t\t\t\t\t}\n510: \t\t\t\t\t} else if data, rerr := os.ReadFile(src); rerr != nil {\n511: \t\t\t\t\t\ts.logger.Printf(\"[WARN] [sync] %s: could not re-read the template to refresh its stored definition: %v\", appName, rerr)\n", + "line": "510", + "column": "30", + "nosec": false, + "suppressions": null + }, + { + "severity": "MEDIUM", + "confidence": "HIGH", + "cwe": { + "id": "22", + "url": "https://cwe.mitre.org/data/definitions/22.html" + }, + "rule_id": "G304", + "details": "Potential file inclusion via variable", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/sync/sync.go", + "code": "482: \t\t\t\t\t// 2026-09-24 Part B, live finding). A fresh install takes the ladder's tested digest.\n483: \t\t\t\t\tcurrent, _ := os.ReadFile(dst)\n484: \t\t\t\t\trendered = stacks.CarryDigests(raw, current)\n", + "line": "483", + "column": "20", + "nosec": false, + "suppressions": null + }, + { + "severity": "MEDIUM", + "confidence": "HIGH", + "cwe": { + "id": "22", + "url": "https://cwe.mitre.org/data/definitions/22.html" + }, + "rule_id": "G304", + "details": "Potential file inclusion via variable", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/sync/sync.go", + "code": "474: \t\t\tif filename == \"docker-compose.yml\" \u0026\u0026 filepath.Dir(src) == srcDir {\n475: \t\t\t\traw, rerr := os.ReadFile(src)\n476: \t\t\t\tif rerr != nil {\n", + "line": "475", + "column": "18", + "nosec": false, + "suppressions": null + }, + { + "severity": "MEDIUM", + "confidence": "HIGH", + "cwe": { + "id": "22", + "url": "https://cwe.mitre.org/data/definitions/22.html" + }, + "rule_id": "G304", + "details": "Potential file inclusion via variable", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/stacks/update.go", + "code": "1342: \ttmp := p + \".tmp\"\n1343: \tf, err := os.OpenFile(tmp, os.O_WRONLY|os.O_CREATE|os.O_TRUNC, 0o600)\n1344: \tif err != nil {\n", + "line": "1343", + "column": "12", + "nosec": false, + "suppressions": null + }, + { + "severity": "MEDIUM", + "confidence": "HIGH", + "cwe": { + "id": "22", + "url": "https://cwe.mitre.org/data/definitions/22.html" + }, + "rule_id": "G304", + "details": "Potential file inclusion via variable", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/stacks/undo.go", + "code": "664: \t\t}\n665: \t\tb, err := os.ReadFile(filepath.Join(dir, \".felhom.yml\"))\n666: \t\tif err == nil {\n", + "line": "665", + "column": "13", + "nosec": false, + "suppressions": null + }, + { + "severity": "MEDIUM", + "confidence": "HIGH", + "cwe": { + "id": "22", + "url": "https://cwe.mitre.org/data/definitions/22.html" + }, + "rule_id": "G304", + "details": "Potential file inclusion via variable", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/stacks/undo.go", + "code": "470: \tif err != nil {\n471: \t\tif src, err = os.ReadFile(filepath.Join(dir, \".felhom.yml\")); err != nil {\n472: \t\t\treturn \"\", err\n", + "line": "471", + "column": "17", + "nosec": false, + "suppressions": null + }, + { + "severity": "MEDIUM", + "confidence": "HIGH", + "cwe": { + "id": "22", + "url": "https://cwe.mitre.org/data/definitions/22.html" + }, + "rule_id": "G304", + "details": "Potential file inclusion via variable", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/stacks/undo.go", + "code": "468: func savePreUpdateMeta(dir string) (string, error) {\n469: \tsrc, err := os.ReadFile(filepath.Join(dir, appliedMetaDir, \".felhom.yml\"))\n470: \tif err != nil {\n", + "line": "469", + "column": "14", + "nosec": false, + "suppressions": null + }, + { + "severity": "MEDIUM", + "confidence": "HIGH", + "cwe": { + "id": "22", + "url": "https://cwe.mitre.org/data/definitions/22.html" + }, + "rule_id": "G304", + "details": "Potential file inclusion via variable", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/stacks/undo.go", + "code": "333: func DeclaredVolumeNames(composePath string) (own, external []string, err error) {\n334: \tdata, err := os.ReadFile(composePath)\n335: \tif err != nil {\n", + "line": "334", + "column": "15", + "nosec": false, + "suppressions": null + }, + { + "severity": "MEDIUM", + "confidence": "HIGH", + "cwe": { + "id": "22", + "url": "https://cwe.mitre.org/data/definitions/22.html" + }, + "rule_id": "G304", + "details": "Potential file inclusion via variable", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/stacks/undo.go", + "code": "121: func (m *Manager) storeAppliedMetaFrom(name, stackDir, src string) {\n122: \tb, err := os.ReadFile(src)\n123: \tif err == nil {\n", + "line": "122", + "column": "12", + "nosec": false, + "suppressions": null + }, + { + "severity": "MEDIUM", + "confidence": "HIGH", + "cwe": { + "id": "22", + "url": "https://cwe.mitre.org/data/definitions/22.html" + }, + "rule_id": "G304", + "details": "Potential file inclusion via variable", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/stacks/signup_block.go", + "code": "66: \tp := m.signupBlockPath(name)\n67: \tif cur, err := os.ReadFile(p); err == nil \u0026\u0026 string(cur) == want {\n68: \t\treturn nil\n", + "line": "67", + "column": "17", + "nosec": false, + "suppressions": null + }, + { + "severity": "MEDIUM", + "confidence": "HIGH", + "cwe": { + "id": "22", + "url": "https://cwe.mitre.org/data/definitions/22.html" + }, + "rule_id": "G304", + "details": "Potential file inclusion via variable", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/stacks/setup_gate.go", + "code": "263: \tp := m.setupGatePath(name)\n264: \tif cur, err := os.ReadFile(p); err == nil \u0026\u0026 string(cur) == want {\n265: \t\treturn gateHosts(rs), nil\n", + "line": "264", + "column": "17", + "nosec": false, + "suppressions": null + }, + { + "severity": "MEDIUM", + "confidence": "HIGH", + "cwe": { + "id": "22", + "url": "https://cwe.mitre.org/data/definitions/22.html" + }, + "rule_id": "G304", + "details": "Potential file inclusion via variable", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/stacks/setup_gate.go", + "code": "116: func gateRoutersFromCompose(composePath string, env map[string]string) ([]gateRouter, error) {\n117: \tdata, err := os.ReadFile(composePath)\n118: \tif err != nil {\n", + "line": "117", + "column": "15", + "nosec": false, + "suppressions": null + }, + { + "severity": "MEDIUM", + "confidence": "HIGH", + "cwe": { + "id": "22", + "url": "https://cwe.mitre.org/data/definitions/22.html" + }, + "rule_id": "G304", + "details": "Potential file inclusion via variable", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/stacks/samba.go", + "code": "214: \ttmp := path + \".tmp\"\n215: \tf, err := os.OpenFile(tmp, os.O_CREATE|os.O_WRONLY|os.O_TRUNC, mode)\n216: \tif err != nil {\n", + "line": "215", + "column": "12", + "nosec": false, + "suppressions": null + }, + { + "severity": "MEDIUM", + "confidence": "HIGH", + "cwe": { + "id": "22", + "url": "https://cwe.mitre.org/data/definitions/22.html" + }, + "rule_id": "G304", + "details": "Potential file inclusion via variable", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/stacks/samba.go", + "code": "199: \t\tp := filepath.Join(dir, f.name)\n200: \t\tif cur, err := os.ReadFile(p); err == nil \u0026\u0026 string(cur) == f.content {\n201: \t\t\tcontinue\n", + "line": "200", + "column": "18", + "nosec": false, + "suppressions": null + }, + { + "severity": "MEDIUM", + "confidence": "HIGH", + "cwe": { + "id": "22", + "url": "https://cwe.mitre.org/data/definitions/22.html" + }, + "rule_id": "G304", + "details": "Potential file inclusion via variable", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/stacks/pin.go", + "code": "162: \t}\n163: \tdata, err := os.ReadFile(composePath)\n164: \tif err != nil {\n", + "line": "163", + "column": "15", + "nosec": false, + "suppressions": null + }, + { + "severity": "MEDIUM", + "confidence": "HIGH", + "cwe": { + "id": "22", + "url": "https://cwe.mitre.org/data/definitions/22.html" + }, + "rule_id": "G304", + "details": "Potential file inclusion via variable", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/stacks/pgconvert.go", + "code": "898: func (d dockerPGConverter) Load(c, user, path string, skip map[string]bool) error {\n899: \tf, err := os.Open(path)\n900: \tif err != nil {\n", + "line": "899", + "column": "12", + "nosec": false, + "suppressions": null + }, + { + "severity": "MEDIUM", + "confidence": "HIGH", + "cwe": { + "id": "22", + "url": "https://cwe.mitre.org/data/definitions/22.html" + }, + "rule_id": "G304", + "details": "Potential file inclusion via variable", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/stacks/pgconvert.go", + "code": "829: func (d dockerPGConverter) DumpAll(c, user, path string) error {\n830: \tf, err := os.OpenFile(path, os.O_WRONLY|os.O_CREATE|os.O_TRUNC, 0o600)\n831: \tif err != nil {\n", + "line": "830", + "column": "12", + "nosec": false, + "suppressions": null + }, + { + "severity": "MEDIUM", + "confidence": "HIGH", + "cwe": { + "id": "22", + "url": "https://cwe.mitre.org/data/definitions/22.html" + }, + "rule_id": "G304", + "details": "Potential file inclusion via variable", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/stacks/pgconvert.go", + "code": "383: func validateDumpAll(path string) error {\n384: \tf, err := os.Open(path)\n385: \tif err != nil {\n", + "line": "384", + "column": "12", + "nosec": false, + "suppressions": null + }, + { + "severity": "MEDIUM", + "confidence": "HIGH", + "cwe": { + "id": "22", + "url": "https://cwe.mitre.org/data/definitions/22.html" + }, + "rule_id": "G304", + "details": "Potential file inclusion via variable", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/stacks/pgconvert.go", + "code": "252: func serviceDataVolume(composePath, service string) (key, dockerName string, err error) {\n253: \tdata, err := os.ReadFile(composePath)\n254: \tif err != nil {\n", + "line": "253", + "column": "15", + "nosec": false, + "suppressions": null + }, + { + "severity": "MEDIUM", + "confidence": "HIGH", + "cwe": { + "id": "22", + "url": "https://cwe.mitre.org/data/definitions/22.html" + }, + "rule_id": "G304", + "details": "Potential file inclusion via variable", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/stacks/pgconvert.go", + "code": "239: func composeProject(composePath string) string {\n240: \tdata, err := os.ReadFile(composePath)\n241: \tif err == nil {\n", + "line": "240", + "column": "15", + "nosec": false, + "suppressions": null + }, + { + "severity": "MEDIUM", + "confidence": "HIGH", + "cwe": { + "id": "22", + "url": "https://cwe.mitre.org/data/definitions/22.html" + }, + "rule_id": "G304", + "details": "Potential file inclusion via variable", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/stacks/migrate.go", + "code": "1166: func fileSum(path string) (string, error) {\n1167: \tf, err := os.Open(path)\n1168: \tif err != nil {\n", + "line": "1167", + "column": "12", + "nosec": false, + "suppressions": null + }, + { + "severity": "MEDIUM", + "confidence": "HIGH", + "cwe": { + "id": "22", + "url": "https://cwe.mitre.org/data/definitions/22.html" + }, + "rule_id": "G304", + "details": "Potential file inclusion via variable", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/stacks/migrate.go", + "code": "1105: \ttmp := dst + \".felhom-mig.tmp\"\n1106: \tout, err := os.OpenFile(tmp, os.O_CREATE|os.O_WRONLY|os.O_TRUNC, fi.Mode().Perm())\n1107: \tif err != nil {\n", + "line": "1106", + "column": "14", + "nosec": false, + "suppressions": null + }, + { + "severity": "MEDIUM", + "confidence": "HIGH", + "cwe": { + "id": "22", + "url": "https://cwe.mitre.org/data/definitions/22.html" + }, + "rule_id": "G304", + "details": "Potential file inclusion via variable", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/stacks/migrate.go", + "code": "1092: func copyFile(src, dst string) (int64, error) {\n1093: \tin, err := os.Open(src)\n1094: \tif err != nil {\n", + "line": "1093", + "column": "13", + "nosec": false, + "suppressions": null + }, + { + "severity": "MEDIUM", + "confidence": "HIGH", + "cwe": { + "id": "22", + "url": "https://cwe.mitre.org/data/definitions/22.html" + }, + "rule_id": "G304", + "details": "Potential file inclusion via variable", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/stacks/metadata.go", + "code": "363: \tpath := filepath.Join(stackDir, \".felhom.yml\")\n364: \tdata, err := os.ReadFile(path)\n365: \tif err != nil {\n", + "line": "364", + "column": "15", + "nosec": false, + "suppressions": null + }, + { + "severity": "MEDIUM", + "confidence": "HIGH", + "cwe": { + "id": "22", + "url": "https://cwe.mitre.org/data/definitions/22.html" + }, + "rule_id": "G304", + "details": "Potential file inclusion via variable", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/stacks/manager.go", + "code": "1721: \t\tcomposePath = filepath.Join(stackDir, \"docker-compose.yaml\")\n1722: \t\tdata, err = os.ReadFile(composePath)\n1723: \t\tif err != nil {\n", + "line": "1722", + "column": "15", + "nosec": false, + "suppressions": null + }, + { + "severity": "MEDIUM", + "confidence": "HIGH", + "cwe": { + "id": "22", + "url": "https://cwe.mitre.org/data/definitions/22.html" + }, + "rule_id": "G304", + "details": "Potential file inclusion via variable", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/stacks/manager.go", + "code": "1718: \tcomposePath := filepath.Join(stackDir, \"docker-compose.yml\")\n1719: \tdata, err := os.ReadFile(composePath)\n1720: \tif err != nil {\n", + "line": "1719", + "column": "15", + "nosec": false, + "suppressions": null + }, + { + "severity": "MEDIUM", + "confidence": "HIGH", + "cwe": { + "id": "22", + "url": "https://cwe.mitre.org/data/definitions/22.html" + }, + "rule_id": "G304", + "details": "Potential file inclusion via variable", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/stacks/manager.go", + "code": "1511: \tfor _, n := range names {\n1512: \t\tb, rerr := os.ReadFile(filepath.Join(dir, \"hold-logs\", n, \"compose-logs.txt\"))\n1513: \t\tif rerr == nil \u0026\u0026 strings.TrimSpace(string(b)) != \"\" {\n", + "line": "1512", + "column": "14", + "nosec": false, + "suppressions": null + }, + { + "severity": "MEDIUM", + "confidence": "HIGH", + "cwe": { + "id": "22", + "url": "https://cwe.mitre.org/data/definitions/22.html" + }, + "rule_id": "G304", + "details": "Potential file inclusion via variable", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/stacks/ladder.go", + "code": "222: func loadMetadataFile(path string) (Metadata, error) {\n223: \tdata, err := os.ReadFile(path)\n224: \tif err != nil {\n", + "line": "223", + "column": "15", + "nosec": false, + "suppressions": null + }, + { + "severity": "MEDIUM", + "confidence": "HIGH", + "cwe": { + "id": "22", + "url": "https://cwe.mitre.org/data/definitions/22.html" + }, + "rule_id": "G304", + "details": "Potential file inclusion via variable", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/stacks/ladder.go", + "code": "83: func LoadLadder(felhomPath string) ([]LadderEntry, error) {\n84: \tdata, err := os.ReadFile(felhomPath)\n85: \tif err != nil {\n", + "line": "84", + "column": "15", + "nosec": false, + "suppressions": null + }, + { + "severity": "MEDIUM", + "confidence": "HIGH", + "cwe": { + "id": "22", + "url": "https://cwe.mitre.org/data/definitions/22.html" + }, + "rule_id": "G304", + "details": "Potential file inclusion via variable", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/stacks/kept.go", + "code": "207: func readKeptMarker(dir string) *KeptMarker {\n208: \tb, err := os.ReadFile(filepath.Join(dir, keptMarkerFile))\n209: \tif err != nil {\n", + "line": "208", + "column": "12", + "nosec": false, + "suppressions": null + }, + { + "severity": "MEDIUM", + "confidence": "HIGH", + "cwe": { + "id": "22", + "url": "https://cwe.mitre.org/data/definitions/22.html" + }, + "rule_id": "G304", + "details": "Potential file inclusion via variable", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/stacks/kept.go", + "code": "111: func dirHasEntries(p string) bool {\n112: \tf, err := os.Open(p)\n113: \tif err != nil {\n", + "line": "112", + "column": "12", + "nosec": false, + "suppressions": null + }, + { + "severity": "MEDIUM", + "confidence": "HIGH", + "cwe": { + "id": "22", + "url": "https://cwe.mitre.org/data/definitions/22.html" + }, + "rule_id": "G304", + "details": "Potential file inclusion via variable", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/stacks/installed.go", + "code": "90: func ParseComposeImages(composePath string) (map[string]string, error) {\n91: \tdata, err := os.ReadFile(composePath)\n92: \tif err != nil {\n", + "line": "91", + "column": "15", + "nosec": false, + "suppressions": null + }, + { + "severity": "MEDIUM", + "confidence": "HIGH", + "cwe": { + "id": "22", + "url": "https://cwe.mitre.org/data/definitions/22.html" + }, + "rule_id": "G304", + "details": "Potential file inclusion via variable", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/stacks/install_hold.go", + "code": "71: \tp := m.installHoldPath(name)\n72: \tif cur, err := os.ReadFile(p); err == nil \u0026\u0026 string(cur) == want {\n73: \t\treturn gateHosts(rs), nil\n", + "line": "72", + "column": "17", + "nosec": false, + "suppressions": null + }, + { + "severity": "MEDIUM", + "confidence": "HIGH", + "cwe": { + "id": "22", + "url": "https://cwe.mitre.org/data/definitions/22.html" + }, + "rule_id": "G304", + "details": "Potential file inclusion via variable", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/stacks/infra.go", + "code": "424: \tcomposePath := filepath.Join(dir, \"docker-compose.yml\")\n425: \tcur, err := os.ReadFile(composePath)\n426: \tif err != nil {\n", + "line": "425", + "column": "14", + "nosec": false, + "suppressions": null + }, + { + "severity": "MEDIUM", + "confidence": "HIGH", + "cwe": { + "id": "22", + "url": "https://cwe.mitre.org/data/definitions/22.html" + }, + "rule_id": "G304", + "details": "Potential file inclusion via variable", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/stacks/infra.go", + "code": "326: \twant := infra.RenderControllerRoute(domain, wildcardTLS)\n327: \tif cur, err := os.ReadFile(routePath); err != nil || string(cur) != want {\n328: \t\tif err := os.WriteFile(routePath, []byte(want), 0o644); err != nil {\n", + "line": "327", + "column": "17", + "nosec": false, + "suppressions": null + }, + { + "severity": "MEDIUM", + "confidence": "HIGH", + "cwe": { + "id": "22", + "url": "https://cwe.mitre.org/data/definitions/22.html" + }, + "rule_id": "G304", + "details": "Potential file inclusion via variable", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/stacks/infra.go", + "code": "292: \twant := infra.RenderServersTransports()\n293: \tif cur, err := os.ReadFile(path); err != nil || string(cur) != want {\n294: \t\tif err := os.WriteFile(path, []byte(want), 0o644); err != nil {\n", + "line": "293", + "column": "17", + "nosec": false, + "suppressions": null + }, + { + "severity": "MEDIUM", + "confidence": "HIGH", + "cwe": { + "id": "22", + "url": "https://cwe.mitre.org/data/definitions/22.html" + }, + "rule_id": "G304", + "details": "Potential file inclusion via variable", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/stacks/infra.go", + "code": "242: \tfor name, spec := range files {\n243: \t\tcur, err := os.ReadFile(filepath.Join(dir, name))\n244: \t\tif err != nil || string(cur) != spec.Content {\n", + "line": "243", + "column": "15", + "nosec": false, + "suppressions": null + }, + { + "severity": "MEDIUM", + "confidence": "HIGH", + "cwe": { + "id": "22", + "url": "https://cwe.mitre.org/data/definitions/22.html" + }, + "rule_id": "G304", + "details": "Potential file inclusion via variable", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/stacks/infra.go", + "code": "229: \twant := infra.RenderForwardedHeaders()\n230: \tif cur, err := os.ReadFile(path); err != nil || string(cur) != want {\n231: \t\tif err := os.WriteFile(path, []byte(want), 0o644); err != nil {\n", + "line": "230", + "column": "17", + "nosec": false, + "suppressions": null + }, + { + "severity": "MEDIUM", + "confidence": "HIGH", + "cwe": { + "id": "22", + "url": "https://cwe.mitre.org/data/definitions/22.html" + }, + "rule_id": "G304", + "details": "Potential file inclusion via variable", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/stacks/infra.go", + "code": "136: \t\t}\n137: \t\tif cur, err := os.ReadFile(filepath.Join(dir, \"traefik.yml\")); err == nil \u0026\u0026\n138: \t\t\tstrings.Contains(string(cur), \"certResolver\") \u0026\u0026 !strings.Contains(files[\"traefik.yml\"].Content, \"certResolver\") {\n", + "line": "137", + "column": "18", + "nosec": false, + "suppressions": null + }, + { + "severity": "MEDIUM", + "confidence": "HIGH", + "cwe": { + "id": "22", + "url": "https://cwe.mitre.org/data/definitions/22.html" + }, + "rule_id": "G304", + "details": "Potential file inclusion via variable", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/stacks/family_gate.go", + "code": "124: \tp := m.familyGatePath(name)\n125: \tif cur, err := os.ReadFile(p); err == nil \u0026\u0026 string(cur) == want {\n126: \t\treturn gateHosts(rs), nil\n", + "line": "125", + "column": "17", + "nosec": false, + "suppressions": null + }, + { + "severity": "MEDIUM", + "confidence": "HIGH", + "cwe": { + "id": "22", + "url": "https://cwe.mitre.org/data/definitions/22.html" + }, + "rule_id": "G304", + "details": "Potential file inclusion via variable", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/stacks/deploy.go", + "code": "1415: \tfor _, p := range []string{filepath.Join(stackDir, \"docker-compose.yml\"), AppliedComposePath(stackDir)} {\n1416: \t\tif b, err := os.ReadFile(p); err == nil \u0026\u0026 ref.Match(b) {\n1417: \t\t\treturn false\n", + "line": "1416", + "column": "16", + "nosec": false, + "suppressions": null + }, + { + "severity": "MEDIUM", + "confidence": "HIGH", + "cwe": { + "id": "22", + "url": "https://cwe.mitre.org/data/definitions/22.html" + }, + "rule_id": "G304", + "details": "Potential file inclusion via variable", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/stacks/deploy.go", + "code": "1062: \tpath := filepath.Join(stackDir, \"app.yaml\")\n1063: \tdata, err := os.ReadFile(path)\n1064: \tif err != nil {\n", + "line": "1063", + "column": "15", + "nosec": false, + "suppressions": null + }, + { + "severity": "MEDIUM", + "confidence": "HIGH", + "cwe": { + "id": "22", + "url": "https://cwe.mitre.org/data/definitions/22.html" + }, + "rule_id": "G304", + "details": "Potential file inclusion via variable", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/stacks/delete.go", + "code": "987: \n988: \tdata, err := os.ReadFile(composePath)\n989: \tif err != nil {\n", + "line": "988", + "column": "15", + "nosec": false, + "suppressions": null + }, + { + "severity": "MEDIUM", + "confidence": "HIGH", + "cwe": { + "id": "22", + "url": "https://cwe.mitre.org/data/definitions/22.html" + }, + "rule_id": "G304", + "details": "Potential file inclusion via variable", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/stacks/classify_binds.go", + "code": "43: func ParseComposeClassifiableBinds(composePath string) []appbackup.ComposeBind {\n44: \tdata, err := os.ReadFile(composePath)\n45: \tif err != nil {\n", + "line": "44", + "column": "15", + "nosec": false, + "suppressions": null + }, + { + "severity": "MEDIUM", + "confidence": "HIGH", + "cwe": { + "id": "22", + "url": "https://cwe.mitre.org/data/definitions/22.html" + }, + "rule_id": "G304", + "details": "Potential file inclusion via variable", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/stacks/after_setup.go", + "code": "393: func composeMissingVars(composePath string, env map[string]string) []string {\n394: \tb, err := os.ReadFile(composePath)\n395: \tif err != nil {\n", + "line": "394", + "column": "12", + "nosec": false, + "suppressions": null + }, + { + "severity": "MEDIUM", + "confidence": "HIGH", + "cwe": { + "id": "22", + "url": "https://cwe.mitre.org/data/definitions/22.html" + }, + "rule_id": "G304", + "details": "Potential file inclusion via variable", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/setup/setup.go", + "code": "56: \n57: \tdata, err := os.ReadFile(path)\n58: \tif err != nil {\n", + "line": "57", + "column": "15", + "nosec": false, + "suppressions": null + }, + { + "severity": "MEDIUM", + "confidence": "HIGH", + "cwe": { + "id": "22", + "url": "https://cwe.mitre.org/data/definitions/22.html" + }, + "rule_id": "G304", + "details": "Potential file inclusion via variable", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/settings/settings.go", + "code": "735: \t\tlogger.Printf(\"[ERROR] [settings] primary settings corrupt (%v) — attempting recovery from .bak\", err)\n736: \t\tif bak, berr := os.ReadFile(path + \".bak\"); berr == nil {\n737: \t\t\ts2 := \u0026Settings{path: path, log: logger}\n", + "line": "736", + "column": "19", + "nosec": false, + "suppressions": null + }, + { + "severity": "MEDIUM", + "confidence": "HIGH", + "cwe": { + "id": "22", + "url": "https://cwe.mitre.org/data/definitions/22.html" + }, + "rule_id": "G304", + "details": "Potential file inclusion via variable", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/settings/settings.go", + "code": "721: \n722: \tdata, err := os.ReadFile(path)\n723: \tif err != nil {\n", + "line": "722", + "column": "15", + "nosec": false, + "suppressions": null + }, + { + "severity": "MEDIUM", + "confidence": "HIGH", + "cwe": { + "id": "22", + "url": "https://cwe.mitre.org/data/definitions/22.html" + }, + "rule_id": "G304", + "details": "Potential file inclusion via variable", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/selfupdate/state.go", + "code": "28: \tpath := filepath.Join(dataDir, stateFileName)\n29: \tdata, err := os.ReadFile(path)\n30: \tif err != nil {\n", + "line": "29", + "column": "15", + "nosec": false, + "suppressions": null + }, + { + "severity": "MEDIUM", + "confidence": "HIGH", + "cwe": { + "id": "22", + "url": "https://cwe.mitre.org/data/definitions/22.html" + }, + "rule_id": "G304", + "details": "Potential file inclusion via variable", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/report/dr_recipe.go", + "code": "14: func readComposeFile(path string) string {\n15: \tdata, err := os.ReadFile(path)\n16: \tif err != nil {\n", + "line": "15", + "column": "15", + "nosec": false, + "suppressions": null + }, + { + "severity": "MEDIUM", + "confidence": "HIGH", + "cwe": { + "id": "22", + "url": "https://cwe.mitre.org/data/definitions/22.html" + }, + "rule_id": "G304", + "details": "Potential file inclusion via variable", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/report/builder.go", + "code": "57: \tif configPath != \"\" {\n58: \t\tif data, err := os.ReadFile(configPath); err == nil {\n59: \t\t\th := sha256.Sum256(data)\n", + "line": "58", + "column": "19", + "nosec": false, + "suppressions": null + }, + { + "severity": "MEDIUM", + "confidence": "HIGH", + "cwe": { + "id": "22", + "url": "https://cwe.mitre.org/data/definitions/22.html" + }, + "rule_id": "G304", + "details": "Potential file inclusion via variable", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/quiesce/nightowed.go", + "code": "88: \t}\n89: \tdata, err := os.ReadFile(p)\n90: \tif err != nil {\n", + "line": "89", + "column": "15", + "nosec": false, + "suppressions": null + }, + { + "severity": "MEDIUM", + "confidence": "HIGH", + "cwe": { + "id": "22", + "url": "https://cwe.mitre.org/data/definitions/22.html" + }, + "rule_id": "G304", + "details": "Potential file inclusion via variable", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/nightchain/nightchain.go", + "code": "90: \tl := \u0026Ledger{path: path, d: ledgerData{Ended: map[Leg]time.Time{}}}\n91: \tb, err := os.ReadFile(path)\n92: \tswitch {\n", + "line": "91", + "column": "12", + "nosec": false, + "suppressions": null + }, + { + "severity": "MEDIUM", + "confidence": "HIGH", + "cwe": { + "id": "22", + "url": "https://cwe.mitre.org/data/definitions/22.html" + }, + "rule_id": "G304", + "details": "Potential file inclusion via variable", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/metrics/sysinfo.go", + "code": "74: func readOSRelease(path string) string {\n75: \tf, err := os.Open(path)\n76: \tif err != nil {\n", + "line": "75", + "column": "12", + "nosec": false, + "suppressions": null + }, + { + "severity": "MEDIUM", + "confidence": "HIGH", + "cwe": { + "id": "22", + "url": "https://cwe.mitre.org/data/definitions/22.html" + }, + "rule_id": "G304", + "details": "Potential file inclusion via variable", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/integrations/onlyoffice_filebrowser.go", + "code": "68: \n69: \tconfigData, err := os.ReadFile(configPath)\n70: \tif err != nil {\n", + "line": "69", + "column": "21", + "nosec": false, + "suppressions": null + }, + { + "severity": "MEDIUM", + "confidence": "HIGH", + "cwe": { + "id": "22", + "url": "https://cwe.mitre.org/data/definitions/22.html" + }, + "rule_id": "G304", + "details": "Potential file inclusion via variable", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/integrations/onlyoffice_filebrowser.go", + "code": "32: \n33: \tconfigData, err := os.ReadFile(configPath)\n34: \tif err != nil {\n", + "line": "33", + "column": "21", + "nosec": false, + "suppressions": null + }, + { + "severity": "MEDIUM", + "confidence": "HIGH", + "cwe": { + "id": "22", + "url": "https://cwe.mitre.org/data/definitions/22.html" + }, + "rule_id": "G304", + "details": "Potential file inclusion via variable", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/family/family.go", + "code": "128: \ttmp := s.path + \".tmp\"\n129: \tfh, err := os.OpenFile(tmp, os.O_CREATE|os.O_TRUNC|os.O_WRONLY, 0o600)\n130: \tif err != nil {\n", + "line": "129", + "column": "13", + "nosec": false, + "suppressions": null + }, + { + "severity": "MEDIUM", + "confidence": "HIGH", + "cwe": { + "id": "22", + "url": "https://cwe.mitre.org/data/definitions/22.html" + }, + "rule_id": "G304", + "details": "Potential file inclusion via variable", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/crypto/crypto.go", + "code": "21: func LoadOrCreateKey(path string) ([]byte, error) {\n22: \tdata, err := os.ReadFile(path)\n23: \tif err == nil {\n", + "line": "22", + "column": "15", + "nosec": false, + "suppressions": null + }, + { + "severity": "MEDIUM", + "confidence": "HIGH", + "cwe": { + "id": "22", + "url": "https://cwe.mitre.org/data/definitions/22.html" + }, + "rule_id": "G304", + "details": "Potential file inclusion via variable", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/config/config.go", + "code": "372: func FileHash(path string) (string, error) {\n373: \tdata, err := os.ReadFile(path)\n374: \tif err != nil {\n", + "line": "373", + "column": "15", + "nosec": false, + "suppressions": null + }, + { + "severity": "MEDIUM", + "confidence": "HIGH", + "cwe": { + "id": "22", + "url": "https://cwe.mitre.org/data/definitions/22.html" + }, + "rule_id": "G304", + "details": "Potential file inclusion via variable", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/config/config.go", + "code": "334: func loadAndParse(path string) (*Config, error) {\n335: \tdata, err := os.ReadFile(path)\n336: \tif err != nil {\n", + "line": "335", + "column": "15", + "nosec": false, + "suppressions": null + }, + { + "severity": "MEDIUM", + "confidence": "HIGH", + "cwe": { + "id": "22", + "url": "https://cwe.mitre.org/data/definitions/22.html" + }, + "rule_id": "G304", + "details": "Potential file inclusion via variable", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/bootstrap/bootstrap.go", + "code": "269: \t}\n270: \tcurrent, err := os.ReadFile(configPath)\n271: \tif err != nil {\n", + "line": "270", + "column": "18", + "nosec": false, + "suppressions": null + }, + { + "severity": "MEDIUM", + "confidence": "HIGH", + "cwe": { + "id": "22", + "url": "https://cwe.mitre.org/data/definitions/22.html" + }, + "rule_id": "G304", + "details": "Potential file inclusion via variable", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/bootstrap/bootstrap.go", + "code": "185: \tbpath := Path()\n186: \tdata, err := os.ReadFile(bpath)\n187: \tif err != nil {\n", + "line": "186", + "column": "15", + "nosec": false, + "suppressions": null + }, + { + "severity": "MEDIUM", + "confidence": "HIGH", + "cwe": { + "id": "22", + "url": "https://cwe.mitre.org/data/definitions/22.html" + }, + "rule_id": "G304", + "details": "Potential file inclusion via variable", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/bootstrap/bootstrap.go", + "code": "110: \tbpath := Path()\n111: \tdata, err := os.ReadFile(bpath)\n112: \tif err != nil {\n", + "line": "111", + "column": "15", + "nosec": false, + "suppressions": null + }, + { + "severity": "MEDIUM", + "confidence": "HIGH", + "cwe": { + "id": "22", + "url": "https://cwe.mitre.org/data/definitions/22.html" + }, + "rule_id": "G304", + "details": "Potential file inclusion via variable", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/backup/tier2_whole.go", + "code": "86: \ttmp := dst + \".felhom-restoring\"\n87: \tout, err := os.OpenFile(tmp, os.O_WRONLY|os.O_CREATE|os.O_EXCL, fi.Mode().Perm())\n88: \tif err != nil {\n", + "line": "87", + "column": "14", + "nosec": false, + "suppressions": null + }, + { + "severity": "MEDIUM", + "confidence": "HIGH", + "cwe": { + "id": "22", + "url": "https://cwe.mitre.org/data/definitions/22.html" + }, + "rule_id": "G304", + "details": "Potential file inclusion via variable", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/backup/tier2_whole.go", + "code": "80: func copyFilePreserving(src, dst string, fi fs.FileInfo) error {\n81: \tin, err := os.Open(src)\n82: \tif err != nil {\n", + "line": "81", + "column": "13", + "nosec": false, + "suppressions": null + }, + { + "severity": "MEDIUM", + "confidence": "HIGH", + "cwe": { + "id": "22", + "url": "https://cwe.mitre.org/data/definitions/22.html" + }, + "rule_id": "G304", + "details": "Potential file inclusion via variable", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/backup/tier2_whole.go", + "code": "65: func fileSHA(p string) ([]byte, error) {\n66: \tf, err := os.Open(p)\n67: \tif err != nil {\n", + "line": "66", + "column": "12", + "nosec": false, + "suppressions": null + }, + { + "severity": "MEDIUM", + "confidence": "HIGH", + "cwe": { + "id": "22", + "url": "https://cwe.mitre.org/data/definitions/22.html" + }, + "rule_id": "G304", + "details": "Potential file inclusion via variable", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/backup/shares_restore.go", + "code": "286: \tpassdb := filepath.Join(scratchJoin(scratch, m.sharesPayloadDir()), sharesPassdbName)\n287: \tif blob, rErr := os.ReadFile(passdb); rErr == nil \u0026\u0026 len(blob) \u003e 0 {\n288: \t\tif pErr := m.sharesPassdbRestorer()(blob); pErr != nil {\n", + "line": "287", + "column": "19", + "nosec": false, + "suppressions": null + }, + { + "severity": "MEDIUM", + "confidence": "HIGH", + "cwe": { + "id": "22", + "url": "https://cwe.mitre.org/data/definitions/22.html" + }, + "rule_id": "G304", + "details": "Potential file inclusion via variable", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/backup/shares_restore.go", + "code": "198: \tp := filepath.Join(scratchJoin(scratch, m.sharesPayloadDir()), sharesManifestName)\n199: \tblob, err := os.ReadFile(p)\n200: \tif err != nil {\n", + "line": "199", + "column": "15", + "nosec": false, + "suppressions": null + }, + { + "severity": "MEDIUM", + "confidence": "HIGH", + "cwe": { + "id": "22", + "url": "https://cwe.mitre.org/data/definitions/22.html" + }, + "rule_id": "G304", + "details": "Potential file inclusion via variable", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/backup/restore_unit.go", + "code": "91: \tnonSecret, unitSecrets = map[string]string{}, map[string]string{}\n92: \tdata, err := os.ReadFile(path)\n93: \tif err != nil {\n", + "line": "92", + "column": "15", + "nosec": false, + "suppressions": null + }, + { + "severity": "MEDIUM", + "confidence": "HIGH", + "cwe": { + "id": "22", + "url": "https://cwe.mitre.org/data/definitions/22.html" + }, + "rule_id": "G304", + "details": "Potential file inclusion via variable", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/backup/recovery_unit.go", + "code": "627: \ttmp := path + \".tmp\"\n628: \tf, err := os.OpenFile(tmp, os.O_CREATE|os.O_TRUNC|os.O_WRONLY, perm)\n629: \tif err != nil {\n", + "line": "628", + "column": "12", + "nosec": false, + "suppressions": null + }, + { + "severity": "MEDIUM", + "confidence": "HIGH", + "cwe": { + "id": "22", + "url": "https://cwe.mitre.org/data/definitions/22.html" + }, + "rule_id": "G304", + "details": "Potential file inclusion via variable", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/backup/recovery_unit.go", + "code": "568: func readManifest(path string) *RecoveryManifest {\n569: \tdata, err := os.ReadFile(path)\n570: \tif err != nil {\n", + "line": "569", + "column": "15", + "nosec": false, + "suppressions": null + }, + { + "severity": "MEDIUM", + "confidence": "HIGH", + "cwe": { + "id": "22", + "url": "https://cwe.mitre.org/data/definitions/22.html" + }, + "rule_id": "G304", + "details": "Potential file inclusion via variable", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/backup/recovery_unit.go", + "code": "197: \t\tfor _, fname := range []string{\"docker-compose.yml\", \".felhom.yml\", \"app.yaml\"} {\n198: \t\t\tb, err := os.ReadFile(filepath.Join(composeDir, fname))\n199: \t\t\tif err != nil {\n", + "line": "198", + "column": "14", + "nosec": false, + "suppressions": null + }, + { + "severity": "MEDIUM", + "confidence": "HIGH", + "cwe": { + "id": "22", + "url": "https://cwe.mitre.org/data/definitions/22.html" + }, + "rule_id": "G304", + "details": "Potential file inclusion via variable", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/backup/recovery_unit.go", + "code": "141: \t\t}\n142: \t\tdata, err := os.ReadFile(src)\n143: \t\tif err != nil {\n", + "line": "142", + "column": "16", + "nosec": false, + "suppressions": null + }, + { + "severity": "MEDIUM", + "confidence": "HIGH", + "cwe": { + "id": "22", + "url": "https://cwe.mitre.org/data/definitions/22.html" + }, + "rule_id": "G304", + "details": "Potential file inclusion via variable", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/backup/offbox_restore.go", + "code": "566: \t}\n567: \tdata, rErr := os.ReadFile(filepath.Join(scratch, scratchMarkerName))\n568: \tif rErr != nil {\n", + "line": "567", + "column": "16", + "nosec": false, + "suppressions": null + }, + { + "severity": "MEDIUM", + "confidence": "HIGH", + "cwe": { + "id": "22", + "url": "https://cwe.mitre.org/data/definitions/22.html" + }, + "rule_id": "G304", + "details": "Potential file inclusion via variable", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/backup/offbox_restore.go", + "code": "466: \ttmp := final + \".tmp\"\n467: \tf, err := os.OpenFile(tmp, os.O_WRONLY|os.O_CREATE|os.O_TRUNC, 0o600)\n468: \tif err != nil {\n", + "line": "467", + "column": "12", + "nosec": false, + "suppressions": null + }, + { + "severity": "MEDIUM", + "confidence": "HIGH", + "cwe": { + "id": "22", + "url": "https://cwe.mitre.org/data/definitions/22.html" + }, + "rule_id": "G304", + "details": "Potential file inclusion via variable", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/backup/offbox_reconstitute.go", + "code": "473: \tfor _, fname := range []string{\"docker-compose.yml\", \".felhom.yml\"} {\n474: \t\tdata, rErr := os.ReadFile(filepath.Join(filepath.Dir(composePath), fname))\n475: \t\tif rErr != nil {\n", + "line": "474", + "column": "17", + "nosec": false, + "suppressions": null + }, + { + "severity": "MEDIUM", + "confidence": "HIGH", + "cwe": { + "id": "22", + "url": "https://cwe.mitre.org/data/definitions/22.html" + }, + "rule_id": "G304", + "details": "Potential file inclusion via variable", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/backup/offbox_placement.go", + "code": "188: func readRecordedAddress(appYAMLPath string) RecordedAddress {\n189: \traw, err := os.ReadFile(appYAMLPath)\n190: \tif err != nil {\n", + "line": "189", + "column": "14", + "nosec": false, + "suppressions": null + }, + { + "severity": "MEDIUM", + "confidence": "HIGH", + "cwe": { + "id": "22", + "url": "https://cwe.mitre.org/data/definitions/22.html" + }, + "rule_id": "G304", + "details": "Potential file inclusion via variable", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/backup/kept_load.go", + "code": "78: func unitHDDPath(unitDir string) string {\n79: \tb, err := os.ReadFile(filepath.Join(unitDir, \"compose\", \"app.yaml\"))\n80: \tif err != nil {\n", + "line": "79", + "column": "12", + "nosec": false, + "suppressions": null + }, + { + "severity": "MEDIUM", + "confidence": "HIGH", + "cwe": { + "id": "22", + "url": "https://cwe.mitre.org/data/definitions/22.html" + }, + "rule_id": "G304", + "details": "Potential file inclusion via variable", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/backup/data_versions.go", + "code": "83: func readDataStamps(unitDir string) map[string]DataStamp {\n84: \tdata, err := os.ReadFile(filepath.Join(unitDir, dataStampsFile))\n85: \tif err != nil {\n", + "line": "84", + "column": "15", + "nosec": false, + "suppressions": null + }, + { + "severity": "MEDIUM", + "confidence": "HIGH", + "cwe": { + "id": "22", + "url": "https://cwe.mitre.org/data/definitions/22.html" + }, + "rule_id": "G304", + "details": "Potential file inclusion via variable", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/backup/backup.go", + "code": "958: \t// while a writable handle syncs on every platform. Content is not modified.\n959: \tf, err := os.OpenFile(tmpPath, os.O_RDWR, 0)\n960: \tif err != nil {\n", + "line": "959", + "column": "12", + "nosec": false, + "suppressions": null + }, + { + "severity": "MEDIUM", + "confidence": "HIGH", + "cwe": { + "id": "22", + "url": "https://cwe.mitre.org/data/definitions/22.html" + }, + "rule_id": "G304", + "details": "Potential file inclusion via variable", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/backup/appstop_marker.go", + "code": "374: \ttmp := g.path + \".tmp\"\n375: \tf, err := os.OpenFile(tmp, os.O_WRONLY|os.O_CREATE|os.O_TRUNC, 0o600)\n376: \tif err != nil {\n", + "line": "375", + "column": "12", + "nosec": false, + "suppressions": null + }, + { + "severity": "MEDIUM", + "confidence": "HIGH", + "cwe": { + "id": "22", + "url": "https://cwe.mitre.org/data/definitions/22.html" + }, + "rule_id": "G304", + "details": "Potential file inclusion via variable", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/assets/syncer.go", + "code": "333: func fileSHA256(path string) (string, error) {\n334: \tf, err := os.Open(path)\n335: \tif err != nil {\n", + "line": "334", + "column": "12", + "nosec": false, + "suppressions": null + }, + { + "severity": "MEDIUM", + "confidence": "HIGH", + "cwe": { + "id": "22", + "url": "https://cwe.mitre.org/data/definitions/22.html" + }, + "rule_id": "G304", + "details": "Potential file inclusion via variable", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/assets/syncer.go", + "code": "297: \n298: \tout, err := os.Create(tmp)\n299: \tif err != nil {\n", + "line": "298", + "column": "14", + "nosec": false, + "suppressions": null + }, + { + "severity": "MEDIUM", + "confidence": "HIGH", + "cwe": { + "id": "22", + "url": "https://cwe.mitre.org/data/definitions/22.html" + }, + "rule_id": "G304", + "details": "Potential file inclusion via variable", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/appexport/restore.go", + "code": "1133: func extractTar(tarPath, destDir string) error {\n1134: \tf, err := os.Open(tarPath)\n1135: \tif err != nil {\n", + "line": "1134", + "column": "12", + "nosec": false, + "suppressions": null + }, + { + "severity": "MEDIUM", + "confidence": "HIGH", + "cwe": { + "id": "22", + "url": "https://cwe.mitre.org/data/definitions/22.html" + }, + "rule_id": "G304", + "details": "Potential file inclusion via variable", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/appexport/restore.go", + "code": "1079: func extractTarGz(tgzPath, destDir string) error {\n1080: \tf, err := os.Open(tgzPath)\n1081: \tif err != nil {\n", + "line": "1080", + "column": "12", + "nosec": false, + "suppressions": null + }, + { + "severity": "MEDIUM", + "confidence": "HIGH", + "cwe": { + "id": "22", + "url": "https://cwe.mitre.org/data/definitions/22.html" + }, + "rule_id": "G304", + "details": "Potential file inclusion via variable", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/appexport/restore.go", + "code": "1020: \t// Open the dump file\n1021: \tf, err := os.Open(dumpPath)\n1022: \tif err != nil {\n", + "line": "1021", + "column": "12", + "nosec": false, + "suppressions": null + }, + { + "severity": "MEDIUM", + "confidence": "HIGH", + "cwe": { + "id": "22", + "url": "https://cwe.mitre.org/data/definitions/22.html" + }, + "rule_id": "G304", + "details": "Potential file inclusion via variable", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/appexport/restore.go", + "code": "863: func findDBServiceInCompose(composePath string) *dbServiceInfo {\n864: \tdata, err := os.ReadFile(composePath)\n865: \tif err != nil {\n", + "line": "864", + "column": "15", + "nosec": false, + "suppressions": null + }, + { + "severity": "MEDIUM", + "confidence": "HIGH", + "cwe": { + "id": "22", + "url": "https://cwe.mitre.org/data/definitions/22.html" + }, + "rule_id": "G304", + "details": "Potential file inclusion via variable", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/appexport/restore.go", + "code": "713: \treturn e.withVolumeHelper(volName, func(cid string) error {\n714: \t\tf, err := os.Open(tarPath)\n715: \t\tif err != nil {\n", + "line": "714", + "column": "13", + "nosec": false, + "suppressions": null + }, + { + "severity": "MEDIUM", + "confidence": "HIGH", + "cwe": { + "id": "22", + "url": "https://cwe.mitre.org/data/definitions/22.html" + }, + "rule_id": "G304", + "details": "Potential file inclusion via variable", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/appexport/restore.go", + "code": "646: func resolveHDDMounts(composePath string, env map[string]string) []string {\n647: \tdata, err := os.ReadFile(composePath)\n648: \tif err != nil {\n", + "line": "647", + "column": "15", + "nosec": false, + "suppressions": null + }, + { + "severity": "MEDIUM", + "confidence": "HIGH", + "cwe": { + "id": "22", + "url": "https://cwe.mitre.org/data/definitions/22.html" + }, + "rule_id": "G304", + "details": "Potential file inclusion via variable", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/appexport/restore.go", + "code": "543: func readPlaintextAppYaml(path string) (map[string]string, error) {\n544: \tdata, err := os.ReadFile(path)\n545: \tif err != nil {\n", + "line": "544", + "column": "15", + "nosec": false, + "suppressions": null + }, + { + "severity": "MEDIUM", + "confidence": "HIGH", + "cwe": { + "id": "22", + "url": "https://cwe.mitre.org/data/definitions/22.html" + }, + "rule_id": "G304", + "details": "Potential file inclusion via variable", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/appexport/restore.go", + "code": "304: \t// Read manifest\n305: \tmanifestData, err := os.ReadFile(filepath.Join(tmpDir, \"manifest.json\"))\n306: \tif err != nil {\n", + "line": "305", + "column": "23", + "nosec": false, + "suppressions": null + }, + { + "severity": "MEDIUM", + "confidence": "HIGH", + "cwe": { + "id": "22", + "url": "https://cwe.mitre.org/data/definitions/22.html" + }, + "rule_id": "G304", + "details": "Potential file inclusion via variable", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/appexport/restore.go", + "code": "130: func ReadManifestFromFAB(fabPath string) (*Manifest, error) {\n131: \tf, err := os.Open(fabPath)\n132: \tif err != nil {\n", + "line": "131", + "column": "12", + "nosec": false, + "suppressions": null + }, + { + "severity": "MEDIUM", + "confidence": "HIGH", + "cwe": { + "id": "22", + "url": "https://cwe.mitre.org/data/definitions/22.html" + }, + "rule_id": "G304", + "details": "Potential file inclusion via variable", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/appexport/fabplan.go", + "code": "302: \t\t}\n303: \t\tf, err := os.Open(path)\n304: \t\tif err != nil {\n", + "line": "303", + "column": "13", + "nosec": false, + "suppressions": null + }, + { + "severity": "MEDIUM", + "confidence": "HIGH", + "cwe": { + "id": "22", + "url": "https://cwe.mitre.org/data/definitions/22.html" + }, + "rule_id": "G304", + "details": "Potential file inclusion via variable", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/appexport/fabplan.go", + "code": "263: \t}\n264: \toutFile, err := os.Create(outputPath)\n265: \tif err != nil {\n", + "line": "264", + "column": "18", + "nosec": false, + "suppressions": null + }, + { + "severity": "MEDIUM", + "confidence": "HIGH", + "cwe": { + "id": "22", + "url": "https://cwe.mitre.org/data/definitions/22.html" + }, + "rule_id": "G304", + "details": "Potential file inclusion via variable", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/appexport/export.go", + "code": "940: \n941: \tout, err := os.Create(dst)\n942: \tif err != nil {\n", + "line": "941", + "column": "14", + "nosec": false, + "suppressions": null + }, + { + "severity": "MEDIUM", + "confidence": "HIGH", + "cwe": { + "id": "22", + "url": "https://cwe.mitre.org/data/definitions/22.html" + }, + "rule_id": "G304", + "details": "Potential file inclusion via variable", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/appexport/export.go", + "code": "934: func copyFile(src, dst string) error {\n935: \tin, err := os.Open(src)\n936: \tif err != nil {\n", + "line": "935", + "column": "13", + "nosec": false, + "suppressions": null + }, + { + "severity": "MEDIUM", + "confidence": "HIGH", + "cwe": { + "id": "22", + "url": "https://cwe.mitre.org/data/definitions/22.html" + }, + "rule_id": "G304", + "details": "Potential file inclusion via variable", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/appexport/export.go", + "code": "919: \n920: \tout, err := os.Create(dst)\n921: \tif err != nil {\n", + "line": "920", + "column": "14", + "nosec": false, + "suppressions": null + }, + { + "severity": "MEDIUM", + "confidence": "HIGH", + "cwe": { + "id": "22", + "url": "https://cwe.mitre.org/data/definitions/22.html" + }, + "rule_id": "G304", + "details": "Potential file inclusion via variable", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/appexport/export.go", + "code": "913: func gzipFile(src, dst string) error {\n914: \tin, err := os.Open(src)\n915: \tif err != nil {\n", + "line": "914", + "column": "13", + "nosec": false, + "suppressions": null + }, + { + "severity": "MEDIUM", + "confidence": "HIGH", + "cwe": { + "id": "22", + "url": "https://cwe.mitre.org/data/definitions/22.html" + }, + "rule_id": "G304", + "details": "Potential file inclusion via variable", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/appexport/export.go", + "code": "895: \n896: \t\tf, err := os.Open(path)\n897: \t\tif err != nil {\n", + "line": "896", + "column": "13", + "nosec": false, + "suppressions": null + }, + { + "severity": "MEDIUM", + "confidence": "HIGH", + "cwe": { + "id": "22", + "url": "https://cwe.mitre.org/data/definitions/22.html" + }, + "rule_id": "G304", + "details": "Potential file inclusion via variable", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/appexport/export.go", + "code": "855: func createTarGz(outputPath, sourceDir string) error {\n856: \toutFile, err := os.Create(outputPath)\n857: \tif err != nil {\n", + "line": "856", + "column": "18", + "nosec": false, + "suppressions": null + }, + { + "severity": "MEDIUM", + "confidence": "HIGH", + "cwe": { + "id": "22", + "url": "https://cwe.mitre.org/data/definitions/22.html" + }, + "rule_id": "G304", + "details": "Potential file inclusion via variable", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/appexport/export.go", + "code": "772: \treturn e.withVolumeHelper(volName, func(cid string) error {\n773: \t\tf, err := os.Create(tarPath)\n774: \t\tif err != nil {\n", + "line": "773", + "column": "13", + "nosec": false, + "suppressions": null + }, + { + "severity": "MEDIUM", + "confidence": "HIGH", + "cwe": { + "id": "22", + "url": "https://cwe.mitre.org/data/definitions/22.html" + }, + "rule_id": "G304", + "details": "Potential file inclusion via variable", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/appexport/crypto.go", + "code": "185: \n186: \tout, err := os.Create(outputPath)\n187: \tif err != nil {\n", + "line": "186", + "column": "14", + "nosec": false, + "suppressions": null + }, + { + "severity": "MEDIUM", + "confidence": "HIGH", + "cwe": { + "id": "22", + "url": "https://cwe.mitre.org/data/definitions/22.html" + }, + "rule_id": "G304", + "details": "Potential file inclusion via variable", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/appexport/crypto.go", + "code": "133: func DecryptFile(inputPath, outputPath, password string) error {\n134: \tin, err := os.Open(inputPath)\n135: \tif err != nil {\n", + "line": "134", + "column": "13", + "nosec": false, + "suppressions": null + }, + { + "severity": "MEDIUM", + "confidence": "HIGH", + "cwe": { + "id": "22", + "url": "https://cwe.mitre.org/data/definitions/22.html" + }, + "rule_id": "G304", + "details": "Potential file inclusion via variable", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/appexport/crypto.go", + "code": "63: \n64: \tout, err := os.Create(outputPath)\n65: \tif err != nil {\n", + "line": "64", + "column": "14", + "nosec": false, + "suppressions": null + }, + { + "severity": "MEDIUM", + "confidence": "HIGH", + "cwe": { + "id": "22", + "url": "https://cwe.mitre.org/data/definitions/22.html" + }, + "rule_id": "G304", + "details": "Potential file inclusion via variable", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/appexport/crypto.go", + "code": "57: func EncryptFile(inputPath, outputPath, password string) error {\n58: \tin, err := os.Open(inputPath)\n59: \tif err != nil {\n", + "line": "58", + "column": "13", + "nosec": false, + "suppressions": null + }, + { + "severity": "MEDIUM", + "confidence": "HIGH", + "cwe": { + "id": "22", + "url": "https://cwe.mitre.org/data/definitions/22.html" + }, + "rule_id": "G304", + "details": "Potential file inclusion via variable", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/appexport/crypto.go", + "code": "39: func IsEncryptedFAB(path string) (bool, error) {\n40: \tf, err := os.Open(path)\n41: \tif err != nil {\n", + "line": "40", + "column": "12", + "nosec": false, + "suppressions": null + }, + { + "severity": "MEDIUM", + "confidence": "HIGH", + "cwe": { + "id": "22", + "url": "https://cwe.mitre.org/data/definitions/22.html" + }, + "rule_id": "G304", + "details": "Potential file inclusion via variable", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/appbackup/dbservices.go", + "code": "65: func DBServiceNames(composePath string) ([]string, error) {\n66: \tdata, err := os.ReadFile(composePath)\n67: \tif err != nil {\n", + "line": "66", + "column": "15", + "nosec": false, + "suppressions": null + }, + { + "severity": "MEDIUM", + "confidence": "HIGH", + "cwe": { + "id": "22", + "url": "https://cwe.mitre.org/data/definitions/22.html" + }, + "rule_id": "G304", + "details": "Potential file inclusion via variable", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/appbackup/dbdump.go", + "code": "1028: \t}\n1029: \tf, err := os.Open(path)\n1030: \tif err != nil {\n", + "line": "1029", + "column": "12", + "nosec": false, + "suppressions": null + }, + { + "severity": "MEDIUM", + "confidence": "HIGH", + "cwe": { + "id": "22", + "url": "https://cwe.mitre.org/data/definitions/22.html" + }, + "rule_id": "G304", + "details": "Potential file inclusion via variable", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/appbackup/dbdump.go", + "code": "744: \n745: \tf, err := os.Open(dumpPath)\n746: \tif err != nil {\n", + "line": "745", + "column": "12", + "nosec": false, + "suppressions": null + }, + { + "severity": "MEDIUM", + "confidence": "HIGH", + "cwe": { + "id": "22", + "url": "https://cwe.mitre.org/data/definitions/22.html" + }, + "rule_id": "G304", + "details": "Potential file inclusion via variable", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/appbackup/dbdump.go", + "code": "454: \t// Large dumps (500MB+) would cause massive allocations on every 5-min cache refresh.\n455: \tf, err := os.Open(filePath)\n456: \tif err != nil {\n", + "line": "455", + "column": "12", + "nosec": false, + "suppressions": null + }, + { + "severity": "MEDIUM", + "confidence": "HIGH", + "cwe": { + "id": "22", + "url": "https://cwe.mitre.org/data/definitions/22.html" + }, + "rule_id": "G304", + "details": "Potential file inclusion via variable", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/appbackup/dbdump.go", + "code": "345: \t// Write output to tmp file\n346: \ttmpFile, err := os.Create(tmpPath)\n347: \tif err != nil {\n", + "line": "346", + "column": "18", + "nosec": false, + "suppressions": null + }, + { + "severity": "MEDIUM", + "confidence": "HIGH", + "cwe": { + "id": "22", + "url": "https://cwe.mitre.org/data/definitions/22.html" + }, + "rule_id": "G304", + "details": "Potential file inclusion via variable", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/appbackup/dbdump.go", + "code": "233: var syncDumpDir = func(dir string) error {\n234: \td, err := os.Open(dir)\n235: \tif err != nil {\n", + "line": "234", + "column": "12", + "nosec": false, + "suppressions": null + }, + { + "severity": "MEDIUM", + "confidence": "HIGH", + "cwe": { + "id": "22", + "url": "https://cwe.mitre.org/data/definitions/22.html" + }, + "rule_id": "G304", + "details": "Potential file inclusion via variable", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/appbackup/appdata.go", + "code": "214: func ParseComposeNamedVolumes(composePath string) []AppDockerVolume {\n215: \tdata, err := os.ReadFile(composePath)\n216: \tif err != nil {\n", + "line": "215", + "column": "15", + "nosec": false, + "suppressions": null + }, + { + "severity": "MEDIUM", + "confidence": "HIGH", + "cwe": { + "id": "22", + "url": "https://cwe.mitre.org/data/definitions/22.html" + }, + "rule_id": "G304", + "details": "Potential file inclusion via variable", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/appbackup/appdata.go", + "code": "95: func ParseComposeImages(composePath string) []string {\n96: \tdata, err := os.ReadFile(composePath)\n97: \tif err != nil {\n", + "line": "96", + "column": "15", + "nosec": false, + "suppressions": null + }, + { + "severity": "MEDIUM", + "confidence": "HIGH", + "cwe": { + "id": "22", + "url": "https://cwe.mitre.org/data/definitions/22.html" + }, + "rule_id": "G304", + "details": "Potential file inclusion via variable", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/cmd/controller/main.go", + "code": "3196: \tfor _, fname := range []string{\"docker-compose.yml\", \".felhom.yml\"} {\n3197: \t\tdata, err := os.ReadFile(filepath.Join(composeSrcDir, fname))\n3198: \t\tif err != nil {\n", + "line": "3197", + "column": "16", + "nosec": false, + "suppressions": null + }, + { + "severity": "MEDIUM", + "confidence": "MEDIUM", + "cwe": { + "id": "409", + "url": "https://cwe.mitre.org/data/definitions/409.html" + }, + "rule_id": "G110", + "details": "Potential DoS vulnerability via decompression bomb", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/appexport/restore.go", + "code": "1169: \t\t\t}\n1170: \t\t\tif _, err := io.Copy(outFile, tr); err != nil {\n1171: \t\t\t\toutFile.Close()\n", + "line": "1170", + "column": "17", + "nosec": false, + "suppressions": null + }, + { + "severity": "MEDIUM", + "confidence": "MEDIUM", + "cwe": { + "id": "409", + "url": "https://cwe.mitre.org/data/definitions/409.html" + }, + "rule_id": "G110", + "details": "Potential DoS vulnerability via decompression bomb", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/appexport/restore.go", + "code": "1121: \t\t\t}\n1122: \t\t\tif _, err := io.Copy(outFile, tr); err != nil {\n1123: \t\t\t\toutFile.Close()\n", + "line": "1122", + "column": "17", + "nosec": false, + "suppressions": null + }, + { + "severity": "MEDIUM", + "confidence": "HIGH", + "cwe": { + "id": "22", + "url": "https://cwe.mitre.org/data/definitions/22.html" + }, + "rule_id": "G305", + "details": "File traversal when extracting zip/tar archive", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/appexport/restore.go", + "code": "1149: \n1150: \t\ttarget := filepath.Join(destDir, hdr.Name)\n1151: \n", + "line": "1150", + "column": "13", + "nosec": false, + "suppressions": null + }, + { + "severity": "MEDIUM", + "confidence": "HIGH", + "cwe": { + "id": "22", + "url": "https://cwe.mitre.org/data/definitions/22.html" + }, + "rule_id": "G305", + "details": "File traversal when extracting zip/tar archive", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/appexport/restore.go", + "code": "1101: \n1102: \t\ttarget := filepath.Join(destDir, hdr.Name)\n1103: \n", + "line": "1102", + "column": "13", + "nosec": false, + "suppressions": null + }, + { + "severity": "MEDIUM", + "confidence": "HIGH", + "cwe": { + "id": "276", + "url": "https://cwe.mitre.org/data/definitions/276.html" + }, + "rule_id": "G302", + "details": "Expect file permissions to be 0600 or less", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/web/handler_export_upload.go", + "code": "195: \t}\n196: \tf, err := os.OpenFile(job.partPath, os.O_CREATE|os.O_EXCL|os.O_WRONLY, 0644)\n197: \tif err != nil {\n", + "line": "196", + "column": "12", + "nosec": false, + "suppressions": null + }, + { + "severity": "MEDIUM", + "confidence": "HIGH", + "cwe": { + "id": "276", + "url": "https://cwe.mitre.org/data/definitions/276.html" + }, + "rule_id": "G302", + "details": "Expect file permissions to be 0600 or less", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/backup/shares_payload.go", + "code": "143: \t// Tighten an inherited-loose mode from an older layout (the passdb archive lives here).\n144: \tif chErr := os.Chmod(dir, 0o700); chErr != nil {\n145: \t\tm.logger.Printf(\"[WARN] [shares] payload dir chmod failed: %v\", chErr)\n", + "line": "144", + "column": "14", + "nosec": false, + "suppressions": null + }, + { + "severity": "MEDIUM", + "confidence": "HIGH", + "cwe": { + "id": "276", + "url": "https://cwe.mitre.org/data/definitions/276.html" + }, + "rule_id": "G301", + "details": "Expect directory permissions to be 0750 or less", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/web/sharing_handlers.go", + "code": "393: \t\t}\n394: \t\tif err := os.MkdirAll(dir, 0o775); err != nil {\n395: \t\t\ts.logger.Printf(\"[ERROR] [sharing] mkdir failed: %v\", err)\n", + "line": "394", + "column": "13", + "nosec": false, + "suppressions": null + }, + { + "severity": "MEDIUM", + "confidence": "HIGH", + "cwe": { + "id": "276", + "url": "https://cwe.mitre.org/data/definitions/276.html" + }, + "rule_id": "G301", + "details": "Expect directory permissions to be 0750 or less", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/web/handler_export_upload.go", + "code": "159: \texportDir := appexport.ExportDir(drive)\n160: \tif err := os.MkdirAll(exportDir, 0755); err != nil {\n161: \t\tlogx.Warnf(s.logger, \"[web] fab upload init: mkdir %s: %v\", exportDir, err)\n", + "line": "160", + "column": "12", + "nosec": false, + "suppressions": null + }, + { + "severity": "MEDIUM", + "confidence": "HIGH", + "cwe": { + "id": "276", + "url": "https://cwe.mitre.org/data/definitions/276.html" + }, + "rule_id": "G301", + "details": "Expect directory permissions to be 0750 or less", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/web/handler_export_download.go", + "code": "96: \tsweepFabDownloads(s.fabDownloadDir(), time.Now(), fabDownloadTTL, s.logger)\n97: \tif err := os.MkdirAll(s.fabDownloadDir(), 0755); err != nil {\n98: \t\tjsonError(w, s.errText(r, err), http.StatusInternalServerError)\n", + "line": "97", + "column": "12", + "nosec": false, + "suppressions": null + }, + { + "severity": "MEDIUM", + "confidence": "HIGH", + "cwe": { + "id": "276", + "url": "https://cwe.mitre.org/data/definitions/276.html" + }, + "rule_id": "G301", + "details": "Expect directory permissions to be 0750 or less", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/web/handler_export_download.go", + "code": "59: \t}\n60: \tif err := os.MkdirAll(s.fabDownloadDir(), 0755); err != nil {\n61: \t\tjsonError(w, s.errText(r, err), http.StatusInternalServerError)\n", + "line": "60", + "column": "12", + "nosec": false, + "suppressions": null + }, + { + "severity": "MEDIUM", + "confidence": "HIGH", + "cwe": { + "id": "276", + "url": "https://cwe.mitre.org/data/definitions/276.html" + }, + "rule_id": "G301", + "details": "Expect directory permissions to be 0750 or less", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/sync/sync.go", + "code": "438: \t\t\tisNew = true\n439: \t\t\tif err := os.MkdirAll(dstDir, 0755); err != nil {\n440: \t\t\t\ts.logger.Printf(\"[WARN] [sync] Failed to create stack dir %s: %v\", dstDir, err)\n", + "line": "439", + "column": "14", + "nosec": false, + "suppressions": null + }, + { + "severity": "MEDIUM", + "confidence": "HIGH", + "cwe": { + "id": "276", + "url": "https://cwe.mitre.org/data/definitions/276.html" + }, + "rule_id": "G301", + "details": "Expect directory permissions to be 0750 or less", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/sync/sync.go", + "code": "294: func (s *Syncer) gitCloneOrPull() error {\n295: \tif err := os.MkdirAll(filepath.Dir(s.cacheDir), 0755); err != nil {\n296: \t\treturn fmt.Errorf(\"creating cache parent dir: %w\", err)\n", + "line": "295", + "column": "12", + "nosec": false, + "suppressions": null + }, + { + "severity": "MEDIUM", + "confidence": "HIGH", + "cwe": { + "id": "276", + "url": "https://cwe.mitre.org/data/definitions/276.html" + }, + "rule_id": "G301", + "details": "Expect directory permissions to be 0750 or less", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/stacks/update.go", + "code": "1338: \t}\n1339: \tif err := os.MkdirAll(filepath.Dir(p), 0o755); err != nil {\n1340: \t\treturn err\n", + "line": "1339", + "column": "12", + "nosec": false, + "suppressions": null + }, + { + "severity": "MEDIUM", + "confidence": "HIGH", + "cwe": { + "id": "276", + "url": "https://cwe.mitre.org/data/definitions/276.html" + }, + "rule_id": "G301", + "details": "Expect directory permissions to be 0750 or less", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/stacks/update.go", + "code": "1055: \toutDir := filepath.Join(dir, \"hold-logs\", ts)\n1056: \tif err := os.MkdirAll(outDir, 0o755); err != nil {\n1057: \t\tm.logger.Printf(\"[ERROR] [stacks] update %s: cannot create the hold-log directory %s: %v — the hold still proceeds\", name, outDir, err)\n", + "line": "1056", + "column": "12", + "nosec": false, + "suppressions": null + }, + { + "severity": "MEDIUM", + "confidence": "HIGH", + "cwe": { + "id": "276", + "url": "https://cwe.mitre.org/data/definitions/276.html" + }, + "rule_id": "G301", + "details": "Expect directory permissions to be 0750 or less", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/stacks/undo.go", + "code": "477: \tmd := filepath.Join(dir, preUpdateMetaDir)\n478: \tif err := os.MkdirAll(md, 0o755); err != nil {\n479: \t\treturn \"\", err\n", + "line": "478", + "column": "12", + "nosec": false, + "suppressions": null + }, + { + "severity": "MEDIUM", + "confidence": "HIGH", + "cwe": { + "id": "276", + "url": "https://cwe.mitre.org/data/definitions/276.html" + }, + "rule_id": "G301", + "details": "Expect directory permissions to be 0750 or less", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/stacks/undo.go", + "code": "109: \td := filepath.Join(stackDir, appliedMetaDir)\n110: \tif err := os.MkdirAll(d, 0o755); err != nil {\n111: \t\treturn err\n", + "line": "110", + "column": "12", + "nosec": false, + "suppressions": null + }, + { + "severity": "MEDIUM", + "confidence": "HIGH", + "cwe": { + "id": "276", + "url": "https://cwe.mitre.org/data/definitions/276.html" + }, + "rule_id": "G301", + "details": "Expect directory permissions to be 0750 or less", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/stacks/signup_block.go", + "code": "61: \t}\n62: \tif err := os.MkdirAll(m.setupGateDir(), 0o755); err != nil {\n63: \t\treturn err\n", + "line": "62", + "column": "12", + "nosec": false, + "suppressions": null + }, + { + "severity": "MEDIUM", + "confidence": "HIGH", + "cwe": { + "id": "276", + "url": "https://cwe.mitre.org/data/definitions/276.html" + }, + "rule_id": "G301", + "details": "Expect directory permissions to be 0750 or less", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/stacks/setup_gate.go", + "code": "258: \t}\n259: \tif err := os.MkdirAll(m.setupGateDir(), 0o755); err != nil {\n260: \t\treturn nil, err\n", + "line": "259", + "column": "12", + "nosec": false, + "suppressions": null + }, + { + "severity": "MEDIUM", + "confidence": "HIGH", + "cwe": { + "id": "276", + "url": "https://cwe.mitre.org/data/definitions/276.html" + }, + "rule_id": "G301", + "details": "Expect directory permissions to be 0750 or less", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/stacks/samba.go", + "code": "189: func (m *Manager) writeSambaFiles(dir string, d infra.SambaData) (bool, error) {\n190: \tif err := os.MkdirAll(dir, 0o755); err != nil {\n191: \t\treturn false, fmt.Errorf(\"mkdir %s: %w\", dir, err)\n", + "line": "190", + "column": "12", + "nosec": false, + "suppressions": null + }, + { + "severity": "MEDIUM", + "confidence": "HIGH", + "cwe": { + "id": "276", + "url": "https://cwe.mitre.org/data/definitions/276.html" + }, + "rule_id": "G301", + "details": "Expect directory permissions to be 0750 or less", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/stacks/migrate.go", + "code": "1101: \t}\n1102: \tif err := os.MkdirAll(filepath.Dir(dst), 0o755); err != nil {\n1103: \t\treturn 0, err\n", + "line": "1102", + "column": "12", + "nosec": false, + "suppressions": null + }, + { + "severity": "MEDIUM", + "confidence": "HIGH", + "cwe": { + "id": "276", + "url": "https://cwe.mitre.org/data/definitions/276.html" + }, + "rule_id": "G301", + "details": "Expect directory permissions to be 0750 or less", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/stacks/migrate.go", + "code": "1084: \t}\n1085: \tif err := os.MkdirAll(filepath.Dir(dst), 0o755); err != nil {\n1086: \t\treturn err\n", + "line": "1085", + "column": "12", + "nosec": false, + "suppressions": null + }, + { + "severity": "MEDIUM", + "confidence": "HIGH", + "cwe": { + "id": "276", + "url": "https://cwe.mitre.org/data/definitions/276.html" + }, + "rule_id": "G301", + "details": "Expect directory permissions to be 0750 or less", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/stacks/migrate.go", + "code": "969: \t\t\t}\n970: \t\t\tif err := os.MkdirAll(dst, 0o755); err != nil {\n971: \t\t\t\treturn err\n", + "line": "970", + "column": "14", + "nosec": false, + "suppressions": null + }, + { + "severity": "MEDIUM", + "confidence": "HIGH", + "cwe": { + "id": "276", + "url": "https://cwe.mitre.org/data/definitions/276.html" + }, + "rule_id": "G301", + "details": "Expect directory permissions to be 0750 or less", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/stacks/migrate.go", + "code": "860: func rsyncCopy(ctx context.Context, src, dst string, onBytes func(int64)) error {\n861: \tif err := os.MkdirAll(dst, 0o755); err != nil {\n862: \t\treturn fmt.Errorf(\"mkdir %s: %w\", dst, err)\n", + "line": "861", + "column": "12", + "nosec": false, + "suppressions": null + }, + { + "severity": "MEDIUM", + "confidence": "HIGH", + "cwe": { + "id": "276", + "url": "https://cwe.mitre.org/data/definitions/276.html" + }, + "rule_id": "G301", + "details": "Expect directory permissions to be 0750 or less", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/stacks/migrate.go", + "code": "829: \t}\n830: \tif err := os.MkdirAll(filepath.Dir(m.journalPath()), 0o755); err != nil {\n831: \t\treturn err\n", + "line": "830", + "column": "12", + "nosec": false, + "suppressions": null + }, + { + "severity": "MEDIUM", + "confidence": "HIGH", + "cwe": { + "id": "276", + "url": "https://cwe.mitre.org/data/definitions/276.html" + }, + "rule_id": "G301", + "details": "Expect directory permissions to be 0750 or less", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/stacks/manager.go", + "code": "370: \n371: \tif err := os.MkdirAll(cfg.Paths.StacksDir, 0755); err != nil {\n372: \t\treturn nil, fmt.Errorf(\"creating stacks directory %s: %w\", cfg.Paths.StacksDir, err)\n", + "line": "371", + "column": "12", + "nosec": false, + "suppressions": null + }, + { + "severity": "MEDIUM", + "confidence": "HIGH", + "cwe": { + "id": "276", + "url": "https://cwe.mitre.org/data/definitions/276.html" + }, + "rule_id": "G301", + "details": "Expect directory permissions to be 0750 or less", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/stacks/kept.go", + "code": "443: \t\tif _, err := os.Stat(unitHome); os.IsNotExist(err) {\n444: \t\t\tif err := os.MkdirAll(filepath.Dir(unitHome), 0o755); err == nil {\n445: \t\t\t\tif err := renameFn(it.UnitDir, unitHome); err == nil {\n", + "line": "444", + "column": "14", + "nosec": false, + "suppressions": null + }, + { + "severity": "MEDIUM", + "confidence": "HIGH", + "cwe": { + "id": "276", + "url": "https://cwe.mitre.org/data/definitions/276.html" + }, + "rule_id": "G301", + "details": "Expect directory permissions to be 0750 or less", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/stacks/kept.go", + "code": "419: \t\t_ = os.Remove(to) // an EMPTY leftover directory only (checked above)\n420: \t\tif err := os.MkdirAll(filepath.Dir(to), 0o755); err != nil {\n421: \t\t\treturn \"\", err\n", + "line": "420", + "column": "13", + "nosec": false, + "suppressions": null + }, + { + "severity": "MEDIUM", + "confidence": "HIGH", + "cwe": { + "id": "276", + "url": "https://cwe.mitre.org/data/definitions/276.html" + }, + "rule_id": "G301", + "details": "Expect directory permissions to be 0750 or less", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/stacks/kept.go", + "code": "173: \t\tto := filepath.Join(dest, rel)\n174: \t\tif err := os.MkdirAll(filepath.Dir(to), 0o755); err != nil {\n175: \t\t\tundo()\n", + "line": "174", + "column": "13", + "nosec": false, + "suppressions": null + }, + { + "severity": "MEDIUM", + "confidence": "HIGH", + "cwe": { + "id": "276", + "url": "https://cwe.mitre.org/data/definitions/276.html" + }, + "rule_id": "G301", + "details": "Expect directory permissions to be 0750 or less", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/stacks/kept.go", + "code": "151: \t}\n152: \tif err := os.MkdirAll(dest, 0o755); err != nil {\n153: \t\treturn \"\", fmt.Errorf(\"creating the kept folder: %w\", err)\n", + "line": "152", + "column": "12", + "nosec": false, + "suppressions": null + }, + { + "severity": "MEDIUM", + "confidence": "HIGH", + "cwe": { + "id": "276", + "url": "https://cwe.mitre.org/data/definitions/276.html" + }, + "rule_id": "G301", + "details": "Expect directory permissions to be 0750 or less", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/stacks/install_hold.go", + "code": "66: \t}\n67: \tif err := os.MkdirAll(m.setupGateDir(), 0o755); err != nil {\n68: \t\treturn nil, err\n", + "line": "67", + "column": "12", + "nosec": false, + "suppressions": null + }, + { + "severity": "MEDIUM", + "confidence": "HIGH", + "cwe": { + "id": "276", + "url": "https://cwe.mitre.org/data/definitions/276.html" + }, + "rule_id": "G301", + "details": "Expect directory permissions to be 0750 or less", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/stacks/infra.go", + "code": "390: func writeInfraFiles(dir string, files map[string]infra.FileSpec) error {\n391: \tif err := os.MkdirAll(dir, 0o755); err != nil {\n392: \t\treturn fmt.Errorf(\"mkdir: %w\", err)\n", + "line": "391", + "column": "12", + "nosec": false, + "suppressions": null + }, + { + "severity": "MEDIUM", + "confidence": "HIGH", + "cwe": { + "id": "276", + "url": "https://cwe.mitre.org/data/definitions/276.html" + }, + "rule_id": "G301", + "details": "Expect directory permissions to be 0750 or less", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/stacks/infra.go", + "code": "319: \tdynDir := filepath.Join(traefikDir, \"dynamic\")\n320: \tif err := os.MkdirAll(dynDir, 0o755); err != nil {\n321: \t\treturn fmt.Errorf(\"mkdir dynamic: %w\", err)\n", + "line": "320", + "column": "12", + "nosec": false, + "suppressions": null + }, + { + "severity": "MEDIUM", + "confidence": "HIGH", + "cwe": { + "id": "276", + "url": "https://cwe.mitre.org/data/definitions/276.html" + }, + "rule_id": "G301", + "details": "Expect directory permissions to be 0750 or less", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/stacks/infra.go", + "code": "287: \tdynDir := filepath.Join(traefikDir, \"dynamic\")\n288: \tif err := os.MkdirAll(dynDir, 0o755); err != nil {\n289: \t\treturn fmt.Errorf(\"mkdir dynamic: %w\", err)\n", + "line": "288", + "column": "12", + "nosec": false, + "suppressions": null + }, + { + "severity": "MEDIUM", + "confidence": "HIGH", + "cwe": { + "id": "276", + "url": "https://cwe.mitre.org/data/definitions/276.html" + }, + "rule_id": "G301", + "details": "Expect directory permissions to be 0750 or less", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/stacks/infra.go", + "code": "263: \tm.logger.Printf(\"[INFO] [infra] deploying filebrowser → %s\", dir)\n264: \tif err := os.MkdirAll(dir, 0o755); err != nil {\n265: \t\treturn fmt.Errorf(\"mkdir: %w\", err)\n", + "line": "264", + "column": "12", + "nosec": false, + "suppressions": null + }, + { + "severity": "MEDIUM", + "confidence": "HIGH", + "cwe": { + "id": "276", + "url": "https://cwe.mitre.org/data/definitions/276.html" + }, + "rule_id": "G301", + "details": "Expect directory permissions to be 0750 or less", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/stacks/infra.go", + "code": "224: \tdynDir := filepath.Join(traefikDir, \"dynamic\")\n225: \tif err := os.MkdirAll(dynDir, 0o755); err != nil {\n226: \t\treturn fmt.Errorf(\"mkdir dynamic: %w\", err)\n", + "line": "225", + "column": "12", + "nosec": false, + "suppressions": null + }, + { + "severity": "MEDIUM", + "confidence": "HIGH", + "cwe": { + "id": "276", + "url": "https://cwe.mitre.org/data/definitions/276.html" + }, + "rule_id": "G301", + "details": "Expect directory permissions to be 0750 or less", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/stacks/infra.go", + "code": "151: \t}\n152: \tif err := os.MkdirAll(filepath.Join(dir, \"certs\"), 0o755); err != nil {\n153: \t\treturn fmt.Errorf(\"mkdir certs: %w\", err)\n", + "line": "152", + "column": "12", + "nosec": false, + "suppressions": null + }, + { + "severity": "MEDIUM", + "confidence": "HIGH", + "cwe": { + "id": "276", + "url": "https://cwe.mitre.org/data/definitions/276.html" + }, + "rule_id": "G301", + "details": "Expect directory permissions to be 0750 or less", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/stacks/infra.go", + "code": "148: \tm.logger.Printf(\"[INFO] [infra] deploying traefik → %s\", dir)\n149: \tif err := os.MkdirAll(filepath.Join(dir, \"dynamic\"), 0o755); err != nil {\n150: \t\treturn fmt.Errorf(\"mkdir dynamic: %w\", err)\n", + "line": "149", + "column": "12", + "nosec": false, + "suppressions": null + }, + { + "severity": "MEDIUM", + "confidence": "HIGH", + "cwe": { + "id": "276", + "url": "https://cwe.mitre.org/data/definitions/276.html" + }, + "rule_id": "G301", + "details": "Expect directory permissions to be 0750 or less", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/stacks/image_retention.go", + "code": "390: \t\tlen(deleted), strings.Join(strings.Fields(firstLine(before)), \" \"), strings.Join(strings.Fields(firstLine(after)), \" \"))\n391: \t_ = os.MkdirAll(filepath.Dir(m.imageRetentionMarker()), 0o755)\n392: \t_ = os.WriteFile(m.imageRetentionMarker(), []byte(fmt.Sprintf(\"deleted %d\\n%s\\n\", len(deleted), strings.Join(deleted, \"\\n\"))), 0o644)\n", + "line": "391", + "column": "6", + "nosec": false, + "suppressions": null + }, + { + "severity": "MEDIUM", + "confidence": "HIGH", + "cwe": { + "id": "276", + "url": "https://cwe.mitre.org/data/definitions/276.html" + }, + "rule_id": "G301", + "details": "Expect directory permissions to be 0750 or less", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/stacks/family_gate.go", + "code": "120: \t}\n121: \tif err := os.MkdirAll(m.setupGateDir(), 0o755); err != nil {\n122: \t\treturn nil, err\n", + "line": "121", + "column": "12", + "nosec": false, + "suppressions": null + }, + { + "severity": "MEDIUM", + "confidence": "HIGH", + "cwe": { + "id": "276", + "url": "https://cwe.mitre.org/data/definitions/276.html" + }, + "rule_id": "G301", + "details": "Expect directory permissions to be 0750 or less", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/setup/setup.go", + "code": "81: \n82: \tif err := os.MkdirAll(filepath.Dir(s.path), 0755); err != nil {\n83: \t\treturn err\n", + "line": "82", + "column": "12", + "nosec": false, + "suppressions": null + }, + { + "severity": "MEDIUM", + "confidence": "HIGH", + "cwe": { + "id": "276", + "url": "https://cwe.mitre.org/data/definitions/276.html" + }, + "rule_id": "G301", + "details": "Expect directory permissions to be 0750 or less", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/setup/handlers.go", + "code": "542: func atomicWriteFile(path string, data []byte, perm os.FileMode) error {\n543: \tif err := os.MkdirAll(filepath.Dir(path), 0755); err != nil {\n544: \t\treturn err\n", + "line": "543", + "column": "12", + "nosec": false, + "suppressions": null + }, + { + "severity": "MEDIUM", + "confidence": "HIGH", + "cwe": { + "id": "276", + "url": "https://cwe.mitre.org/data/definitions/276.html" + }, + "rule_id": "G301", + "details": "Expect directory permissions to be 0750 or less", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/settings/settings.go", + "code": "857: \ttmpPath := s.path + \".tmp\"\n858: \tif err := os.MkdirAll(filepath.Dir(s.path), 0755); err != nil {\n859: \t\tif s.log != nil {\n", + "line": "858", + "column": "12", + "nosec": false, + "suppressions": null + }, + { + "severity": "MEDIUM", + "confidence": "HIGH", + "cwe": { + "id": "276", + "url": "https://cwe.mitre.org/data/definitions/276.html" + }, + "rule_id": "G301", + "details": "Expect directory permissions to be 0750 or less", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/recovery/info.go", + "code": "20: func GenerateRecoveryFile(info Info, version, outputDir string) error {\n21: \tif err := os.MkdirAll(outputDir, 0755); err != nil {\n22: \t\treturn fmt.Errorf(\"creating recovery info directory: %w\", err)\n", + "line": "21", + "column": "12", + "nosec": false, + "suppressions": null + }, + { + "severity": "MEDIUM", + "confidence": "HIGH", + "cwe": { + "id": "276", + "url": "https://cwe.mitre.org/data/definitions/276.html" + }, + "rule_id": "G301", + "details": "Expect directory permissions to be 0750 or less", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/quiesce/quiesce.go", + "code": "867: \t}\n868: \tif err := os.MkdirAll(filepath.Dir(l.markerPath), 0o755); err != nil {\n869: \t\treturn err\n", + "line": "868", + "column": "12", + "nosec": false, + "suppressions": null + }, + { + "severity": "MEDIUM", + "confidence": "HIGH", + "cwe": { + "id": "276", + "url": "https://cwe.mitre.org/data/definitions/276.html" + }, + "rule_id": "G301", + "details": "Expect directory permissions to be 0750 or less", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/nightchain/nightchain.go", + "code": "112: \tb, _ := json.MarshalIndent(l.d, \"\", \" \")\n113: \tif err := os.MkdirAll(filepath.Dir(l.path), 0o755); err != nil {\n114: \t\treturn err\n", + "line": "113", + "column": "12", + "nosec": false, + "suppressions": null + }, + { + "severity": "MEDIUM", + "confidence": "HIGH", + "cwe": { + "id": "276", + "url": "https://cwe.mitre.org/data/definitions/276.html" + }, + "rule_id": "G301", + "details": "Expect directory permissions to be 0750 or less", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/fillwatch/fillwatch.go", + "code": "356: \t}\n357: \tif err := os.MkdirAll(filepath.Dir(w.statePath), 0o755); err != nil {\n358: \t\treturn err\n", + "line": "357", + "column": "12", + "nosec": false, + "suppressions": null + }, + { + "severity": "MEDIUM", + "confidence": "HIGH", + "cwe": { + "id": "276", + "url": "https://cwe.mitre.org/data/definitions/276.html" + }, + "rule_id": "G301", + "details": "Expect directory permissions to be 0750 or less", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/bootstrap/bootstrap.go", + "code": "314: func writeFileAtomic(path string, b []byte) error {\n315: \tif err := os.MkdirAll(filepath.Dir(path), 0o755); err != nil {\n316: \t\treturn fmt.Errorf(\"config dir: %w\", err)\n", + "line": "315", + "column": "12", + "nosec": false, + "suppressions": null + }, + { + "severity": "MEDIUM", + "confidence": "HIGH", + "cwe": { + "id": "276", + "url": "https://cwe.mitre.org/data/definitions/276.html" + }, + "rule_id": "G301", + "details": "Expect directory permissions to be 0750 or less", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/backup/tier2_restore.go", + "code": "463: func rsyncRestoreMissing(src, dst string) (int, error) {\n464: \tif err := os.MkdirAll(dst, 0755); err != nil {\n465: \t\treturn 0, fmt.Errorf(\"mkdir %s: %w\", dst, err)\n", + "line": "464", + "column": "12", + "nosec": false, + "suppressions": null + }, + { + "severity": "MEDIUM", + "confidence": "HIGH", + "cwe": { + "id": "276", + "url": "https://cwe.mitre.org/data/definitions/276.html" + }, + "rule_id": "G301", + "details": "Expect directory permissions to be 0750 or less", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/backup/tier2.go", + "code": "693: func rsyncMirror(src, dst string) error {\n694: \tif err := os.MkdirAll(dst, 0755); err != nil {\n695: \t\treturn fmt.Errorf(\"mkdir %s: %w\", dst, err)\n", + "line": "694", + "column": "12", + "nosec": false, + "suppressions": null + }, + { + "severity": "MEDIUM", + "confidence": "HIGH", + "cwe": { + "id": "276", + "url": "https://cwe.mitre.org/data/definitions/276.html" + }, + "rule_id": "G301", + "details": "Expect directory permissions to be 0750 or less", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/backup/shares_restore.go", + "code": "114: \t}\n115: \tif err := os.MkdirAll(scratch, 0o755); err != nil {\n116: \t\treturn m.restoreDirError(scratch, err)\n", + "line": "115", + "column": "12", + "nosec": false, + "suppressions": null + }, + { + "severity": "MEDIUM", + "confidence": "HIGH", + "cwe": { + "id": "276", + "url": "https://cwe.mitre.org/data/definitions/276.html" + }, + "rule_id": "G301", + "details": "Expect directory permissions to be 0750 or less", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/backup/recovery_unit.go", + "code": "250: \t}\n251: \tif err := os.MkdirAll(composeDir, 0755); err != nil {\n252: \t\treturn fmt.Errorf(\"creating recovery-unit compose dir: %w\", err)\n", + "line": "251", + "column": "12", + "nosec": false, + "suppressions": null + }, + { + "severity": "MEDIUM", + "confidence": "HIGH", + "cwe": { + "id": "276", + "url": "https://cwe.mitre.org/data/definitions/276.html" + }, + "rule_id": "G301", + "details": "Expect directory permissions to be 0750 or less", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/backup/offbox_restore.go", + "code": "378: \t}\n379: \tif err := os.MkdirAll(scratch, 0o755); err != nil {\n380: \t\treturn m.restoreDirError(scratch, err)\n", + "line": "379", + "column": "12", + "nosec": false, + "suppressions": null + }, + { + "severity": "MEDIUM", + "confidence": "HIGH", + "cwe": { + "id": "276", + "url": "https://cwe.mitre.org/data/definitions/276.html" + }, + "rule_id": "G301", + "details": "Expect directory permissions to be 0750 or less", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/backup/offbox_reconstitute.go", + "code": "235: \tdumpDir := AppDBDumpPath(nsRoot, stackName)\n236: \tif err := os.MkdirAll(dumpDir, 0755); err != nil {\n237: \t\treturn safetyDumpSet{}, util.MsgError(\"err.backup.a_biztonsagi_mentes_konyvtara_nem_hozhato\", err)\n", + "line": "236", + "column": "12", + "nosec": false, + "suppressions": null + }, + { + "severity": "MEDIUM", + "confidence": "HIGH", + "cwe": { + "id": "276", + "url": "https://cwe.mitre.org/data/definitions/276.html" + }, + "rule_id": "G301", + "details": "Expect directory permissions to be 0750 or less", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/backup/offbox_reconstitute.go", + "code": "116: func rsyncRestoreOverwrite(src, dst string) (int, error) {\n117: \tif err := os.MkdirAll(dst, 0755); err != nil {\n118: \t\treturn 0, fmt.Errorf(\"mkdir %s: %w\", dst, err)\n", + "line": "117", + "column": "12", + "nosec": false, + "suppressions": null + }, + { + "severity": "MEDIUM", + "confidence": "HIGH", + "cwe": { + "id": "276", + "url": "https://cwe.mitre.org/data/definitions/276.html" + }, + "rule_id": "G301", + "details": "Expect directory permissions to be 0750 or less", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/backup/offbox_proof.go", + "code": "319: func (m *Manager) restoreUnitReadOnly(ctx context.Context, stack, id, unitPath, scratch string) error {\n320: \tif err := os.MkdirAll(scratch, 0o755); err != nil {\n321: \t\treturn fmt.Errorf(\"proof scratch dir: %w\", err)\n", + "line": "320", + "column": "12", + "nosec": false, + "suppressions": null + }, + { + "severity": "MEDIUM", + "confidence": "HIGH", + "cwe": { + "id": "276", + "url": "https://cwe.mitre.org/data/definitions/276.html" + }, + "rule_id": "G301", + "details": "Expect directory permissions to be 0750 or less", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/backup/offbox.go", + "code": "1952: \t}\n1953: \tif err := os.MkdirAll(destDir, 0o755); err != nil {\n1954: \t\treturn m.restoreDirError(destDir, err)\n", + "line": "1953", + "column": "12", + "nosec": false, + "suppressions": null + }, + { + "severity": "MEDIUM", + "confidence": "HIGH", + "cwe": { + "id": "276", + "url": "https://cwe.mitre.org/data/definitions/276.html" + }, + "rule_id": "G301", + "details": "Expect directory permissions to be 0750 or less", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/backup/backup.go", + "code": "859: \tdumpDir := AppVolumeDumpPath(m.namespaceRoot(drivePath), stackName)\n860: \tif err := os.MkdirAll(dumpDir, 0755); err != nil {\n861: \t\treturn fmt.Errorf(\"creating volume dump dir: %w\", err)\n", + "line": "860", + "column": "12", + "nosec": false, + "suppressions": null + }, + { + "severity": "MEDIUM", + "confidence": "HIGH", + "cwe": { + "id": "276", + "url": "https://cwe.mitre.org/data/definitions/276.html" + }, + "rule_id": "G301", + "details": "Expect directory permissions to be 0750 or less", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/backup/appstop_marker.go", + "code": "370: \t}\n371: \tif err := os.MkdirAll(filepath.Dir(g.path), 0o755); err != nil {\n372: \t\treturn err\n", + "line": "371", + "column": "12", + "nosec": false, + "suppressions": null + }, + { + "severity": "MEDIUM", + "confidence": "HIGH", + "cwe": { + "id": "276", + "url": "https://cwe.mitre.org/data/definitions/276.html" + }, + "rule_id": "G301", + "details": "Expect directory permissions to be 0750 or less", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/assets/syncer.go", + "code": "95: \n96: \tif err := os.MkdirAll(s.assetsDir, 0755); err != nil {\n97: \t\ts.setError(fmt.Errorf(\"create assets dir: %w\", err))\n", + "line": "96", + "column": "12", + "nosec": false, + "suppressions": null + }, + { + "severity": "MEDIUM", + "confidence": "HIGH", + "cwe": { + "id": "276", + "url": "https://cwe.mitre.org/data/definitions/276.html" + }, + "rule_id": "G301", + "details": "Expect directory permissions to be 0750 or less", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/appexport/restore.go", + "code": "1162: \t\tcase tar.TypeReg:\n1163: \t\t\tif err := os.MkdirAll(filepath.Dir(target), 0755); err != nil {\n1164: \t\t\t\treturn err\n", + "line": "1163", + "column": "14", + "nosec": false, + "suppressions": null + }, + { + "severity": "MEDIUM", + "confidence": "HIGH", + "cwe": { + "id": "276", + "url": "https://cwe.mitre.org/data/definitions/276.html" + }, + "rule_id": "G301", + "details": "Expect directory permissions to be 0750 or less", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/appexport/restore.go", + "code": "1114: \t\tcase tar.TypeReg:\n1115: \t\t\tif err := os.MkdirAll(filepath.Dir(target), 0755); err != nil {\n1116: \t\t\t\treturn err\n", + "line": "1115", + "column": "14", + "nosec": false, + "suppressions": null + }, + { + "severity": "MEDIUM", + "confidence": "HIGH", + "cwe": { + "id": "276", + "url": "https://cwe.mitre.org/data/definitions/276.html" + }, + "rule_id": "G301", + "details": "Expect directory permissions to be 0750 or less", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/appexport/restore.go", + "code": "629: \n630: \t\tif err := os.MkdirAll(destPath, 0755); err != nil {\n631: \t\t\treturn fmt.Errorf(\"creating %s: %w\", destPath, err)\n", + "line": "630", + "column": "13", + "nosec": false, + "suppressions": null + }, + { + "severity": "MEDIUM", + "confidence": "HIGH", + "cwe": { + "id": "276", + "url": "https://cwe.mitre.org/data/definitions/276.html" + }, + "rule_id": "G301", + "details": "Expect directory permissions to be 0750 or less", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/appexport/restore.go", + "code": "376: \t\te.debugf(\"creating new stack directory: %s\", stackDir)\n377: \t\tif err := os.MkdirAll(stackDir, 0755); err != nil {\n378: \t\t\te.failJob(job, step, fmt.Sprintf(\"Könyvtár létrehozása sikertelen: %v\", err))\n", + "line": "377", + "column": "13", + "nosec": false, + "suppressions": null + }, + { + "severity": "MEDIUM", + "confidence": "HIGH", + "cwe": { + "id": "276", + "url": "https://cwe.mitre.org/data/definitions/276.html" + }, + "rule_id": "G301", + "details": "Expect directory permissions to be 0750 or less", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/appexport/export.go", + "code": "799: \tvolDir := filepath.Join(dataDir, \"volumes\")\n800: \tos.MkdirAll(volDir, 0755)\n801: \n", + "line": "800", + "column": "2", + "nosec": false, + "suppressions": null + }, + { + "severity": "MEDIUM", + "confidence": "HIGH", + "cwe": { + "id": "276", + "url": "https://cwe.mitre.org/data/definitions/276.html" + }, + "rule_id": "G301", + "details": "Expect directory permissions to be 0750 or less", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/appexport/export.go", + "code": "661: \thddDir := filepath.Join(dataDir, \"hdd\")\n662: \tos.MkdirAll(hddDir, 0755)\n663: \n", + "line": "662", + "column": "2", + "nosec": false, + "suppressions": null + }, + { + "severity": "MEDIUM", + "confidence": "HIGH", + "cwe": { + "id": "276", + "url": "https://cwe.mitre.org/data/definitions/276.html" + }, + "rule_id": "G301", + "details": "Expect directory permissions to be 0750 or less", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/appexport/export.go", + "code": "389: \tdataDir := filepath.Join(tmpDir, \"data\")\n390: \tos.MkdirAll(dataDir, 0755)\n391: \n", + "line": "390", + "column": "2", + "nosec": false, + "suppressions": null + }, + { + "severity": "MEDIUM", + "confidence": "HIGH", + "cwe": { + "id": "276", + "url": "https://cwe.mitre.org/data/definitions/276.html" + }, + "rule_id": "G301", + "details": "Expect directory permissions to be 0750 or less", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/appexport/export.go", + "code": "350: \tdbDir := filepath.Join(tmpDir, \"database\")\n351: \tos.MkdirAll(dbDir, 0755)\n352: \n", + "line": "351", + "column": "2", + "nosec": false, + "suppressions": null + }, + { + "severity": "MEDIUM", + "confidence": "HIGH", + "cwe": { + "id": "276", + "url": "https://cwe.mitre.org/data/definitions/276.html" + }, + "rule_id": "G301", + "details": "Expect directory permissions to be 0750 or less", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/appexport/export.go", + "code": "322: \tconfigDir := filepath.Join(tmpDir, \"config\")\n323: \tif err := os.MkdirAll(configDir, 0755); err != nil {\n324: \t\te.failJob(job, step, err.Error())\n", + "line": "323", + "column": "12", + "nosec": false, + "suppressions": null + }, + { + "severity": "MEDIUM", + "confidence": "HIGH", + "cwe": { + "id": "276", + "url": "https://cwe.mitre.org/data/definitions/276.html" + }, + "rule_id": "G301", + "details": "Expect directory permissions to be 0750 or less", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/appexport/export.go", + "code": "235: \te.debugf(\"export dest dir: %s\", destDir)\n236: \tif err := os.MkdirAll(destDir, 0755); err != nil {\n237: \t\te.failJob(job, step, fmt.Sprintf(\"Nem sikerült létrehozni az export könyvtárat: %v\", err))\n", + "line": "236", + "column": "12", + "nosec": false, + "suppressions": null + }, + { + "severity": "MEDIUM", + "confidence": "HIGH", + "cwe": { + "id": "276", + "url": "https://cwe.mitre.org/data/definitions/276.html" + }, + "rule_id": "G301", + "details": "Expect directory permissions to be 0750 or less", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/appexport/estimate.go", + "code": "116: \texportDir := ExportDir(destDrive)\n117: \tos.MkdirAll(exportDir, 0755)\n118: \test.DestFreeBytes = DiskFree(exportDir)\n", + "line": "117", + "column": "2", + "nosec": false, + "suppressions": null + }, + { + "severity": "MEDIUM", + "confidence": "HIGH", + "cwe": { + "id": "276", + "url": "https://cwe.mitre.org/data/definitions/276.html" + }, + "rule_id": "G301", + "details": "Expect directory permissions to be 0750 or less", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/appbackup/userdata.go", + "code": "122: func EnsureDirOwned(path string, gid int) error {\n123: \tif err := os.MkdirAll(path, 0o755); err != nil {\n124: \t\treturn err\n", + "line": "123", + "column": "12", + "nosec": false, + "suppressions": null + }, + { + "severity": "MEDIUM", + "confidence": "HIGH", + "cwe": { + "id": "276", + "url": "https://cwe.mitre.org/data/definitions/276.html" + }, + "rule_id": "G301", + "details": "Expect directory permissions to be 0750 or less", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/appbackup/dbdump.go", + "code": "281: \t// Ensure dump directory exists\n282: \tif err := os.MkdirAll(dumpDir, 0755); err != nil {\n283: \t\tresult.Error = fmt.Errorf(\"creating dump dir: %w\", err)\n", + "line": "282", + "column": "12", + "nosec": false, + "suppressions": null + }, + { + "severity": "MEDIUM", + "confidence": "HIGH", + "cwe": { + "id": "276", + "url": "https://cwe.mitre.org/data/definitions/276.html" + }, + "rule_id": "G306", + "details": "Expect WriteFile permissions to be 0600 or less", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/web/netprobe.go", + "code": "45: \tnonce := randHexToken(32)\n46: \tif err := os.WriteFile(name, []byte(nonce), 0o644); err != nil {\n47: \t\treturn netProbeExitNoWrite\n", + "line": "46", + "column": "12", + "nosec": false, + "suppressions": null + }, + { + "severity": "MEDIUM", + "confidence": "HIGH", + "cwe": { + "id": "276", + "url": "https://cwe.mitre.org/data/definitions/276.html" + }, + "rule_id": "G306", + "details": "Expect WriteFile permissions to be 0600 or less", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/web/handlers.go", + "code": "3660: \tcompose := infra.RenderFileBrowserCompose(domain, storageMounts, keptGroups...)\n3661: \tif err := os.WriteFile(composePath, []byte(compose), 0644); err != nil {\n3662: \t\ts.logger.Printf(\"[ERROR] [web] Failed to write FileBrowser compose: %v\", err)\n", + "line": "3661", + "column": "12", + "nosec": false, + "suppressions": null + }, + { + "severity": "MEDIUM", + "confidence": "HIGH", + "cwe": { + "id": "276", + "url": "https://cwe.mitre.org/data/definitions/276.html" + }, + "rule_id": "G306", + "details": "Expect WriteFile permissions to be 0600 or less", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/web/handlers.go", + "code": "3648: \n3649: \tif err := os.WriteFile(configPath, []byte(fbConfig), 0644); err != nil {\n3650: \t\ts.logger.Printf(\"[ERROR] [web] Failed to write FileBrowser config: %v\", err)\n", + "line": "3649", + "column": "12", + "nosec": false, + "suppressions": null + }, + { + "severity": "MEDIUM", + "confidence": "HIGH", + "cwe": { + "id": "276", + "url": "https://cwe.mitre.org/data/definitions/276.html" + }, + "rule_id": "G306", + "details": "Expect WriteFile permissions to be 0600 or less", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/web/handler_debug.go", + "code": "705: \tmarkerPath := filepath.Join(s.cfg.Paths.DataDir, \".needs-setup\")\n706: \tif err := os.WriteFile(markerPath, []byte(\"debug-triggered\\n\"), 0644); err != nil {\n707: \t\twriteDebugJSON(w, http.StatusInternalServerError, false,\n", + "line": "706", + "column": "12", + "nosec": false, + "suppressions": null + }, + { + "severity": "MEDIUM", + "confidence": "HIGH", + "cwe": { + "id": "276", + "url": "https://cwe.mitre.org/data/definitions/276.html" + }, + "rule_id": "G306", + "details": "Expect WriteFile permissions to be 0600 or less", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/web/disk_health_state.go", + "code": "154: \ttmp := path + \".tmp\"\n155: \tif err := os.WriteFile(tmp, data, 0644); err != nil {\n156: \t\treturn fmt.Errorf(\"writing temp disk-health state: %w\", err)\n", + "line": "155", + "column": "12", + "nosec": false, + "suppressions": null + }, + { + "severity": "MEDIUM", + "confidence": "HIGH", + "cwe": { + "id": "276", + "url": "https://cwe.mitre.org/data/definitions/276.html" + }, + "rule_id": "G306", + "details": "Expect WriteFile permissions to be 0600 or less", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/sync/sync.go", + "code": "678: \n679: \tif err := os.WriteFile(dst, srcData, 0644); err != nil {\n680: \t\treturn false, fmt.Errorf(\"writing %s: %w\", dst, err)\n", + "line": "679", + "column": "12", + "nosec": false, + "suppressions": null + }, + { + "severity": "MEDIUM", + "confidence": "HIGH", + "cwe": { + "id": "276", + "url": "https://cwe.mitre.org/data/definitions/276.html" + }, + "rule_id": "G306", + "details": "Expect WriteFile permissions to be 0600 or less", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/sync/sync.go", + "code": "654: \t}\n655: \tif err := os.WriteFile(dst, data, 0644); err != nil {\n656: \t\treturn false, fmt.Errorf(\"writing %s: %w\", dst, err)\n", + "line": "655", + "column": "12", + "nosec": false, + "suppressions": null + }, + { + "severity": "MEDIUM", + "confidence": "HIGH", + "cwe": { + "id": "276", + "url": "https://cwe.mitre.org/data/definitions/276.html" + }, + "rule_id": "G306", + "details": "Expect WriteFile permissions to be 0600 or less", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/stacks/update.go", + "code": "1152: \tif lerr == nil {\n1153: \t\tif err := os.WriteFile(ComposePathIn(dir), prevLive, 0o644); err != nil {\n1154: \t\t\tm.logger.Printf(\"[ERROR] [stacks] update %s: re-rendering the previous definition failed: %v\", name, err)\n", + "line": "1153", + "column": "13", + "nosec": false, + "suppressions": null + }, + { + "severity": "MEDIUM", + "confidence": "HIGH", + "cwe": { + "id": "276", + "url": "https://cwe.mitre.org/data/definitions/276.html" + }, + "rule_id": "G306", + "details": "Expect WriteFile permissions to be 0600 or less", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/stacks/update.go", + "code": "1064: \tpath := filepath.Join(outDir, \"compose-logs.txt\")\n1065: \tif werr := os.WriteFile(path, []byte(out), 0o644); werr != nil {\n1066: \t\tm.logger.Printf(\"[ERROR] [stacks] update %s: could not write %s: %v\", name, path, werr)\n", + "line": "1065", + "column": "13", + "nosec": false, + "suppressions": null + }, + { + "severity": "MEDIUM", + "confidence": "HIGH", + "cwe": { + "id": "276", + "url": "https://cwe.mitre.org/data/definitions/276.html" + }, + "rule_id": "G306", + "details": "Expect WriteFile permissions to be 0600 or less", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/stacks/update.go", + "code": "910: \tif applied, aerr := LoadAppliedDefinition(dir); aerr == nil {\n911: \t\tif err := os.WriteFile(filepath.Join(dir, preUpdateAppliedFile), applied, 0o644); err == nil {\n912: \t\t\tentry.PrevApplied = filepath.Join(dir, preUpdateAppliedFile)\n", + "line": "911", + "column": "13", + "nosec": false, + "suppressions": null + }, + { + "severity": "MEDIUM", + "confidence": "HIGH", + "cwe": { + "id": "276", + "url": "https://cwe.mitre.org/data/definitions/276.html" + }, + "rule_id": "G306", + "details": "Expect WriteFile permissions to be 0600 or less", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/stacks/update.go", + "code": "893: \t}\n894: \tif err := os.WriteFile(filepath.Join(dir, preUpdateComposeFile), prevLive, 0o644); err != nil {\n895: \t\tfail(\"update.error.journal_failed\", \"saving the pre-update compose copy: \"+err.Error())\n", + "line": "894", + "column": "12", + "nosec": false, + "suppressions": null + }, + { + "severity": "MEDIUM", + "confidence": "HIGH", + "cwe": { + "id": "276", + "url": "https://cwe.mitre.org/data/definitions/276.html" + }, + "rule_id": "G306", + "details": "Expect WriteFile permissions to be 0600 or less", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/stacks/undo.go", + "code": "480: \t}\n481: \tif err := os.WriteFile(filepath.Join(md, \".felhom.yml\"), src, 0o644); err != nil {\n482: \t\treturn \"\", err\n", + "line": "481", + "column": "12", + "nosec": false, + "suppressions": null + }, + { + "severity": "MEDIUM", + "confidence": "HIGH", + "cwe": { + "id": "276", + "url": "https://cwe.mitre.org/data/definitions/276.html" + }, + "rule_id": "G306", + "details": "Expect WriteFile permissions to be 0600 or less", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/stacks/undo.go", + "code": "113: \ttmp := filepath.Join(d, \".felhom.yml.tmp\")\n114: \tif err := os.WriteFile(tmp, src, 0o644); err != nil {\n115: \t\treturn err\n", + "line": "114", + "column": "12", + "nosec": false, + "suppressions": null + }, + { + "severity": "MEDIUM", + "confidence": "HIGH", + "cwe": { + "id": "276", + "url": "https://cwe.mitre.org/data/definitions/276.html" + }, + "rule_id": "G306", + "details": "Expect WriteFile permissions to be 0600 or less", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/stacks/signup_block.go", + "code": "70: \ttmp := p + \".tmp\"\n71: \tif err := os.WriteFile(tmp, []byte(want), 0o644); err != nil {\n72: \t\treturn err\n", + "line": "71", + "column": "12", + "nosec": false, + "suppressions": null + }, + { + "severity": "MEDIUM", + "confidence": "HIGH", + "cwe": { + "id": "276", + "url": "https://cwe.mitre.org/data/definitions/276.html" + }, + "rule_id": "G306", + "details": "Expect WriteFile permissions to be 0600 or less", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/stacks/setup_gate.go", + "code": "267: \ttmp := p + \".tmp\"\n268: \tif err := os.WriteFile(tmp, []byte(want), 0o644); err != nil {\n269: \t\treturn nil, err\n", + "line": "268", + "column": "12", + "nosec": false, + "suppressions": null + }, + { + "severity": "MEDIUM", + "confidence": "HIGH", + "cwe": { + "id": "276", + "url": "https://cwe.mitre.org/data/definitions/276.html" + }, + "rule_id": "G306", + "details": "Expect WriteFile permissions to be 0600 or less", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/stacks/remove_interrupted.go", + "code": "38: \tb, _ := json.Marshal(removeJournal{At: time.Now().UTC().Format(time.RFC3339), RemoveHDDData: removeHDDData, BackupPathsAsked: backupPaths})\n39: \treturn os.WriteFile(filepath.Join(stackDir, removePendingFile), append(b, '\\n'), 0o644)\n40: }\n", + "line": "39", + "column": "9", + "nosec": false, + "suppressions": null + }, + { + "severity": "MEDIUM", + "confidence": "HIGH", + "cwe": { + "id": "276", + "url": "https://cwe.mitre.org/data/definitions/276.html" + }, + "rule_id": "G306", + "details": "Expect WriteFile permissions to be 0600 or less", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/stacks/pin.go", + "code": "354: \t}\n355: \tif err := os.WriteFile(live, data, 0o644); err != nil {\n356: \t\treturn fmt.Errorf(\"rendering the catalog definition for %s: %w\", name, err)\n", + "line": "355", + "column": "12", + "nosec": false, + "suppressions": null + }, + { + "severity": "MEDIUM", + "confidence": "HIGH", + "cwe": { + "id": "276", + "url": "https://cwe.mitre.org/data/definitions/276.html" + }, + "rule_id": "G306", + "details": "Expect WriteFile permissions to be 0600 or less", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/stacks/pin.go", + "code": "42: \ttmp := path + \".tmp\"\n43: \tif err := os.WriteFile(tmp, data, 0o644); err != nil {\n44: \t\treturn fmt.Errorf(\"writing %s: %w\", tmp, err)\n", + "line": "43", + "column": "12", + "nosec": false, + "suppressions": null + }, + { + "severity": "MEDIUM", + "confidence": "HIGH", + "cwe": { + "id": "276", + "url": "https://cwe.mitre.org/data/definitions/276.html" + }, + "rule_id": "G306", + "details": "Expect WriteFile permissions to be 0600 or less", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/stacks/kept.go", + "code": "200: \tb, _ := json.MarshalIndent(marker, \"\", \" \")\n201: \tif err := os.WriteFile(filepath.Join(dest, keptMarkerFile), b, 0o644); err != nil {\n202: \t\tm.logger.Printf(\"[WARN] [stacks] kept %s: could not write the marker in %s: %v — listed without it\", name, dest, err)\n", + "line": "201", + "column": "12", + "nosec": false, + "suppressions": null + }, + { + "severity": "MEDIUM", + "confidence": "HIGH", + "cwe": { + "id": "276", + "url": "https://cwe.mitre.org/data/definitions/276.html" + }, + "rule_id": "G306", + "details": "Expect WriteFile permissions to be 0600 or less", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/stacks/install_interrupted.go", + "code": "80: \t\t}\n81: \t\tif err := os.WriteFile(filepath.Join(c.dir, installInterruptedFile), []byte(time.Now().UTC().Format(time.RFC3339)+\"\\n\"), 0o644); err != nil {\n82: \t\t\tm.logger.Printf(\"[WARN] [stacks] install %s: cannot record the interruption for the page: %v\", c.name, err)\n", + "line": "81", + "column": "13", + "nosec": false, + "suppressions": null + }, + { + "severity": "MEDIUM", + "confidence": "HIGH", + "cwe": { + "id": "276", + "url": "https://cwe.mitre.org/data/definitions/276.html" + }, + "rule_id": "G306", + "details": "Expect WriteFile permissions to be 0600 or less", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/stacks/install_interrupted.go", + "code": "36: \t_ = os.Remove(filepath.Join(stackDir, installInterruptedFile)) // a new install supersedes the old sentence\n37: \treturn os.WriteFile(filepath.Join(stackDir, installPendingFile), []byte(time.Now().UTC().Format(time.RFC3339)+\"\\n\"), 0o644)\n38: }\n", + "line": "37", + "column": "9", + "nosec": false, + "suppressions": null + }, + { + "severity": "MEDIUM", + "confidence": "HIGH", + "cwe": { + "id": "276", + "url": "https://cwe.mitre.org/data/definitions/276.html" + }, + "rule_id": "G306", + "details": "Expect WriteFile permissions to be 0600 or less", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/stacks/install_hold.go", + "code": "75: \ttmp := p + \".tmp\"\n76: \tif err := os.WriteFile(tmp, []byte(want), 0o644); err != nil {\n77: \t\treturn nil, err\n", + "line": "76", + "column": "12", + "nosec": false, + "suppressions": null + }, + { + "severity": "MEDIUM", + "confidence": "HIGH", + "cwe": { + "id": "276", + "url": "https://cwe.mitre.org/data/definitions/276.html" + }, + "rule_id": "G306", + "details": "Expect WriteFile permissions to be 0600 or less", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/stacks/infra.go", + "code": "434: \tout := composeImageLine.ReplaceAll(cur, []byte(\"${1}\"+infra.FileBrowserImage))\n435: \tif err := os.WriteFile(composePath, out, 0o644); err != nil {\n436: \t\treturn fmt.Errorf(\"write docker-compose.yml: %w\", err)\n", + "line": "435", + "column": "12", + "nosec": false, + "suppressions": null + }, + { + "severity": "MEDIUM", + "confidence": "HIGH", + "cwe": { + "id": "276", + "url": "https://cwe.mitre.org/data/definitions/276.html" + }, + "rule_id": "G306", + "details": "Expect WriteFile permissions to be 0600 or less", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/stacks/infra.go", + "code": "327: \tif cur, err := os.ReadFile(routePath); err != nil || string(cur) != want {\n328: \t\tif err := os.WriteFile(routePath, []byte(want), 0o644); err != nil {\n329: \t\t\treturn fmt.Errorf(\"write controller route: %w\", err)\n", + "line": "328", + "column": "13", + "nosec": false, + "suppressions": null + }, + { + "severity": "MEDIUM", + "confidence": "HIGH", + "cwe": { + "id": "276", + "url": "https://cwe.mitre.org/data/definitions/276.html" + }, + "rule_id": "G306", + "details": "Expect WriteFile permissions to be 0600 or less", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/stacks/infra.go", + "code": "293: \tif cur, err := os.ReadFile(path); err != nil || string(cur) != want {\n294: \t\tif err := os.WriteFile(path, []byte(want), 0o644); err != nil {\n295: \t\t\treturn fmt.Errorf(\"write servers-transports: %w\", err)\n", + "line": "294", + "column": "13", + "nosec": false, + "suppressions": null + }, + { + "severity": "MEDIUM", + "confidence": "HIGH", + "cwe": { + "id": "276", + "url": "https://cwe.mitre.org/data/definitions/276.html" + }, + "rule_id": "G306", + "details": "Expect WriteFile permissions to be 0600 or less", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/stacks/infra.go", + "code": "275: \t}\n276: \tif err := os.WriteFile(filepath.Join(dir, \"config.yaml\"), []byte(config), 0o644); err != nil {\n277: \t\treturn fmt.Errorf(\"write config.yaml: %w\", err)\n", + "line": "276", + "column": "12", + "nosec": false, + "suppressions": null + }, + { + "severity": "MEDIUM", + "confidence": "HIGH", + "cwe": { + "id": "276", + "url": "https://cwe.mitre.org/data/definitions/276.html" + }, + "rule_id": "G306", + "details": "Expect WriteFile permissions to be 0600 or less", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/stacks/infra.go", + "code": "272: \tconfig := infra.RenderFileBrowserConfig(nil, false)\n273: \tif err := os.WriteFile(composePath, []byte(compose), 0o644); err != nil {\n274: \t\treturn fmt.Errorf(\"write docker-compose.yml: %w\", err)\n", + "line": "273", + "column": "12", + "nosec": false, + "suppressions": null + }, + { + "severity": "MEDIUM", + "confidence": "HIGH", + "cwe": { + "id": "276", + "url": "https://cwe.mitre.org/data/definitions/276.html" + }, + "rule_id": "G306", + "details": "Expect WriteFile permissions to be 0600 or less", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/stacks/infra.go", + "code": "230: \tif cur, err := os.ReadFile(path); err != nil || string(cur) != want {\n231: \t\tif err := os.WriteFile(path, []byte(want), 0o644); err != nil {\n232: \t\t\treturn fmt.Errorf(\"write forwarded headers: %w\", err)\n", + "line": "231", + "column": "13", + "nosec": false, + "suppressions": null + }, + { + "severity": "MEDIUM", + "confidence": "HIGH", + "cwe": { + "id": "276", + "url": "https://cwe.mitre.org/data/definitions/276.html" + }, + "rule_id": "G306", + "details": "Expect WriteFile permissions to be 0600 or less", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/stacks/image_retention.go", + "code": "391: \t_ = os.MkdirAll(filepath.Dir(m.imageRetentionMarker()), 0o755)\n392: \t_ = os.WriteFile(m.imageRetentionMarker(), []byte(fmt.Sprintf(\"deleted %d\\n%s\\n\", len(deleted), strings.Join(deleted, \"\\n\"))), 0o644)\n393: \treturn deleted, true\n", + "line": "392", + "column": "6", + "nosec": false, + "suppressions": null + }, + { + "severity": "MEDIUM", + "confidence": "HIGH", + "cwe": { + "id": "276", + "url": "https://cwe.mitre.org/data/definitions/276.html" + }, + "rule_id": "G306", + "details": "Expect WriteFile permissions to be 0600 or less", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/stacks/family_gate.go", + "code": "128: \ttmp := p + \".tmp\"\n129: \tif err := os.WriteFile(tmp, []byte(want), 0o644); err != nil {\n130: \t\treturn nil, err\n", + "line": "129", + "column": "12", + "nosec": false, + "suppressions": null + }, + { + "severity": "MEDIUM", + "confidence": "HIGH", + "cwe": { + "id": "276", + "url": "https://cwe.mitre.org/data/definitions/276.html" + }, + "rule_id": "G306", + "details": "Expect WriteFile permissions to be 0600 or less", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/settings/settings.go", + "code": "882: \t// parsed + saved cleanly. Best-effort — a failed .bak must NOT fail the save.\n883: \tif err := os.WriteFile(s.path+\".bak\", data, 0644); err != nil \u0026\u0026 s.log != nil {\n884: \t\ts.log.Printf(\"[WARN] [settings] could not write .bak: %v\", err)\n", + "line": "883", + "column": "12", + "nosec": false, + "suppressions": null + }, + { + "severity": "MEDIUM", + "confidence": "HIGH", + "cwe": { + "id": "276", + "url": "https://cwe.mitre.org/data/definitions/276.html" + }, + "rule_id": "G306", + "details": "Expect WriteFile permissions to be 0600 or less", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/settings/settings.go", + "code": "864: \n865: \tif err := os.WriteFile(tmpPath, data, 0644); err != nil {\n866: \t\tos.Remove(tmpPath) // clean up partial file\n", + "line": "865", + "column": "12", + "nosec": false, + "suppressions": null + }, + { + "severity": "MEDIUM", + "confidence": "HIGH", + "cwe": { + "id": "276", + "url": "https://cwe.mitre.org/data/definitions/276.html" + }, + "rule_id": "G306", + "details": "Expect WriteFile permissions to be 0600 or less", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/settings/settings.go", + "code": "739: \t\t\t\tlogger.Printf(\"[WARN] [settings] recovered settings from .bak; re-promoting to primary\")\n740: \t\t\t\t_ = os.WriteFile(path, bak, 0644) // best-effort promote\n741: \t\t\t\ts2.LoadWarning = \"settings.json volt sérült — visszaállítva biztonsági másolatból\"\n", + "line": "740", + "column": "9", + "nosec": false, + "suppressions": null + }, + { + "severity": "MEDIUM", + "confidence": "HIGH", + "cwe": { + "id": "276", + "url": "https://cwe.mitre.org/data/definitions/276.html" + }, + "rule_id": "G306", + "details": "Expect WriteFile permissions to be 0600 or less", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/selfupdate/state.go", + "code": "53: \n54: \tif err := os.WriteFile(tmpPath, data, 0644); err != nil {\n55: \t\treturn fmt.Errorf(\"writing temp state file: %w\", err)\n", + "line": "54", + "column": "12", + "nosec": false, + "suppressions": null + }, + { + "severity": "MEDIUM", + "confidence": "HIGH", + "cwe": { + "id": "276", + "url": "https://cwe.mitre.org/data/definitions/276.html" + }, + "rule_id": "G306", + "details": "Expect WriteFile permissions to be 0600 or less", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/selftest/selftest.go", + "code": "122: \ttmpFile := filepath.Join(dataDir, \".selftest-\"+fmt.Sprintf(\"%d\", time.Now().UnixNano()))\n123: \tif err := os.WriteFile(tmpFile, []byte(\"test\"), 0644); err != nil {\n124: \t\treturn CheckResult{Name: \"Data directory\", Status: \"warn\", Message: fmt.Sprintf(\"not writable: %v\", err)}\n", + "line": "123", + "column": "12", + "nosec": false, + "suppressions": null + }, + { + "severity": "MEDIUM", + "confidence": "HIGH", + "cwe": { + "id": "276", + "url": "https://cwe.mitre.org/data/definitions/276.html" + }, + "rule_id": "G306", + "details": "Expect WriteFile permissions to be 0600 or less", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/nightchain/nightchain.go", + "code": "116: \ttmp := l.path + \".tmp\"\n117: \tif err := os.WriteFile(tmp, b, 0o644); err != nil {\n118: \t\treturn err\n", + "line": "117", + "column": "12", + "nosec": false, + "suppressions": null + }, + { + "severity": "MEDIUM", + "confidence": "HIGH", + "cwe": { + "id": "276", + "url": "https://cwe.mitre.org/data/definitions/276.html" + }, + "rule_id": "G306", + "details": "Expect WriteFile permissions to be 0600 or less", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/integrations/onlyoffice_filebrowser.go", + "code": "85: \ttmpPath := configPath + \".tmp\"\n86: \tif err := os.WriteFile(tmpPath, []byte(cleaned), 0644); err != nil {\n87: \t\tac.Logger.Printf(\"[ERROR] [integrations] OnlyOffice-FileBrowser revoke: %v\", err)\n", + "line": "86", + "column": "12", + "nosec": false, + "suppressions": null + }, + { + "severity": "MEDIUM", + "confidence": "HIGH", + "cwe": { + "id": "276", + "url": "https://cwe.mitre.org/data/definitions/276.html" + }, + "rule_id": "G306", + "details": "Expect WriteFile permissions to be 0600 or less", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/integrations/onlyoffice_filebrowser.go", + "code": "50: \ttmpPath := configPath + \".tmp\"\n51: \tif err := os.WriteFile(tmpPath, []byte(configStr), 0644); err != nil {\n52: \t\tac.Logger.Printf(\"[ERROR] [integrations] OnlyOffice-FileBrowser apply: %v\", err)\n", + "line": "51", + "column": "12", + "nosec": false, + "suppressions": null + }, + { + "severity": "MEDIUM", + "confidence": "HIGH", + "cwe": { + "id": "276", + "url": "https://cwe.mitre.org/data/definitions/276.html" + }, + "rule_id": "G306", + "details": "Expect WriteFile permissions to be 0600 or less", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/dockerexec/dockerexec.go", + "code": "91: \tfor _, n := range []string{\"docker\", \"docker-compose\"} {\n92: \t\tif err := os.WriteFile(filepath.Join(dir, n), []byte(\"#!/bin/sh\\nexit 0\\n\"), 0o755); err != nil {\n93: \t\t\tfmt.Fprintln(os.Stderr, \"R-650 stub:\", err)\n", + "line": "92", + "column": "13", + "nosec": false, + "suppressions": null + }, + { + "severity": "MEDIUM", + "confidence": "HIGH", + "cwe": { + "id": "276", + "url": "https://cwe.mitre.org/data/definitions/276.html" + }, + "rule_id": "G306", + "details": "Expect WriteFile permissions to be 0600 or less", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/backup/tier2_shares.go", + "code": "283: func (m *Manager) writeTier2Marker(destBase string) error {\n284: \treturn os.WriteFile(filepath.Join(destBase, tier2LayoutMarker), []byte(tier2LayoutVersion), 0o644)\n285: }\n", + "line": "284", + "column": "9", + "nosec": false, + "suppressions": null + }, + { + "severity": "MEDIUM", + "confidence": "HIGH", + "cwe": { + "id": "276", + "url": "https://cwe.mitre.org/data/definitions/276.html" + }, + "rule_id": "G306", + "details": "Expect WriteFile permissions to be 0600 or less", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/backup/tier2.go", + "code": "410: \tm.tier2Reconcile(destBase, legRels)\n411: \tif err := os.WriteFile(markerPath, []byte(tier2LayoutVersion), 0644); err != nil {\n412: \t\tm.logger.Printf(\"[WARN] [backup] Tier 2 %s: layout marker write failed (restore will refuse until next run): %v\", stackName, err)\n", + "line": "411", + "column": "12", + "nosec": false, + "suppressions": null + }, + { + "severity": "MEDIUM", + "confidence": "HIGH", + "cwe": { + "id": "276", + "url": "https://cwe.mitre.org/data/definitions/276.html" + }, + "rule_id": "G306", + "details": "Expect WriteFile permissions to be 0600 or less", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/backup/offbox.go", + "code": "535: \t\t}\n536: \t\tif err := os.WriteFile(m.offboxKnownHosts(), []byte(kh), 0o644); err != nil {\n537: \t\t\treturn fmt.Errorf(\"offbox known_hosts: %w\", err)\n", + "line": "536", + "column": "13", + "nosec": false, + "suppressions": null + }, + { + "severity": "MEDIUM", + "confidence": "HIGH", + "cwe": { + "id": "276", + "url": "https://cwe.mitre.org/data/definitions/276.html" + }, + "rule_id": "G306", + "details": "Expect WriteFile permissions to be 0600 or less", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/assets/syncer.go", + "code": "323: \ttmp := path + \".tmp\"\n324: \tif err := os.WriteFile(tmp, data, 0644); err != nil {\n325: \t\ts.logger.Printf(\"[ERROR] [assets] Failed to save local manifest: %v\", err)\n", + "line": "324", + "column": "12", + "nosec": false, + "suppressions": null + }, + { + "severity": "MEDIUM", + "confidence": "HIGH", + "cwe": { + "id": "276", + "url": "https://cwe.mitre.org/data/definitions/276.html" + }, + "rule_id": "G306", + "details": "Expect WriteFile permissions to be 0600 or less", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/appexport/export.go", + "code": "590: \t}\n591: \treturn os.WriteFile(dst, []byte(sb.String()), 0644)\n592: }\n", + "line": "591", + "column": "9", + "nosec": false, + "suppressions": null + }, + { + "severity": "MEDIUM", + "confidence": "HIGH", + "cwe": { + "id": "276", + "url": "https://cwe.mitre.org/data/definitions/276.html" + }, + "rule_id": "G306", + "details": "Expect WriteFile permissions to be 0600 or less", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/appexport/export.go", + "code": "436: \te.debugf(\"manifest JSON: %d bytes\", len(manifestData))\n437: \tif err := os.WriteFile(filepath.Join(tmpDir, \"manifest.json\"), manifestData, 0644); err != nil {\n438: \t\te.failJob(job, step, err.Error())\n", + "line": "437", + "column": "12", + "nosec": false, + "suppressions": null + }, + { + "severity": "MEDIUM", + "confidence": "HIGH", + "cwe": { + "id": "276", + "url": "https://cwe.mitre.org/data/definitions/276.html" + }, + "rule_id": "G306", + "details": "Expect WriteFile permissions to be 0600 or less", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/cmd/controller/main.go", + "code": "3200: \t\t}\n3201: \t\tif err := os.WriteFile(filepath.Join(stackDir, fname), data, 0644); err != nil {\n3202: \t\t\treturn fmt.Errorf(\"restoring %s from unit: %w\", fname, err)\n", + "line": "3201", + "column": "13", + "nosec": false, + "suppressions": null + }, + { + "severity": "LOW", + "confidence": "HIGH", + "cwe": { + "id": "703", + "url": "https://cwe.mitre.org/data/definitions/703.html" + }, + "rule_id": "G104", + "details": "Errors unhandled", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/web/session_store.go", + "code": "176: \tif err := fh.Close(); err != nil {\n177: \t\tos.Remove(tmp)\n178: \t\treturn err\n", + "line": "177", + "column": "3", + "nosec": false, + "suppressions": null + }, + { + "severity": "LOW", + "confidence": "HIGH", + "cwe": { + "id": "703", + "url": "https://cwe.mitre.org/data/definitions/703.html" + }, + "rule_id": "G104", + "details": "Errors unhandled", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/web/session_store.go", + "code": "172: \t\tfh.Close()\n173: \t\tos.Remove(tmp)\n174: \t\treturn err\n", + "line": "173", + "column": "3", + "nosec": false, + "suppressions": null + }, + { + "severity": "LOW", + "confidence": "HIGH", + "cwe": { + "id": "703", + "url": "https://cwe.mitre.org/data/definitions/703.html" + }, + "rule_id": "G104", + "details": "Errors unhandled", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/web/session_store.go", + "code": "171: \tif err := fh.Sync(); err != nil {\n172: \t\tfh.Close()\n173: \t\tos.Remove(tmp)\n", + "line": "172", + "column": "3", + "nosec": false, + "suppressions": null + }, + { + "severity": "LOW", + "confidence": "HIGH", + "cwe": { + "id": "703", + "url": "https://cwe.mitre.org/data/definitions/703.html" + }, + "rule_id": "G104", + "details": "Errors unhandled", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/web/session_store.go", + "code": "167: \t\tfh.Close()\n168: \t\tos.Remove(tmp)\n169: \t\treturn err\n", + "line": "168", + "column": "3", + "nosec": false, + "suppressions": null + }, + { + "severity": "LOW", + "confidence": "HIGH", + "cwe": { + "id": "703", + "url": "https://cwe.mitre.org/data/definitions/703.html" + }, + "rule_id": "G104", + "details": "Errors unhandled", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/web/session_store.go", + "code": "166: \tif _, err := fh.Write(b); err != nil {\n167: \t\tfh.Close()\n168: \t\tos.Remove(tmp)\n", + "line": "167", + "column": "3", + "nosec": false, + "suppressions": null + }, + { + "severity": "LOW", + "confidence": "HIGH", + "cwe": { + "id": "703", + "url": "https://cwe.mitre.org/data/definitions/703.html" + }, + "rule_id": "G104", + "details": "Errors unhandled", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/web/server.go", + "code": "1108: \tw.Header().Set(\"Cache-Control\", \"public, max-age=31536000, immutable\")\n1109: \tw.Write(data)\n1110: }\n", + "line": "1109", + "column": "2", + "nosec": false, + "suppressions": null + }, + { + "severity": "LOW", + "confidence": "HIGH", + "cwe": { + "id": "703", + "url": "https://cwe.mitre.org/data/definitions/703.html" + }, + "rule_id": "G104", + "details": "Errors unhandled", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/web/server.go", + "code": "1094: \tw.Header().Set(\"Cache-Control\", \"public, max-age=86400\")\n1095: \tw.Write(chartJS)\n1096: }\n", + "line": "1095", + "column": "2", + "nosec": false, + "suppressions": null + }, + { + "severity": "LOW", + "confidence": "HIGH", + "cwe": { + "id": "703", + "url": "https://cwe.mitre.org/data/definitions/703.html" + }, + "rule_id": "G104", + "details": "Errors unhandled", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/web/server.go", + "code": "1088: \tw.Header().Set(\"Cache-Control\", \"public, max-age=3600\")\n1089: \tw.Write(data)\n1090: }\n", + "line": "1089", + "column": "2", + "nosec": false, + "suppressions": null + }, + { + "severity": "LOW", + "confidence": "HIGH", + "cwe": { + "id": "703", + "url": "https://cwe.mitre.org/data/definitions/703.html" + }, + "rule_id": "G104", + "details": "Errors unhandled", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/web/server.go", + "code": "1030: \tw.Header().Set(\"Content-Type\", \"text/html; charset=utf-8\")\n1031: \tbuf.WriteTo(w)\n1032: }\n", + "line": "1031", + "column": "2", + "nosec": false, + "suppressions": null + }, + { + "severity": "LOW", + "confidence": "HIGH", + "cwe": { + "id": "703", + "url": "https://cwe.mitre.org/data/definitions/703.html" + }, + "rule_id": "G104", + "details": "Errors unhandled", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/web/server.go", + "code": "1003: \tw.Header().Set(\"Content-Type\", \"text/html; charset=utf-8\")\n1004: \tbuf.WriteTo(w)\n1005: }\n", + "line": "1004", + "column": "2", + "nosec": false, + "suppressions": null + }, + { + "severity": "LOW", + "confidence": "HIGH", + "cwe": { + "id": "703", + "url": "https://cwe.mitre.org/data/definitions/703.html" + }, + "rule_id": "G104", + "details": "Errors unhandled", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/web/server.go", + "code": "311: \tif _, err := os.Stat(fbResetFlag); err == nil {\n312: \t\tos.Remove(fbResetFlag)\n313: \t\tgo s.SyncFileBrowserMountsReset()\n", + "line": "312", + "column": "3", + "nosec": false, + "suppressions": null + }, + { + "severity": "LOW", + "confidence": "HIGH", + "cwe": { + "id": "703", + "url": "https://cwe.mitre.org/data/definitions/703.html" + }, + "rule_id": "G104", + "details": "Errors unhandled", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/web/logbuffer.go", + "code": "209: \tif err := f.Close(); err != nil {\n210: \t\tos.Remove(tmp)\n211: \t\treturn err\n", + "line": "210", + "column": "3", + "nosec": false, + "suppressions": null + }, + { + "severity": "LOW", + "confidence": "HIGH", + "cwe": { + "id": "703", + "url": "https://cwe.mitre.org/data/definitions/703.html" + }, + "rule_id": "G104", + "details": "Errors unhandled", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/web/logbuffer.go", + "code": "205: \t\tf.Close()\n206: \t\tos.Remove(tmp)\n207: \t\treturn err\n", + "line": "206", + "column": "3", + "nosec": false, + "suppressions": null + }, + { + "severity": "LOW", + "confidence": "HIGH", + "cwe": { + "id": "703", + "url": "https://cwe.mitre.org/data/definitions/703.html" + }, + "rule_id": "G104", + "details": "Errors unhandled", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/web/logbuffer.go", + "code": "204: \tif err := f.Sync(); err != nil {\n205: \t\tf.Close()\n206: \t\tos.Remove(tmp)\n", + "line": "205", + "column": "3", + "nosec": false, + "suppressions": null + }, + { + "severity": "LOW", + "confidence": "HIGH", + "cwe": { + "id": "703", + "url": "https://cwe.mitre.org/data/definitions/703.html" + }, + "rule_id": "G104", + "details": "Errors unhandled", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/web/logbuffer.go", + "code": "200: \t\tf.Close()\n201: \t\tos.Remove(tmp)\n202: \t\treturn err\n", + "line": "201", + "column": "3", + "nosec": false, + "suppressions": null + }, + { + "severity": "LOW", + "confidence": "HIGH", + "cwe": { + "id": "703", + "url": "https://cwe.mitre.org/data/definitions/703.html" + }, + "rule_id": "G104", + "details": "Errors unhandled", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/web/logbuffer.go", + "code": "199: \tif err := w.Flush(); err != nil {\n200: \t\tf.Close()\n201: \t\tos.Remove(tmp)\n", + "line": "200", + "column": "3", + "nosec": false, + "suppressions": null + }, + { + "severity": "LOW", + "confidence": "HIGH", + "cwe": { + "id": "703", + "url": "https://cwe.mitre.org/data/definitions/703.html" + }, + "rule_id": "G104", + "details": "Errors unhandled", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/web/logbuffer.go", + "code": "194: \t\t\tf.Close()\n195: \t\t\tos.Remove(tmp)\n196: \t\t\treturn err\n", + "line": "195", + "column": "4", + "nosec": false, + "suppressions": null + }, + { + "severity": "LOW", + "confidence": "HIGH", + "cwe": { + "id": "703", + "url": "https://cwe.mitre.org/data/definitions/703.html" + }, + "rule_id": "G104", + "details": "Errors unhandled", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/web/logbuffer.go", + "code": "193: \t\tif err := enc.Encode(e); err != nil {\n194: \t\t\tf.Close()\n195: \t\t\tos.Remove(tmp)\n", + "line": "194", + "column": "4", + "nosec": false, + "suppressions": null + }, + { + "severity": "LOW", + "confidence": "HIGH", + "cwe": { + "id": "703", + "url": "https://cwe.mitre.org/data/definitions/703.html" + }, + "rule_id": "G104", + "details": "Errors unhandled", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/web/handlers.go", + "code": "3290: \tvar total int64\n3291: \tfilepath.Walk(path, func(_ string, info os.FileInfo, err error) error {\n3292: \t\tif err != nil || info.IsDir() {\n3293: \t\t\treturn nil\n3294: \t\t}\n3295: \t\ttotal += info.Size()\n3296: \t\treturn nil\n3297: \t})\n3298: \treturn total\n", + "line": "3291-3297", + "column": "2", + "nosec": false, + "suppressions": null + }, + { + "severity": "LOW", + "confidence": "HIGH", + "cwe": { + "id": "703", + "url": "https://cwe.mitre.org/data/definitions/703.html" + }, + "rule_id": "G104", + "details": "Errors unhandled", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/web/handler_export_upload.go", + "code": "392: \tjob.file.Close()\n393: \tos.Remove(job.partPath)\n394: \tlogx.Warnf(s.logger, \"[web] fab upload idle-expired at %d/%d bytes — part deleted\",\n", + "line": "393", + "column": "2", + "nosec": false, + "suppressions": null + }, + { + "severity": "LOW", + "confidence": "HIGH", + "cwe": { + "id": "703", + "url": "https://cwe.mitre.org/data/definitions/703.html" + }, + "rule_id": "G104", + "details": "Errors unhandled", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/web/handler_export_upload.go", + "code": "391: \n392: \tjob.file.Close()\n393: \tos.Remove(job.partPath)\n", + "line": "392", + "column": "2", + "nosec": false, + "suppressions": null + }, + { + "severity": "LOW", + "confidence": "HIGH", + "cwe": { + "id": "703", + "url": "https://cwe.mitre.org/data/definitions/703.html" + }, + "rule_id": "G104", + "details": "Errors unhandled", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/web/handler_export_upload.go", + "code": "374: \tjob.file.Close()\n375: \tos.Remove(job.partPath)\n376: \tlogx.Infof(s.logger, \"[web] fab upload aborted by client at %d/%d bytes\", job.received, job.declared)\n", + "line": "375", + "column": "2", + "nosec": false, + "suppressions": null + }, + { + "severity": "LOW", + "confidence": "HIGH", + "cwe": { + "id": "703", + "url": "https://cwe.mitre.org/data/definitions/703.html" + }, + "rule_id": "G104", + "details": "Errors unhandled", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/web/handler_export_upload.go", + "code": "373: \n374: \tjob.file.Close()\n375: \tos.Remove(job.partPath)\n", + "line": "374", + "column": "2", + "nosec": false, + "suppressions": null + }, + { + "severity": "LOW", + "confidence": "HIGH", + "cwe": { + "id": "703", + "url": "https://cwe.mitre.org/data/definitions/703.html" + }, + "rule_id": "G104", + "details": "Errors unhandled", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/web/handler_export_upload.go", + "code": "340: \tif err := os.Rename(job.partPath, filepath.Join(dir, finalName)); err != nil {\n341: \t\tos.Remove(job.partPath)\n342: \t\tlogx.Warnf(s.logger, \"[web] fab upload finalize rename: %v\", err)\n", + "line": "341", + "column": "3", + "nosec": false, + "suppressions": null + }, + { + "severity": "LOW", + "confidence": "HIGH", + "cwe": { + "id": "703", + "url": "https://cwe.mitre.org/data/definitions/703.html" + }, + "rule_id": "G104", + "details": "Errors unhandled", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/web/handler_export_upload.go", + "code": "333: \tif err := job.file.Close(); err != nil {\n334: \t\tos.Remove(job.partPath)\n335: \t\tjsonError(w, \"A fájl mentése sikertelen.\", http.StatusInternalServerError)\n", + "line": "334", + "column": "3", + "nosec": false, + "suppressions": null + }, + { + "severity": "LOW", + "confidence": "HIGH", + "cwe": { + "id": "703", + "url": "https://cwe.mitre.org/data/definitions/703.html" + }, + "rule_id": "G104", + "details": "Errors unhandled", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/web/handler_export_upload.go", + "code": "327: \t\tjob.file.Close()\n328: \t\tos.Remove(job.partPath)\n329: \t\tlogx.Warnf(s.logger, \"[web] fab upload finalize fsync: %v\", err)\n", + "line": "328", + "column": "3", + "nosec": false, + "suppressions": null + }, + { + "severity": "LOW", + "confidence": "HIGH", + "cwe": { + "id": "703", + "url": "https://cwe.mitre.org/data/definitions/703.html" + }, + "rule_id": "G104", + "details": "Errors unhandled", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/web/handler_export_upload.go", + "code": "326: \tif err := job.file.Sync(); err != nil {\n327: \t\tjob.file.Close()\n328: \t\tos.Remove(job.partPath)\n", + "line": "327", + "column": "3", + "nosec": false, + "suppressions": null + }, + { + "severity": "LOW", + "confidence": "HIGH", + "cwe": { + "id": "703", + "url": "https://cwe.mitre.org/data/definitions/703.html" + }, + "rule_id": "G104", + "details": "Errors unhandled", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/web/handler_export_upload.go", + "code": "317: \t\tjob.file.Close()\n318: \t\tos.Remove(job.partPath)\n319: \t\tlogx.Warnf(s.logger, \"[web] fab upload finalize size mismatch: got %d, declared %d — part deleted\",\n", + "line": "318", + "column": "3", + "nosec": false, + "suppressions": null + }, + { + "severity": "LOW", + "confidence": "HIGH", + "cwe": { + "id": "703", + "url": "https://cwe.mitre.org/data/definitions/703.html" + }, + "rule_id": "G104", + "details": "Errors unhandled", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/web/handler_export_upload.go", + "code": "316: \tif job.received != job.declared {\n317: \t\tjob.file.Close()\n318: \t\tos.Remove(job.partPath)\n", + "line": "317", + "column": "3", + "nosec": false, + "suppressions": null + }, + { + "severity": "LOW", + "confidence": "HIGH", + "cwe": { + "id": "703", + "url": "https://cwe.mitre.org/data/definitions/703.html" + }, + "rule_id": "G104", + "details": "Errors unhandled", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/web/handler_export_upload.go", + "code": "75: \tw.WriteHeader(code)\n76: \tjson.NewEncoder(w).Encode(v)\n77: }\n", + "line": "76", + "column": "2", + "nosec": false, + "suppressions": null + }, + { + "severity": "LOW", + "confidence": "HIGH", + "cwe": { + "id": "703", + "url": "https://cwe.mitre.org/data/definitions/703.html" + }, + "rule_id": "G104", + "details": "Errors unhandled", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/web/handler_export_download.go", + "code": "155: \t}\n156: \tf.Close()\n157: \tif rmErr := os.Remove(path); rmErr != nil {\n", + "line": "156", + "column": "2", + "nosec": false, + "suppressions": null + }, + { + "severity": "LOW", + "confidence": "HIGH", + "cwe": { + "id": "703", + "url": "https://cwe.mitre.org/data/definitions/703.html" + }, + "rule_id": "G104", + "details": "Errors unhandled", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/web/handler_export.go", + "code": "22: \tw.WriteHeader(code)\n23: \tjson.NewEncoder(w).Encode(map[string]interface{}{\n24: \t\t\"ok\": false,\n25: \t\t\"error\": msg,\n26: \t})\n27: }\n", + "line": "23-26", + "column": "2", + "nosec": false, + "suppressions": null + }, + { + "severity": "LOW", + "confidence": "HIGH", + "cwe": { + "id": "703", + "url": "https://cwe.mitre.org/data/definitions/703.html" + }, + "rule_id": "G104", + "details": "Errors unhandled", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/web/handler_export.go", + "code": "15: \tw.Header().Set(\"Content-Type\", \"application/json; charset=utf-8\")\n16: \tjson.NewEncoder(w).Encode(v)\n17: }\n", + "line": "16", + "column": "2", + "nosec": false, + "suppressions": null + }, + { + "severity": "LOW", + "confidence": "HIGH", + "cwe": { + "id": "703", + "url": "https://cwe.mitre.org/data/definitions/703.html" + }, + "rule_id": "G104", + "details": "Errors unhandled", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/web/handler_debug.go", + "code": "361: \tw.Header().Set(\"Content-Type\", \"application/json\")\n362: \tjson.NewEncoder(w).Encode(dump)\n363: }\n", + "line": "362", + "column": "2", + "nosec": false, + "suppressions": null + }, + { + "severity": "LOW", + "confidence": "HIGH", + "cwe": { + "id": "703", + "url": "https://cwe.mitre.org/data/definitions/703.html" + }, + "rule_id": "G104", + "details": "Errors unhandled", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/web/handler_debug.go", + "code": "150: \t}\n151: \tjson.NewEncoder(w).Encode(resp)\n152: }\n", + "line": "151", + "column": "2", + "nosec": false, + "suppressions": null + }, + { + "severity": "LOW", + "confidence": "HIGH", + "cwe": { + "id": "703", + "url": "https://cwe.mitre.org/data/definitions/703.html" + }, + "rule_id": "G104", + "details": "Errors unhandled", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/web/disk_health_state.go", + "code": "158: \tif err := os.Rename(tmp, path); err != nil {\n159: \t\tos.Remove(tmp)\n160: \t\treturn fmt.Errorf(\"renaming disk-health state: %w\", err)\n", + "line": "159", + "column": "3", + "nosec": false, + "suppressions": null + }, + { + "severity": "LOW", + "confidence": "HIGH", + "cwe": { + "id": "703", + "url": "https://cwe.mitre.org/data/definitions/703.html" + }, + "rule_id": "G104", + "details": "Errors unhandled", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/system/mounts_linux.go", + "code": "38: \tf.Close()\n39: \tos.Remove(testFile)\n40: \treturn true\n", + "line": "39", + "column": "2", + "nosec": false, + "suppressions": null + }, + { + "severity": "LOW", + "confidence": "HIGH", + "cwe": { + "id": "703", + "url": "https://cwe.mitre.org/data/definitions/703.html" + }, + "rule_id": "G104", + "details": "Errors unhandled", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/system/mounts_linux.go", + "code": "37: \t}\n38: \tf.Close()\n39: \tos.Remove(testFile)\n", + "line": "38", + "column": "2", + "nosec": false, + "suppressions": null + }, + { + "severity": "LOW", + "confidence": "HIGH", + "cwe": { + "id": "703", + "url": "https://cwe.mitre.org/data/definitions/703.html" + }, + "rule_id": "G104", + "details": "Errors unhandled", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/system/info_linux.go", + "code": "295: \t}\n296: \tfmt.Sscanf(string(data), \"%f %f %f\", \u0026info.LoadAvg1, \u0026info.LoadAvg5, \u0026info.LoadAvg15)\n297: \tdebugf(\"[DEBUG] [system] readLoadAvg: raw=%q → 1m=%.2f 5m=%.2f 15m=%.2f\",\n", + "line": "296", + "column": "2", + "nosec": false, + "suppressions": null + }, + { + "severity": "LOW", + "confidence": "HIGH", + "cwe": { + "id": "703", + "url": "https://cwe.mitre.org/data/definitions/703.html" + }, + "rule_id": "G104", + "details": "Errors unhandled", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/stacks/update.go", + "code": "1357: \tif err := f.Close(); err != nil {\n1358: \t\tos.Remove(tmp)\n1359: \t\treturn err\n", + "line": "1358", + "column": "3", + "nosec": false, + "suppressions": null + }, + { + "severity": "LOW", + "confidence": "HIGH", + "cwe": { + "id": "703", + "url": "https://cwe.mitre.org/data/definitions/703.html" + }, + "rule_id": "G104", + "details": "Errors unhandled", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/stacks/update.go", + "code": "1353: \t\tf.Close()\n1354: \t\tos.Remove(tmp)\n1355: \t\treturn err\n", + "line": "1354", + "column": "3", + "nosec": false, + "suppressions": null + }, + { + "severity": "LOW", + "confidence": "HIGH", + "cwe": { + "id": "703", + "url": "https://cwe.mitre.org/data/definitions/703.html" + }, + "rule_id": "G104", + "details": "Errors unhandled", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/stacks/update.go", + "code": "1352: \tif err := f.Sync(); err != nil {\n1353: \t\tf.Close()\n1354: \t\tos.Remove(tmp)\n", + "line": "1353", + "column": "3", + "nosec": false, + "suppressions": null + }, + { + "severity": "LOW", + "confidence": "HIGH", + "cwe": { + "id": "703", + "url": "https://cwe.mitre.org/data/definitions/703.html" + }, + "rule_id": "G104", + "details": "Errors unhandled", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/stacks/update.go", + "code": "1348: \t\tf.Close()\n1349: \t\tos.Remove(tmp)\n1350: \t\treturn err\n", + "line": "1349", + "column": "3", + "nosec": false, + "suppressions": null + }, + { + "severity": "LOW", + "confidence": "HIGH", + "cwe": { + "id": "703", + "url": "https://cwe.mitre.org/data/definitions/703.html" + }, + "rule_id": "G104", + "details": "Errors unhandled", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/stacks/update.go", + "code": "1347: \tif _, err := f.Write(data); err != nil {\n1348: \t\tf.Close()\n1349: \t\tos.Remove(tmp)\n", + "line": "1348", + "column": "3", + "nosec": false, + "suppressions": null + }, + { + "severity": "LOW", + "confidence": "HIGH", + "cwe": { + "id": "703", + "url": "https://cwe.mitre.org/data/definitions/703.html" + }, + "rule_id": "G104", + "details": "Errors unhandled", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/stacks/samba.go", + "code": "237: \tif err := os.Rename(tmp, path); err != nil {\n238: \t\tos.Remove(tmp)\n239: \t\treturn err\n", + "line": "238", + "column": "3", + "nosec": false, + "suppressions": null + }, + { + "severity": "LOW", + "confidence": "HIGH", + "cwe": { + "id": "703", + "url": "https://cwe.mitre.org/data/definitions/703.html" + }, + "rule_id": "G104", + "details": "Errors unhandled", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/stacks/samba.go", + "code": "233: \tif err := os.Chmod(tmp, mode); err != nil {\n234: \t\tos.Remove(tmp)\n235: \t\treturn err\n", + "line": "234", + "column": "3", + "nosec": false, + "suppressions": null + }, + { + "severity": "LOW", + "confidence": "HIGH", + "cwe": { + "id": "703", + "url": "https://cwe.mitre.org/data/definitions/703.html" + }, + "rule_id": "G104", + "details": "Errors unhandled", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/stacks/samba.go", + "code": "229: \tif err := f.Close(); err != nil {\n230: \t\tos.Remove(tmp)\n231: \t\treturn err\n", + "line": "230", + "column": "3", + "nosec": false, + "suppressions": null + }, + { + "severity": "LOW", + "confidence": "HIGH", + "cwe": { + "id": "703", + "url": "https://cwe.mitre.org/data/definitions/703.html" + }, + "rule_id": "G104", + "details": "Errors unhandled", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/stacks/samba.go", + "code": "225: \t\tf.Close()\n226: \t\tos.Remove(tmp)\n227: \t\treturn err\n", + "line": "226", + "column": "3", + "nosec": false, + "suppressions": null + }, + { + "severity": "LOW", + "confidence": "HIGH", + "cwe": { + "id": "703", + "url": "https://cwe.mitre.org/data/definitions/703.html" + }, + "rule_id": "G104", + "details": "Errors unhandled", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/stacks/samba.go", + "code": "224: \tif err := f.Sync(); err != nil {\n225: \t\tf.Close()\n226: \t\tos.Remove(tmp)\n", + "line": "225", + "column": "3", + "nosec": false, + "suppressions": null + }, + { + "severity": "LOW", + "confidence": "HIGH", + "cwe": { + "id": "703", + "url": "https://cwe.mitre.org/data/definitions/703.html" + }, + "rule_id": "G104", + "details": "Errors unhandled", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/stacks/samba.go", + "code": "220: \t\tf.Close()\n221: \t\tos.Remove(tmp)\n222: \t\treturn err\n", + "line": "221", + "column": "3", + "nosec": false, + "suppressions": null + }, + { + "severity": "LOW", + "confidence": "HIGH", + "cwe": { + "id": "703", + "url": "https://cwe.mitre.org/data/definitions/703.html" + }, + "rule_id": "G104", + "details": "Errors unhandled", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/stacks/samba.go", + "code": "219: \tif _, err := f.Write(data); err != nil {\n220: \t\tf.Close()\n221: \t\tos.Remove(tmp)\n", + "line": "220", + "column": "3", + "nosec": false, + "suppressions": null + }, + { + "severity": "LOW", + "confidence": "HIGH", + "cwe": { + "id": "703", + "url": "https://cwe.mitre.org/data/definitions/703.html" + }, + "rule_id": "G104", + "details": "Errors unhandled", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/stacks/migrate.go", + "code": "1134: \tif err := os.Rename(tmp, dst); err != nil {\n1135: \t\tos.Remove(tmp)\n1136: \t\treturn 0, err\n", + "line": "1135", + "column": "3", + "nosec": false, + "suppressions": null + }, + { + "severity": "LOW", + "confidence": "HIGH", + "cwe": { + "id": "703", + "url": "https://cwe.mitre.org/data/definitions/703.html" + }, + "rule_id": "G104", + "details": "Errors unhandled", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/stacks/migrate.go", + "code": "1127: \tif err := os.Chmod(tmp, fi.Mode()); err != nil {\n1128: \t\tos.Remove(tmp)\n1129: \t\treturn 0, err\n", + "line": "1128", + "column": "3", + "nosec": false, + "suppressions": null + }, + { + "severity": "LOW", + "confidence": "HIGH", + "cwe": { + "id": "703", + "url": "https://cwe.mitre.org/data/definitions/703.html" + }, + "rule_id": "G104", + "details": "Errors unhandled", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/stacks/migrate.go", + "code": "1121: \tif err := out.Close(); err != nil {\n1122: \t\tos.Remove(tmp)\n1123: \t\treturn 0, err\n", + "line": "1122", + "column": "3", + "nosec": false, + "suppressions": null + }, + { + "severity": "LOW", + "confidence": "HIGH", + "cwe": { + "id": "703", + "url": "https://cwe.mitre.org/data/definitions/703.html" + }, + "rule_id": "G104", + "details": "Errors unhandled", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/stacks/migrate.go", + "code": "1117: \t\tout.Close()\n1118: \t\tos.Remove(tmp)\n1119: \t\treturn 0, err\n", + "line": "1118", + "column": "3", + "nosec": false, + "suppressions": null + }, + { + "severity": "LOW", + "confidence": "HIGH", + "cwe": { + "id": "703", + "url": "https://cwe.mitre.org/data/definitions/703.html" + }, + "rule_id": "G104", + "details": "Errors unhandled", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/stacks/migrate.go", + "code": "1116: \tif err := out.Sync(); err != nil {\n1117: \t\tout.Close()\n1118: \t\tos.Remove(tmp)\n", + "line": "1117", + "column": "3", + "nosec": false, + "suppressions": null + }, + { + "severity": "LOW", + "confidence": "HIGH", + "cwe": { + "id": "703", + "url": "https://cwe.mitre.org/data/definitions/703.html" + }, + "rule_id": "G104", + "details": "Errors unhandled", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/stacks/migrate.go", + "code": "1112: \t\tout.Close()\n1113: \t\tos.Remove(tmp)\n1114: \t\treturn 0, cerr\n", + "line": "1113", + "column": "3", + "nosec": false, + "suppressions": null + }, + { + "severity": "LOW", + "confidence": "HIGH", + "cwe": { + "id": "703", + "url": "https://cwe.mitre.org/data/definitions/703.html" + }, + "rule_id": "G104", + "details": "Errors unhandled", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/stacks/migrate.go", + "code": "1111: \tif cerr != nil {\n1112: \t\tout.Close()\n1113: \t\tos.Remove(tmp)\n", + "line": "1112", + "column": "3", + "nosec": false, + "suppressions": null + }, + { + "severity": "LOW", + "confidence": "HIGH", + "cwe": { + "id": "703", + "url": "https://cwe.mitre.org/data/definitions/703.html" + }, + "rule_id": "G104", + "details": "Errors unhandled", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/stacks/migrate.go", + "code": "834: \tif err := os.WriteFile(tmp, data, 0o600); err != nil {\n835: \t\tos.Remove(tmp)\n836: \t\treturn err\n", + "line": "835", + "column": "3", + "nosec": false, + "suppressions": null + }, + { + "severity": "LOW", + "confidence": "HIGH", + "cwe": { + "id": "703", + "url": "https://cwe.mitre.org/data/definitions/703.html" + }, + "rule_id": "G104", + "details": "Errors unhandled", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/stacks/healthprobe.go", + "code": "239: \t} else {\n240: \t\tconn.Close()\n241: \t\tdetail.Healthy = true\n", + "line": "240", + "column": "3", + "nosec": false, + "suppressions": null + }, + { + "severity": "LOW", + "confidence": "HIGH", + "cwe": { + "id": "703", + "url": "https://cwe.mitre.org/data/definitions/703.html" + }, + "rule_id": "G104", + "details": "Errors unhandled", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/stacks/filebrowser_password.go", + "code": "117: \tio.Copy(io.Discard, io.LimitReader(resp.Body, 1\u003c\u003c16))\n118: \tresp.Body.Close()\n119: \tif resp.StatusCode/100 != 2 {\n", + "line": "118", + "column": "2", + "nosec": false, + "suppressions": null + }, + { + "severity": "LOW", + "confidence": "HIGH", + "cwe": { + "id": "703", + "url": "https://cwe.mitre.org/data/definitions/703.html" + }, + "rule_id": "G104", + "details": "Errors unhandled", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/stacks/filebrowser_password.go", + "code": "116: \t}\n117: \tio.Copy(io.Discard, io.LimitReader(resp.Body, 1\u003c\u003c16))\n118: \tresp.Body.Close()\n", + "line": "117", + "column": "2", + "nosec": false, + "suppressions": null + }, + { + "severity": "LOW", + "confidence": "HIGH", + "cwe": { + "id": "703", + "url": "https://cwe.mitre.org/data/definitions/703.html" + }, + "rule_id": "G104", + "details": "Errors unhandled", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/setup/setup.go", + "code": "129: func (s *SetupState) Remove() {\n130: \tos.Remove(s.path)\n131: }\n", + "line": "130", + "column": "2", + "nosec": false, + "suppressions": null + }, + { + "severity": "LOW", + "confidence": "HIGH", + "cwe": { + "id": "703", + "url": "https://cwe.mitre.org/data/definitions/703.html" + }, + "rule_id": "G104", + "details": "Errors unhandled", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/setup/setup.go", + "code": "91: \tif err := os.Rename(tmp, s.path); err != nil {\n92: \t\tos.Remove(tmp)\n93: \t\treturn err\n", + "line": "92", + "column": "3", + "nosec": false, + "suppressions": null + }, + { + "severity": "LOW", + "confidence": "HIGH", + "cwe": { + "id": "703", + "url": "https://cwe.mitre.org/data/definitions/703.html" + }, + "rule_id": "G104", + "details": "Errors unhandled", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/setup/setup.go", + "code": "87: \tif err := os.WriteFile(tmp, data, 0600); err != nil {\n88: \t\tos.Remove(tmp)\n89: \t\treturn err\n", + "line": "88", + "column": "3", + "nosec": false, + "suppressions": null + }, + { + "severity": "LOW", + "confidence": "HIGH", + "cwe": { + "id": "703", + "url": "https://cwe.mitre.org/data/definitions/703.html" + }, + "rule_id": "G104", + "details": "Errors unhandled", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/setup/setup.go", + "code": "28: func ClearSetupMarker(dataDir string) {\n29: \tos.Remove(filepath.Join(dataDir, \".needs-setup\"))\n30: }\n", + "line": "29", + "column": "2", + "nosec": false, + "suppressions": null + }, + { + "severity": "LOW", + "confidence": "HIGH", + "cwe": { + "id": "703", + "url": "https://cwe.mitre.org/data/definitions/703.html" + }, + "rule_id": "G104", + "details": "Errors unhandled", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/setup/handlers.go", + "code": "551: \tif err := os.Rename(tmp, path); err != nil {\n552: \t\tos.Remove(tmp)\n553: \t\t// Rename fails on bind-mounted files (EBUSY). Fall back to direct write.\n", + "line": "552", + "column": "3", + "nosec": false, + "suppressions": null + }, + { + "severity": "LOW", + "confidence": "HIGH", + "cwe": { + "id": "703", + "url": "https://cwe.mitre.org/data/definitions/703.html" + }, + "rule_id": "G104", + "details": "Errors unhandled", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/setup/handlers.go", + "code": "547: \tif err := os.WriteFile(tmp, data, perm); err != nil {\n548: \t\tos.Remove(tmp)\n549: \t\treturn err\n", + "line": "548", + "column": "3", + "nosec": false, + "suppressions": null + }, + { + "severity": "LOW", + "confidence": "HIGH", + "cwe": { + "id": "703", + "url": "https://cwe.mitre.org/data/definitions/703.html" + }, + "rule_id": "G104", + "details": "Errors unhandled", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/setup/handlers.go", + "code": "417: \tsecretBytes := make([]byte, 32)\n418: \tcrand.Read(secretBytes)\n419: \tsessionSecret := hex.EncodeToString(secretBytes)\n", + "line": "418", + "column": "2", + "nosec": false, + "suppressions": null + }, + { + "severity": "LOW", + "confidence": "HIGH", + "cwe": { + "id": "703", + "url": "https://cwe.mitre.org/data/definitions/703.html" + }, + "rule_id": "G104", + "details": "Errors unhandled", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/setup/handlers.go", + "code": "392: \tif retrievalPassword != \"\" {\n393: \t\tsett.SetRetrievalPassword(retrievalPassword)\n394: \t}\n", + "line": "393", + "column": "3", + "nosec": false, + "suppressions": null + }, + { + "severity": "LOW", + "confidence": "HIGH", + "cwe": { + "id": "703", + "url": "https://cwe.mitre.org/data/definitions/703.html" + }, + "rule_id": "G104", + "details": "Errors unhandled", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/setup/handlers.go", + "code": "387: \t\tif err == nil {\n388: \t\t\tsett.SetPasswordHash(string(hash))\n389: \t\t}\n", + "line": "388", + "column": "4", + "nosec": false, + "suppressions": null + }, + { + "severity": "LOW", + "confidence": "HIGH", + "cwe": { + "id": "703", + "url": "https://cwe.mitre.org/data/definitions/703.html" + }, + "rule_id": "G104", + "details": "Errors unhandled", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/setup/handlers.go", + "code": "229: \t\ts.state.SetFormField(\"retrieval_password\", \"\")\n230: \t\ts.state.Save()\n231: \t\tvar msg string\n", + "line": "230", + "column": "3", + "nosec": false, + "suppressions": null + }, + { + "severity": "LOW", + "confidence": "HIGH", + "cwe": { + "id": "703", + "url": "https://cwe.mitre.org/data/definitions/703.html" + }, + "rule_id": "G104", + "details": "Errors unhandled", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/setup/handlers.go", + "code": "203: \tw.Header().Set(\"Cache-Control\", \"public, max-age=3600\")\n204: \tw.Write(data)\n205: }\n", + "line": "204", + "column": "2", + "nosec": false, + "suppressions": null + }, + { + "severity": "LOW", + "confidence": "HIGH", + "cwe": { + "id": "703", + "url": "https://cwe.mitre.org/data/definitions/703.html" + }, + "rule_id": "G104", + "details": "Errors unhandled", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/setup/handlers.go", + "code": "198: \t\tw.Header().Set(\"Content-Type\", \"text/css; charset=utf-8\")\n199: \t\tw.Write([]byte(minimalCSS))\n200: \t\treturn\n", + "line": "199", + "column": "3", + "nosec": false, + "suppressions": null + }, + { + "severity": "LOW", + "confidence": "HIGH", + "cwe": { + "id": "703", + "url": "https://cwe.mitre.org/data/definitions/703.html" + }, + "rule_id": "G104", + "details": "Errors unhandled", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/setup/handlers.go", + "code": "58: \tif s.isHubPreseeded() {\n59: \t\ts.state.Save()\n60: \t}\n", + "line": "59", + "column": "3", + "nosec": false, + "suppressions": null + }, + { + "severity": "LOW", + "confidence": "HIGH", + "cwe": { + "id": "703", + "url": "https://cwe.mitre.org/data/definitions/703.html" + }, + "rule_id": "G104", + "details": "Errors unhandled", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/settings/settings.go", + "code": "873: \tif err := os.Rename(tmpPath, s.path); err != nil {\n874: \t\tos.Remove(tmpPath)\n875: \t\tif s.log != nil {\n", + "line": "874", + "column": "3", + "nosec": false, + "suppressions": null + }, + { + "severity": "LOW", + "confidence": "HIGH", + "cwe": { + "id": "703", + "url": "https://cwe.mitre.org/data/definitions/703.html" + }, + "rule_id": "G104", + "details": "Errors unhandled", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/settings/settings.go", + "code": "865: \tif err := os.WriteFile(tmpPath, data, 0644); err != nil {\n866: \t\tos.Remove(tmpPath) // clean up partial file\n867: \t\tif s.log != nil {\n", + "line": "866", + "column": "3", + "nosec": false, + "suppressions": null + }, + { + "severity": "LOW", + "confidence": "HIGH", + "cwe": { + "id": "703", + "url": "https://cwe.mitre.org/data/definitions/703.html" + }, + "rule_id": "G104", + "details": "Errors unhandled", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/selfupdate/updater.go", + "code": "850: \t\tstate.CompletedAt = time.Now().UTC().Format(time.RFC3339)\n851: \t\tSaveState(u.dataDir, state)\n852: \t\tu.logger.Printf(\"[WARN] [selfupdate] Post-update startup: version mismatch (expected %s, running %s)\", state.TargetVersion, u.currentVer)\n", + "line": "851", + "column": "3", + "nosec": false, + "suppressions": null + }, + { + "severity": "LOW", + "confidence": "HIGH", + "cwe": { + "id": "703", + "url": "https://cwe.mitre.org/data/definitions/703.html" + }, + "rule_id": "G104", + "details": "Errors unhandled", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/selfupdate/updater.go", + "code": "843: \t\tstate.CompletedAt = time.Now().UTC().Format(time.RFC3339)\n844: \t\tSaveState(u.dataDir, state)\n845: \t\tu.logger.Printf(\"[INFO] [selfupdate] Post-update startup: update successful (%s → %s)\", state.PreviousVersion, state.TargetVersion)\n", + "line": "844", + "column": "3", + "nosec": false, + "suppressions": null + }, + { + "severity": "LOW", + "confidence": "HIGH", + "cwe": { + "id": "703", + "url": "https://cwe.mitre.org/data/definitions/703.html" + }, + "rule_id": "G104", + "details": "Errors unhandled", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/selfupdate/updater.go", + "code": "834: \t\tstate.CompletedAt = time.Now().UTC().Format(time.RFC3339)\n835: \t\tSaveState(u.dataDir, state)\n836: \t\tu.logger.Printf(\"[WARN] [selfupdate] Post-update startup: version parse error (current=%s, target=%s)\", u.currentVer, state.TargetVersion)\n", + "line": "835", + "column": "3", + "nosec": false, + "suppressions": null + }, + { + "severity": "LOW", + "confidence": "HIGH", + "cwe": { + "id": "703", + "url": "https://cwe.mitre.org/data/definitions/703.html" + }, + "rule_id": "G104", + "details": "Errors unhandled", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/selfupdate/updater.go", + "code": "758: \t\tstate.CompletedAt = time.Now().UTC().Format(time.RFC3339)\n759: \t\tSaveState(u.dataDir, state)\n760: \t\tu.logger.Printf(\"[ERROR] [selfupdate] Agent swap request failed: %v\", err)\n", + "line": "759", + "column": "3", + "nosec": false, + "suppressions": null + }, + { + "severity": "LOW", + "confidence": "HIGH", + "cwe": { + "id": "703", + "url": "https://cwe.mitre.org/data/definitions/703.html" + }, + "rule_id": "G104", + "details": "Errors unhandled", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/selfupdate/updater.go", + "code": "743: \t\tstate.CompletedAt = time.Now().UTC().Format(time.RFC3339)\n744: \t\tSaveState(u.dataDir, state)\n745: \t\tu.logger.Printf(\"[ERROR] [selfupdate] %v\", err)\n", + "line": "744", + "column": "3", + "nosec": false, + "suppressions": null + }, + { + "severity": "LOW", + "confidence": "HIGH", + "cwe": { + "id": "703", + "url": "https://cwe.mitre.org/data/definitions/703.html" + }, + "rule_id": "G104", + "details": "Errors unhandled", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/selftest/selftest.go", + "code": "206: \t}\n207: \tresp.Body.Close()\n208: \n", + "line": "207", + "column": "2", + "nosec": false, + "suppressions": null + }, + { + "severity": "LOW", + "confidence": "HIGH", + "cwe": { + "id": "703", + "url": "https://cwe.mitre.org/data/definitions/703.html" + }, + "rule_id": "G104", + "details": "Errors unhandled", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/selftest/selftest.go", + "code": "125: \t}\n126: \tos.Remove(tmpFile)\n127: \n", + "line": "126", + "column": "2", + "nosec": false, + "suppressions": null + }, + { + "severity": "LOW", + "confidence": "HIGH", + "cwe": { + "id": "703", + "url": "https://cwe.mitre.org/data/definitions/703.html" + }, + "rule_id": "G104", + "details": "Errors unhandled", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/scheduler/scheduler.go", + "code": "362: \ts.mu.Unlock()\n363: \ts.runClaimed(s.ctx, job, quiet)\n364: }\n", + "line": "363", + "column": "2", + "nosec": false, + "suppressions": null + }, + { + "severity": "LOW", + "confidence": "HIGH", + "cwe": { + "id": "703", + "url": "https://cwe.mitre.org/data/definitions/703.html" + }, + "rule_id": "G104", + "details": "Errors unhandled", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/report/pusher.go", + "code": "206: \tio.Copy(io.Discard, resp.Body)\n207: \tresp.Body.Close()\n208: \n", + "line": "207", + "column": "2", + "nosec": false, + "suppressions": null + }, + { + "severity": "LOW", + "confidence": "HIGH", + "cwe": { + "id": "703", + "url": "https://cwe.mitre.org/data/definitions/703.html" + }, + "rule_id": "G104", + "details": "Errors unhandled", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/report/pusher.go", + "code": "205: \t}\n206: \tio.Copy(io.Discard, resp.Body)\n207: \tresp.Body.Close()\n", + "line": "206", + "column": "2", + "nosec": false, + "suppressions": null + }, + { + "severity": "LOW", + "confidence": "HIGH", + "cwe": { + "id": "703", + "url": "https://cwe.mitre.org/data/definitions/703.html" + }, + "rule_id": "G104", + "details": "Errors unhandled", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/report/pusher.go", + "code": "138: \t\trespBody, _ := io.ReadAll(io.LimitReader(resp.Body, maxPushResponseBytes))\n139: \t\tresp.Body.Close()\n140: \n", + "line": "139", + "column": "3", + "nosec": false, + "suppressions": null + }, + { + "severity": "LOW", + "confidence": "HIGH", + "cwe": { + "id": "703", + "url": "https://cwe.mitre.org/data/definitions/703.html" + }, + "rule_id": "G104", + "details": "Errors unhandled", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/recovery/info.go", + "code": "63: \tif err := os.Rename(tmp, path); err != nil {\n64: \t\tos.Remove(tmp)\n65: \t\treturn err\n", + "line": "64", + "column": "3", + "nosec": false, + "suppressions": null + }, + { + "severity": "LOW", + "confidence": "HIGH", + "cwe": { + "id": "703", + "url": "https://cwe.mitre.org/data/definitions/703.html" + }, + "rule_id": "G104", + "details": "Errors unhandled", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/recovery/info.go", + "code": "59: \tif err := os.WriteFile(tmp, []byte(content), 0600); err != nil {\n60: \t\tos.Remove(tmp)\n61: \t\treturn err\n", + "line": "60", + "column": "3", + "nosec": false, + "suppressions": null + }, + { + "severity": "LOW", + "confidence": "HIGH", + "cwe": { + "id": "703", + "url": "https://cwe.mitre.org/data/definitions/703.html" + }, + "rule_id": "G104", + "details": "Errors unhandled", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/quiesce/quiesce.go", + "code": "872: \tif err := os.WriteFile(tmp, data, 0o600); err != nil {\n873: \t\tos.Remove(tmp)\n874: \t\treturn err\n", + "line": "873", + "column": "3", + "nosec": false, + "suppressions": null + }, + { + "severity": "LOW", + "confidence": "HIGH", + "cwe": { + "id": "703", + "url": "https://cwe.mitre.org/data/definitions/703.html" + }, + "rule_id": "G104", + "details": "Errors unhandled", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/offsiteapply/seams.go", + "code": "233: \tif c != nil {\n234: \t\tc.Close()\n235: \t}\n", + "line": "234", + "column": "3", + "nosec": false, + "suppressions": null + }, + { + "severity": "LOW", + "confidence": "HIGH", + "cwe": { + "id": "703", + "url": "https://cwe.mitre.org/data/definitions/703.html" + }, + "rule_id": "G104", + "details": "Errors unhandled", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/notify/notifier.go", + "code": "1266: \t\tio.Copy(io.Discard, resp.Body)\n1267: \t\tresp.Body.Close()\n1268: \t}()\n", + "line": "1267", + "column": "3", + "nosec": false, + "suppressions": null + }, + { + "severity": "LOW", + "confidence": "HIGH", + "cwe": { + "id": "703", + "url": "https://cwe.mitre.org/data/definitions/703.html" + }, + "rule_id": "G104", + "details": "Errors unhandled", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/notify/notifier.go", + "code": "1265: \t\t}\n1266: \t\tio.Copy(io.Discard, resp.Body)\n1267: \t\tresp.Body.Close()\n", + "line": "1266", + "column": "3", + "nosec": false, + "suppressions": null + }, + { + "severity": "LOW", + "confidence": "HIGH", + "cwe": { + "id": "703", + "url": "https://cwe.mitre.org/data/definitions/703.html" + }, + "rule_id": "G104", + "details": "Errors unhandled", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/notify/notifier.go", + "code": "1164: \tio.Copy(io.Discard, resp.Body)\n1165: \tresp.Body.Close()\n1166: \n", + "line": "1165", + "column": "2", + "nosec": false, + "suppressions": null + }, + { + "severity": "LOW", + "confidence": "HIGH", + "cwe": { + "id": "703", + "url": "https://cwe.mitre.org/data/definitions/703.html" + }, + "rule_id": "G104", + "details": "Errors unhandled", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/notify/notifier.go", + "code": "1163: \t}\n1164: \tio.Copy(io.Discard, resp.Body)\n1165: \tresp.Body.Close()\n", + "line": "1164", + "column": "2", + "nosec": false, + "suppressions": null + }, + { + "severity": "LOW", + "confidence": "HIGH", + "cwe": { + "id": "703", + "url": "https://cwe.mitre.org/data/definitions/703.html" + }, + "rule_id": "G104", + "details": "Errors unhandled", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/notify/notifier.go", + "code": "329: \t\t\tio.Copy(io.Discard, resp.Body)\n330: \t\t\tresp.Body.Close()\n331: \n", + "line": "330", + "column": "4", + "nosec": false, + "suppressions": null + }, + { + "severity": "LOW", + "confidence": "HIGH", + "cwe": { + "id": "703", + "url": "https://cwe.mitre.org/data/definitions/703.html" + }, + "rule_id": "G104", + "details": "Errors unhandled", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/notify/notifier.go", + "code": "328: \t\t\t}\n329: \t\t\tio.Copy(io.Discard, resp.Body)\n330: \t\t\tresp.Body.Close()\n", + "line": "329", + "column": "4", + "nosec": false, + "suppressions": null + }, + { + "severity": "LOW", + "confidence": "HIGH", + "cwe": { + "id": "703", + "url": "https://cwe.mitre.org/data/definitions/703.html" + }, + "rule_id": "G104", + "details": "Errors unhandled", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/metrics/store.go", + "code": "79: \t\tif _, err := db.Exec(s); err != nil {\n80: \t\t\tdb.Close()\n81: \t\t\treturn nil, fmt.Errorf(\"schema: %w\", err)\n", + "line": "80", + "column": "4", + "nosec": false, + "suppressions": null + }, + { + "severity": "LOW", + "confidence": "HIGH", + "cwe": { + "id": "703", + "url": "https://cwe.mitre.org/data/definitions/703.html" + }, + "rule_id": "G104", + "details": "Errors unhandled", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/metrics/store.go", + "code": "41: \t\tif _, err := db.Exec(p); err != nil {\n42: \t\t\tdb.Close()\n43: \t\t\treturn nil, fmt.Errorf(\"pragma %q: %w\", p, err)\n", + "line": "42", + "column": "4", + "nosec": false, + "suppressions": null + }, + { + "severity": "LOW", + "confidence": "HIGH", + "cwe": { + "id": "703", + "url": "https://cwe.mitre.org/data/definitions/703.html" + }, + "rule_id": "G104", + "details": "Errors unhandled", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/metrics/store.go", + "code": "31: \tif walMode != \"wal\" {\n32: \t\tdb.Close()\n33: \t\treturn nil, fmt.Errorf(\"WAL mode not supported on this filesystem (got %q)\", walMode)\n", + "line": "32", + "column": "3", + "nosec": false, + "suppressions": null + }, + { + "severity": "LOW", + "confidence": "HIGH", + "cwe": { + "id": "703", + "url": "https://cwe.mitre.org/data/definitions/703.html" + }, + "rule_id": "G104", + "details": "Errors unhandled", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/metrics/store.go", + "code": "27: \tif err := db.QueryRow(\"PRAGMA journal_mode=WAL\").Scan(\u0026walMode); err != nil {\n28: \t\tdb.Close()\n29: \t\treturn nil, fmt.Errorf(\"set WAL mode: %w\", err)\n", + "line": "28", + "column": "3", + "nosec": false, + "suppressions": null + }, + { + "severity": "LOW", + "confidence": "HIGH", + "cwe": { + "id": "703", + "url": "https://cwe.mitre.org/data/definitions/703.html" + }, + "rule_id": "G104", + "details": "Errors unhandled", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/mailrelay/server.go", + "code": "147: \t\tpl.Close()\n148: \t\ttl.Close()\n149: \t\treturn fmt.Errorf(\"mailrelay: listen %s: %w\", s.opts.PlainNoTLSAddr, err)\n", + "line": "148", + "column": "3", + "nosec": false, + "suppressions": null + }, + { + "severity": "LOW", + "confidence": "HIGH", + "cwe": { + "id": "703", + "url": "https://cwe.mitre.org/data/definitions/703.html" + }, + "rule_id": "G104", + "details": "Errors unhandled", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/mailrelay/server.go", + "code": "146: \tif err != nil {\n147: \t\tpl.Close()\n148: \t\ttl.Close()\n", + "line": "147", + "column": "3", + "nosec": false, + "suppressions": null + }, + { + "severity": "LOW", + "confidence": "HIGH", + "cwe": { + "id": "703", + "url": "https://cwe.mitre.org/data/definitions/703.html" + }, + "rule_id": "G104", + "details": "Errors unhandled", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/mailrelay/server.go", + "code": "141: \tif err != nil {\n142: \t\tpl.Close()\n143: \t\treturn fmt.Errorf(\"mailrelay: listen TLS %s: %w\", s.opts.TLSAddr, err)\n", + "line": "142", + "column": "3", + "nosec": false, + "suppressions": null + }, + { + "severity": "LOW", + "confidence": "HIGH", + "cwe": { + "id": "703", + "url": "https://cwe.mitre.org/data/definitions/703.html" + }, + "rule_id": "G104", + "details": "Errors unhandled", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/family/family.go", + "code": "137: \tif err := fh.Sync(); err != nil {\n138: \t\tfh.Close()\n139: \t\treturn err\n", + "line": "138", + "column": "3", + "nosec": false, + "suppressions": null + }, + { + "severity": "LOW", + "confidence": "HIGH", + "cwe": { + "id": "703", + "url": "https://cwe.mitre.org/data/definitions/703.html" + }, + "rule_id": "G104", + "details": "Errors unhandled", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/family/family.go", + "code": "133: \tif _, err := fh.Write(b); err != nil {\n134: \t\tfh.Close()\n135: \t\treturn err\n", + "line": "134", + "column": "3", + "nosec": false, + "suppressions": null + }, + { + "severity": "LOW", + "confidence": "HIGH", + "cwe": { + "id": "703", + "url": "https://cwe.mitre.org/data/definitions/703.html" + }, + "rule_id": "G104", + "details": "Errors unhandled", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/dockerexec/dockerexec.go", + "code": "96: \t}\n97: \tos.Setenv(\"PATH\", dir+string(os.PathListSeparator)+os.Getenv(\"PATH\"))\n98: \treturn m.Run()\n", + "line": "97", + "column": "2", + "nosec": false, + "suppressions": null + }, + { + "severity": "LOW", + "confidence": "HIGH", + "cwe": { + "id": "703", + "url": "https://cwe.mitre.org/data/definitions/703.html" + }, + "rule_id": "G104", + "details": "Errors unhandled", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/backup/tier2_whole.go", + "code": "111: \tif err := os.Link(tmp, dst); err != nil {\n112: \t\tos.Remove(tmp)\n113: \t\treturn err\n", + "line": "112", + "column": "3", + "nosec": false, + "suppressions": null + }, + { + "severity": "LOW", + "confidence": "HIGH", + "cwe": { + "id": "703", + "url": "https://cwe.mitre.org/data/definitions/703.html" + }, + "rule_id": "G104", + "details": "Errors unhandled", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/backup/tier2_whole.go", + "code": "101: \tif err := out.Close(); err != nil {\n102: \t\tos.Remove(tmp)\n103: \t\treturn err\n", + "line": "102", + "column": "3", + "nosec": false, + "suppressions": null + }, + { + "severity": "LOW", + "confidence": "HIGH", + "cwe": { + "id": "703", + "url": "https://cwe.mitre.org/data/definitions/703.html" + }, + "rule_id": "G104", + "details": "Errors unhandled", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/backup/tier2_whole.go", + "code": "97: \t\tout.Close()\n98: \t\tos.Remove(tmp)\n99: \t\treturn err\n", + "line": "98", + "column": "3", + "nosec": false, + "suppressions": null + }, + { + "severity": "LOW", + "confidence": "HIGH", + "cwe": { + "id": "703", + "url": "https://cwe.mitre.org/data/definitions/703.html" + }, + "rule_id": "G104", + "details": "Errors unhandled", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/backup/tier2_whole.go", + "code": "96: \tif err := out.Sync(); err != nil {\n97: \t\tout.Close()\n98: \t\tos.Remove(tmp)\n", + "line": "97", + "column": "3", + "nosec": false, + "suppressions": null + }, + { + "severity": "LOW", + "confidence": "HIGH", + "cwe": { + "id": "703", + "url": "https://cwe.mitre.org/data/definitions/703.html" + }, + "rule_id": "G104", + "details": "Errors unhandled", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/backup/tier2_whole.go", + "code": "92: \t\tout.Close()\n93: \t\tos.Remove(tmp)\n94: \t\treturn err\n", + "line": "93", + "column": "3", + "nosec": false, + "suppressions": null + }, + { + "severity": "LOW", + "confidence": "HIGH", + "cwe": { + "id": "703", + "url": "https://cwe.mitre.org/data/definitions/703.html" + }, + "rule_id": "G104", + "details": "Errors unhandled", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/backup/tier2_whole.go", + "code": "91: \tif _, err := io.Copy(out, in); err != nil {\n92: \t\tout.Close()\n93: \t\tos.Remove(tmp)\n", + "line": "92", + "column": "3", + "nosec": false, + "suppressions": null + }, + { + "severity": "LOW", + "confidence": "HIGH", + "cwe": { + "id": "703", + "url": "https://cwe.mitre.org/data/definitions/703.html" + }, + "rule_id": "G104", + "details": "Errors unhandled", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/backup/restore.go", + "code": "217: \t\t// Remove existing volume (ignore errors — may not exist)\n218: \t\tdockerexec.Command(\"docker\", \"volume\", \"rm\", \"-f\", volName).Run()\n219: \n", + "line": "218", + "column": "3", + "nosec": false, + "suppressions": null + }, + { + "severity": "LOW", + "confidence": "HIGH", + "cwe": { + "id": "703", + "url": "https://cwe.mitre.org/data/definitions/703.html" + }, + "rule_id": "G104", + "details": "Errors unhandled", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/backup/recovery_unit.go", + "code": "641: \tif err := os.Rename(tmp, path); err != nil {\n642: \t\tos.Remove(tmp)\n643: \t\treturn err\n", + "line": "642", + "column": "3", + "nosec": false, + "suppressions": null + }, + { + "severity": "LOW", + "confidence": "HIGH", + "cwe": { + "id": "703", + "url": "https://cwe.mitre.org/data/definitions/703.html" + }, + "rule_id": "G104", + "details": "Errors unhandled", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/backup/recovery_unit.go", + "code": "637: \tif err := f.Close(); err != nil {\n638: \t\tos.Remove(tmp)\n639: \t\treturn err\n", + "line": "638", + "column": "3", + "nosec": false, + "suppressions": null + }, + { + "severity": "LOW", + "confidence": "HIGH", + "cwe": { + "id": "703", + "url": "https://cwe.mitre.org/data/definitions/703.html" + }, + "rule_id": "G104", + "details": "Errors unhandled", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/backup/recovery_unit.go", + "code": "633: \t\tf.Close()\n634: \t\tos.Remove(tmp)\n635: \t\treturn err\n", + "line": "634", + "column": "3", + "nosec": false, + "suppressions": null + }, + { + "severity": "LOW", + "confidence": "HIGH", + "cwe": { + "id": "703", + "url": "https://cwe.mitre.org/data/definitions/703.html" + }, + "rule_id": "G104", + "details": "Errors unhandled", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/backup/recovery_unit.go", + "code": "632: \tif _, err := io.Copy(f, strings.NewReader(string(data))); err != nil {\n633: \t\tf.Close()\n634: \t\tos.Remove(tmp)\n", + "line": "633", + "column": "3", + "nosec": false, + "suppressions": null + }, + { + "severity": "LOW", + "confidence": "HIGH", + "cwe": { + "id": "703", + "url": "https://cwe.mitre.org/data/definitions/703.html" + }, + "rule_id": "G104", + "details": "Errors unhandled", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/backup/offbox_restore.go", + "code": "481: \tif err := f.Close(); err != nil {\n482: \t\tos.Remove(tmp)\n483: \t\treturn err\n", + "line": "482", + "column": "3", + "nosec": false, + "suppressions": null + }, + { + "severity": "LOW", + "confidence": "HIGH", + "cwe": { + "id": "703", + "url": "https://cwe.mitre.org/data/definitions/703.html" + }, + "rule_id": "G104", + "details": "Errors unhandled", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/backup/offbox_restore.go", + "code": "477: \t\tf.Close()\n478: \t\tos.Remove(tmp)\n479: \t\treturn err\n", + "line": "478", + "column": "3", + "nosec": false, + "suppressions": null + }, + { + "severity": "LOW", + "confidence": "HIGH", + "cwe": { + "id": "703", + "url": "https://cwe.mitre.org/data/definitions/703.html" + }, + "rule_id": "G104", + "details": "Errors unhandled", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/backup/offbox_restore.go", + "code": "476: \tif err := f.Sync(); err != nil {\n477: \t\tf.Close()\n478: \t\tos.Remove(tmp)\n", + "line": "477", + "column": "3", + "nosec": false, + "suppressions": null + }, + { + "severity": "LOW", + "confidence": "HIGH", + "cwe": { + "id": "703", + "url": "https://cwe.mitre.org/data/definitions/703.html" + }, + "rule_id": "G104", + "details": "Errors unhandled", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/backup/offbox_restore.go", + "code": "472: \t\tf.Close()\n473: \t\tos.Remove(tmp)\n474: \t\treturn err\n", + "line": "473", + "column": "3", + "nosec": false, + "suppressions": null + }, + { + "severity": "LOW", + "confidence": "HIGH", + "cwe": { + "id": "703", + "url": "https://cwe.mitre.org/data/definitions/703.html" + }, + "rule_id": "G104", + "details": "Errors unhandled", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/backup/offbox_restore.go", + "code": "471: \tif _, err := f.Write(data); err != nil {\n472: \t\tf.Close()\n473: \t\tos.Remove(tmp)\n", + "line": "472", + "column": "3", + "nosec": false, + "suppressions": null + }, + { + "severity": "LOW", + "confidence": "HIGH", + "cwe": { + "id": "703", + "url": "https://cwe.mitre.org/data/definitions/703.html" + }, + "rule_id": "G104", + "details": "Errors unhandled", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/backup/offbox_restore.go", + "code": "99: \tvar size int64\n100: \tfmt.Sscanf(strings.TrimSpace(lines[1]), \"%d\", \u0026size)\n101: \treturn size\n", + "line": "100", + "column": "2", + "nosec": false, + "suppressions": null + }, + { + "severity": "LOW", + "confidence": "HIGH", + "cwe": { + "id": "703", + "url": "https://cwe.mitre.org/data/definitions/703.html" + }, + "rule_id": "G104", + "details": "Errors unhandled", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/backup/backup.go", + "code": "963: \tif err := f.Sync(); err != nil {\n964: \t\tf.Close()\n965: \t\treturn fmt.Errorf(\"syncing tmp dump: %w\", err)\n", + "line": "964", + "column": "3", + "nosec": false, + "suppressions": null + }, + { + "severity": "LOW", + "confidence": "HIGH", + "cwe": { + "id": "703", + "url": "https://cwe.mitre.org/data/definitions/703.html" + }, + "rule_id": "G104", + "details": "Errors unhandled", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/backup/backup.go", + "code": "921: \t\tif !activeVols[name] \u0026\u0026 strings.HasSuffix(name, \".tar\") {\n922: \t\t\tos.Remove(filepath.Join(dumpDir, name))\n923: \t\t\tif m.isDebug() {\n", + "line": "922", + "column": "4", + "nosec": false, + "suppressions": null + }, + { + "severity": "LOW", + "confidence": "HIGH", + "cwe": { + "id": "703", + "url": "https://cwe.mitre.org/data/definitions/703.html" + }, + "rule_id": "G104", + "details": "Errors unhandled", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/backup/backup.go", + "code": "917: \t\tif strings.HasSuffix(name, \".tar.tmp\") {\n918: \t\t\tos.Remove(filepath.Join(dumpDir, name))\n919: \t\t\tcontinue\n", + "line": "918", + "column": "4", + "nosec": false, + "suppressions": null + }, + { + "severity": "LOW", + "confidence": "HIGH", + "cwe": { + "id": "703", + "url": "https://cwe.mitre.org/data/definitions/703.html" + }, + "rule_id": "G104", + "details": "Errors unhandled", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/backup/backup.go", + "code": "894: \t\t\t\tstackName, volName, err)\n895: \t\t\tos.Remove(tmpPath)\n896: \t\t\tdumpErrors = append(dumpErrors, volName)\n", + "line": "895", + "column": "4", + "nosec": false, + "suppressions": null + }, + { + "severity": "LOW", + "confidence": "HIGH", + "cwe": { + "id": "703", + "url": "https://cwe.mitre.org/data/definitions/703.html" + }, + "rule_id": "G104", + "details": "Errors unhandled", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/backup/backup.go", + "code": "885: \t\t\t\tstackName, volName, strings.TrimSpace(string(out)), err)\n886: \t\t\tos.Remove(tmpPath)\n887: \t\t\tdumpErrors = append(dumpErrors, volName)\n", + "line": "886", + "column": "4", + "nosec": false, + "suppressions": null + }, + { + "severity": "LOW", + "confidence": "HIGH", + "cwe": { + "id": "703", + "url": "https://cwe.mitre.org/data/definitions/703.html" + }, + "rule_id": "G104", + "details": "Errors unhandled", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/backup/appstop_marker.go", + "code": "391: \tif err := f.Close(); err != nil {\n392: \t\tos.Remove(tmp)\n393: \t\treturn err\n", + "line": "392", + "column": "3", + "nosec": false, + "suppressions": null + }, + { + "severity": "LOW", + "confidence": "HIGH", + "cwe": { + "id": "703", + "url": "https://cwe.mitre.org/data/definitions/703.html" + }, + "rule_id": "G104", + "details": "Errors unhandled", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/backup/appstop_marker.go", + "code": "387: \t\tf.Close()\n388: \t\tos.Remove(tmp)\n389: \t\treturn err\n", + "line": "388", + "column": "3", + "nosec": false, + "suppressions": null + }, + { + "severity": "LOW", + "confidence": "HIGH", + "cwe": { + "id": "703", + "url": "https://cwe.mitre.org/data/definitions/703.html" + }, + "rule_id": "G104", + "details": "Errors unhandled", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/backup/appstop_marker.go", + "code": "386: \tif err := f.Sync(); err != nil {\n387: \t\tf.Close()\n388: \t\tos.Remove(tmp)\n", + "line": "387", + "column": "3", + "nosec": false, + "suppressions": null + }, + { + "severity": "LOW", + "confidence": "HIGH", + "cwe": { + "id": "703", + "url": "https://cwe.mitre.org/data/definitions/703.html" + }, + "rule_id": "G104", + "details": "Errors unhandled", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/backup/appstop_marker.go", + "code": "380: \t\tf.Close()\n381: \t\tos.Remove(tmp)\n382: \t\treturn err\n", + "line": "381", + "column": "3", + "nosec": false, + "suppressions": null + }, + { + "severity": "LOW", + "confidence": "HIGH", + "cwe": { + "id": "703", + "url": "https://cwe.mitre.org/data/definitions/703.html" + }, + "rule_id": "G104", + "details": "Errors unhandled", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/backup/appstop_marker.go", + "code": "379: \tif _, err := f.Write(data); err != nil {\n380: \t\tf.Close()\n381: \t\tos.Remove(tmp)\n", + "line": "380", + "column": "3", + "nosec": false, + "suppressions": null + }, + { + "severity": "LOW", + "confidence": "HIGH", + "cwe": { + "id": "703", + "url": "https://cwe.mitre.org/data/definitions/703.html" + }, + "rule_id": "G104", + "details": "Errors unhandled", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/assets/syncer.go", + "code": "308: \tif err := out.Close(); err != nil {\n309: \t\tos.Remove(tmp)\n310: \t\treturn err\n", + "line": "309", + "column": "3", + "nosec": false, + "suppressions": null + }, + { + "severity": "LOW", + "confidence": "HIGH", + "cwe": { + "id": "703", + "url": "https://cwe.mitre.org/data/definitions/703.html" + }, + "rule_id": "G104", + "details": "Errors unhandled", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/assets/syncer.go", + "code": "304: \t\tout.Close()\n305: \t\tos.Remove(tmp)\n306: \t\treturn err\n", + "line": "305", + "column": "3", + "nosec": false, + "suppressions": null + }, + { + "severity": "LOW", + "confidence": "HIGH", + "cwe": { + "id": "703", + "url": "https://cwe.mitre.org/data/definitions/703.html" + }, + "rule_id": "G104", + "details": "Errors unhandled", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/assets/syncer.go", + "code": "303: \tif _, err := io.Copy(out, resp.Body); err != nil {\n304: \t\tout.Close()\n305: \t\tos.Remove(tmp)\n", + "line": "304", + "column": "3", + "nosec": false, + "suppressions": null + }, + { + "severity": "LOW", + "confidence": "HIGH", + "cwe": { + "id": "703", + "url": "https://cwe.mitre.org/data/definitions/703.html" + }, + "rule_id": "G104", + "details": "Errors unhandled", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/appexport/restore.go", + "code": "1174: \t\t\toutFile.Close()\n1175: \t\t\tos.Chmod(target, os.FileMode(hdr.Mode))\n1176: \t\t}\n", + "line": "1175", + "column": "4", + "nosec": false, + "suppressions": null + }, + { + "severity": "LOW", + "confidence": "HIGH", + "cwe": { + "id": "703", + "url": "https://cwe.mitre.org/data/definitions/703.html" + }, + "rule_id": "G104", + "details": "Errors unhandled", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/appexport/restore.go", + "code": "1173: \t\t\t}\n1174: \t\t\toutFile.Close()\n1175: \t\t\tos.Chmod(target, os.FileMode(hdr.Mode))\n", + "line": "1174", + "column": "4", + "nosec": false, + "suppressions": null + }, + { + "severity": "LOW", + "confidence": "HIGH", + "cwe": { + "id": "703", + "url": "https://cwe.mitre.org/data/definitions/703.html" + }, + "rule_id": "G104", + "details": "Errors unhandled", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/appexport/restore.go", + "code": "1170: \t\t\tif _, err := io.Copy(outFile, tr); err != nil {\n1171: \t\t\t\toutFile.Close()\n1172: \t\t\t\treturn err\n", + "line": "1171", + "column": "5", + "nosec": false, + "suppressions": null + }, + { + "severity": "LOW", + "confidence": "HIGH", + "cwe": { + "id": "703", + "url": "https://cwe.mitre.org/data/definitions/703.html" + }, + "rule_id": "G104", + "details": "Errors unhandled", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/appexport/restore.go", + "code": "1126: \t\t\toutFile.Close()\n1127: \t\t\tos.Chmod(target, os.FileMode(hdr.Mode))\n1128: \t\t}\n", + "line": "1127", + "column": "4", + "nosec": false, + "suppressions": null + }, + { + "severity": "LOW", + "confidence": "HIGH", + "cwe": { + "id": "703", + "url": "https://cwe.mitre.org/data/definitions/703.html" + }, + "rule_id": "G104", + "details": "Errors unhandled", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/appexport/restore.go", + "code": "1125: \t\t\t}\n1126: \t\t\toutFile.Close()\n1127: \t\t\tos.Chmod(target, os.FileMode(hdr.Mode))\n", + "line": "1126", + "column": "4", + "nosec": false, + "suppressions": null + }, + { + "severity": "LOW", + "confidence": "HIGH", + "cwe": { + "id": "703", + "url": "https://cwe.mitre.org/data/definitions/703.html" + }, + "rule_id": "G104", + "details": "Errors unhandled", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/appexport/restore.go", + "code": "1122: \t\t\tif _, err := io.Copy(outFile, tr); err != nil {\n1123: \t\t\t\toutFile.Close()\n1124: \t\t\t\treturn err\n", + "line": "1123", + "column": "5", + "nosec": false, + "suppressions": null + }, + { + "severity": "LOW", + "confidence": "HIGH", + "cwe": { + "id": "703", + "url": "https://cwe.mitre.org/data/definitions/703.html" + }, + "rule_id": "G104", + "details": "Errors unhandled", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/appexport/restore.go", + "code": "289: \tif e.debug {\n290: \t\tfilepath.Walk(tmpDir, func(path string, info os.FileInfo, err error) error {\n291: \t\t\tif err != nil {\n292: \t\t\t\treturn nil\n293: \t\t\t}\n294: \t\t\trel, _ := filepath.Rel(tmpDir, path)\n295: \t\t\tif info.IsDir() {\n296: \t\t\t\te.debugf(\" [dir] %s/\", rel)\n297: \t\t\t} else {\n298: \t\t\t\te.debugf(\" [file] %s (%s)\", rel, humanizeBytes(info.Size()))\n299: \t\t\t}\n300: \t\t\treturn nil\n301: \t\t})\n302: \t}\n", + "line": "290-301", + "column": "3", + "nosec": false, + "suppressions": null + }, + { + "severity": "LOW", + "confidence": "HIGH", + "cwe": { + "id": "703", + "url": "https://cwe.mitre.org/data/definitions/703.html" + }, + "rule_id": "G104", + "details": "Errors unhandled", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/appexport/restore.go", + "code": "255: \t\ttmpPath := tmp.Name()\n256: \t\ttmp.Close()\n257: \t\tdefer os.Remove(tmpPath)\n", + "line": "256", + "column": "3", + "nosec": false, + "suppressions": null + }, + { + "severity": "LOW", + "confidence": "HIGH", + "cwe": { + "id": "703", + "url": "https://cwe.mitre.org/data/definitions/703.html" + }, + "rule_id": "G104", + "details": "Errors unhandled", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/appexport/restore.go", + "code": "168: \ttmpPath := tmpFile.Name()\n169: \ttmpFile.Close()\n170: \tdefer os.Remove(tmpPath)\n", + "line": "169", + "column": "2", + "nosec": false, + "suppressions": null + }, + { + "severity": "LOW", + "confidence": "HIGH", + "cwe": { + "id": "703", + "url": "https://cwe.mitre.org/data/definitions/703.html" + }, + "rule_id": "G104", + "details": "Errors unhandled", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/appexport/export.go", + "code": "955: \tvar total int64\n956: \tfilepath.Walk(dir, func(_ string, info os.FileInfo, err error) error {\n957: \t\tif err != nil || info.IsDir() {\n958: \t\t\treturn nil\n959: \t\t}\n960: \t\ttotal += info.Size()\n961: \t\treturn nil\n962: \t})\n963: \treturn total\n", + "line": "956-962", + "column": "2", + "nosec": false, + "suppressions": null + }, + { + "severity": "LOW", + "confidence": "HIGH", + "cwe": { + "id": "703", + "url": "https://cwe.mitre.org/data/definitions/703.html" + }, + "rule_id": "G104", + "details": "Errors unhandled", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/appexport/export.go", + "code": "799: \tvolDir := filepath.Join(dataDir, \"volumes\")\n800: \tos.MkdirAll(volDir, 0755)\n801: \n", + "line": "800", + "column": "2", + "nosec": false, + "suppressions": null + }, + { + "severity": "LOW", + "confidence": "HIGH", + "cwe": { + "id": "703", + "url": "https://cwe.mitre.org/data/definitions/703.html" + }, + "rule_id": "G104", + "details": "Errors unhandled", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/appexport/export.go", + "code": "785: \t\tif closeErr != nil {\n786: \t\t\tos.Remove(tarPath)\n787: \t\t\treturn fmt.Errorf(\"flushing %s: %w\", tarPath, closeErr)\n", + "line": "786", + "column": "4", + "nosec": false, + "suppressions": null + }, + { + "severity": "LOW", + "confidence": "HIGH", + "cwe": { + "id": "703", + "url": "https://cwe.mitre.org/data/definitions/703.html" + }, + "rule_id": "G104", + "details": "Errors unhandled", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/appexport/export.go", + "code": "781: \t\tif err != nil {\n782: \t\t\tos.Remove(tarPath)\n783: \t\t\treturn fmt.Errorf(\"streaming volume %s: %s — %w\", volName, stderr, err)\n", + "line": "782", + "column": "4", + "nosec": false, + "suppressions": null + }, + { + "severity": "LOW", + "confidence": "HIGH", + "cwe": { + "id": "703", + "url": "https://cwe.mitre.org/data/definitions/703.html" + }, + "rule_id": "G104", + "details": "Errors unhandled", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/appexport/export.go", + "code": "714: \t\t\te.logger.Printf(\"[WARN] Export: failed to tar %s (excluded from the bundle): %v\", mount, err)\n715: \t\t\tos.Remove(tarPath)\n716: \t\t} else {\n", + "line": "715", + "column": "4", + "nosec": false, + "suppressions": null + }, + { + "severity": "LOW", + "confidence": "HIGH", + "cwe": { + "id": "703", + "url": "https://cwe.mitre.org/data/definitions/703.html" + }, + "rule_id": "G104", + "details": "Errors unhandled", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/appexport/export.go", + "code": "661: \thddDir := filepath.Join(dataDir, \"hdd\")\n662: \tos.MkdirAll(hddDir, 0755)\n663: \n", + "line": "662", + "column": "2", + "nosec": false, + "suppressions": null + }, + { + "severity": "LOW", + "confidence": "HIGH", + "cwe": { + "id": "703", + "url": "https://cwe.mitre.org/data/definitions/703.html" + }, + "rule_id": "G104", + "details": "Errors unhandled", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/appexport/export.go", + "code": "644: \t\t\t}\n645: \t\t\tos.Remove(result.FilePath)\n646: \t\t}\n", + "line": "645", + "column": "4", + "nosec": false, + "suppressions": null + }, + { + "severity": "LOW", + "confidence": "HIGH", + "cwe": { + "id": "703", + "url": "https://cwe.mitre.org/data/definitions/703.html" + }, + "rule_id": "G104", + "details": "Errors unhandled", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/appexport/export.go", + "code": "480: \t\t}\n481: \t\tos.Remove(targetPath)\n482: \t\ttargetPath = encPath\n", + "line": "481", + "column": "3", + "nosec": false, + "suppressions": null + }, + { + "severity": "LOW", + "confidence": "HIGH", + "cwe": { + "id": "703", + "url": "https://cwe.mitre.org/data/definitions/703.html" + }, + "rule_id": "G104", + "details": "Errors unhandled", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/appexport/export.go", + "code": "476: \t\tif err := EncryptFile(targetPath, encPath, req.Password); err != nil {\n477: \t\t\tos.Remove(targetPath)\n478: \t\t\te.failJob(job, step, fmt.Sprintf(\"Titkosítás sikertelen: %v\", err))\n", + "line": "477", + "column": "4", + "nosec": false, + "suppressions": null + }, + { + "severity": "LOW", + "confidence": "HIGH", + "cwe": { + "id": "703", + "url": "https://cwe.mitre.org/data/definitions/703.html" + }, + "rule_id": "G104", + "details": "Errors unhandled", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/appexport/export.go", + "code": "457: \tif err := createTarGz(targetPath, tmpDir); err != nil {\n458: \t\tos.Remove(targetPath)\n459: \t\te.failJob(job, step, fmt.Sprintf(\"Csomag készítése sikertelen: %v\", err))\n", + "line": "458", + "column": "3", + "nosec": false, + "suppressions": null + }, + { + "severity": "LOW", + "confidence": "HIGH", + "cwe": { + "id": "703", + "url": "https://cwe.mitre.org/data/definitions/703.html" + }, + "rule_id": "G104", + "details": "Errors unhandled", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/appexport/export.go", + "code": "389: \tdataDir := filepath.Join(tmpDir, \"data\")\n390: \tos.MkdirAll(dataDir, 0755)\n391: \n", + "line": "390", + "column": "2", + "nosec": false, + "suppressions": null + }, + { + "severity": "LOW", + "confidence": "HIGH", + "cwe": { + "id": "703", + "url": "https://cwe.mitre.org/data/definitions/703.html" + }, + "rule_id": "G104", + "details": "Errors unhandled", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/appexport/export.go", + "code": "368: \t\te.debugf(\"no database found for %s — skipping DB step\", req.StackName)\n369: \t\tos.Remove(dbDir)\n370: \t} else {\n", + "line": "369", + "column": "3", + "nosec": false, + "suppressions": null + }, + { + "severity": "LOW", + "confidence": "HIGH", + "cwe": { + "id": "703", + "url": "https://cwe.mitre.org/data/definitions/703.html" + }, + "rule_id": "G104", + "details": "Errors unhandled", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/appexport/export.go", + "code": "350: \tdbDir := filepath.Join(tmpDir, \"database\")\n351: \tos.MkdirAll(dbDir, 0755)\n352: \n", + "line": "351", + "column": "2", + "nosec": false, + "suppressions": null + }, + { + "severity": "LOW", + "confidence": "HIGH", + "cwe": { + "id": "703", + "url": "https://cwe.mitre.org/data/definitions/703.html" + }, + "rule_id": "G104", + "details": "Errors unhandled", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/appexport/estimate.go", + "code": "207: \tvar size int64\n208: \tfmt.Sscanf(strings.TrimSpace(lines[1]), \"%d\", \u0026size)\n209: \treturn size\n", + "line": "208", + "column": "2", + "nosec": false, + "suppressions": null + }, + { + "severity": "LOW", + "confidence": "HIGH", + "cwe": { + "id": "703", + "url": "https://cwe.mitre.org/data/definitions/703.html" + }, + "rule_id": "G104", + "details": "Errors unhandled", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/appexport/estimate.go", + "code": "160: \tvar size int64\n161: \tfmt.Sscanf(strings.Fields(string(out))[0], \"%d\", \u0026size)\n162: \treturn size\n", + "line": "161", + "column": "2", + "nosec": false, + "suppressions": null + }, + { + "severity": "LOW", + "confidence": "HIGH", + "cwe": { + "id": "703", + "url": "https://cwe.mitre.org/data/definitions/703.html" + }, + "rule_id": "G104", + "details": "Errors unhandled", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/appexport/estimate.go", + "code": "116: \texportDir := ExportDir(destDrive)\n117: \tos.MkdirAll(exportDir, 0755)\n118: \test.DestFreeBytes = DiskFree(exportDir)\n", + "line": "117", + "column": "2", + "nosec": false, + "suppressions": null + }, + { + "severity": "LOW", + "confidence": "HIGH", + "cwe": { + "id": "703", + "url": "https://cwe.mitre.org/data/definitions/703.html" + }, + "rule_id": "G104", + "details": "Errors unhandled", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/appexport/crypto.go", + "code": "223: \tif !hmac.Equal(mac.Sum(nil), storedMAC) {\n224: \t\tos.Remove(outputPath)\n225: \t\treturn util.MsgError(\"err.appexport.jelszo_hibas_vagy_a_fajl_serult\")\n", + "line": "224", + "column": "3", + "nosec": false, + "suppressions": null + }, + { + "severity": "LOW", + "confidence": "HIGH", + "cwe": { + "id": "703", + "url": "https://cwe.mitre.org/data/definitions/703.html" + }, + "rule_id": "G104", + "details": "Errors unhandled", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/appbackup/dbdump.go", + "code": "992: \t\t\tpath := filepath.Join(dumpDir, e.Name())\n993: \t\t\tos.Remove(path)\n994: \t\t\tlogger.Printf(\"[INFO] [backup] Cleaned up stale tmp file: %s\", e.Name())\n", + "line": "993", + "column": "4", + "nosec": false, + "suppressions": null + }, + { + "severity": "LOW", + "confidence": "HIGH", + "cwe": { + "id": "703", + "url": "https://cwe.mitre.org/data/definitions/703.html" + }, + "rule_id": "G104", + "details": "Errors unhandled", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/appbackup/dbdump.go", + "code": "401: \tif err := os.Rename(tmpPath, finalPath); err != nil {\n402: \t\tos.Remove(tmpPath)\n403: \t\tresult.Error = fmt.Errorf(\"renaming dump file: %w\", err)\n", + "line": "402", + "column": "3", + "nosec": false, + "suppressions": null + }, + { + "severity": "LOW", + "confidence": "HIGH", + "cwe": { + "id": "703", + "url": "https://cwe.mitre.org/data/definitions/703.html" + }, + "rule_id": "G104", + "details": "Errors unhandled", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/appbackup/dbdump.go", + "code": "390: \tif err != nil || stat.Size() == 0 {\n391: \t\tos.Remove(tmpPath)\n392: \t\tresult.Error = fmt.Errorf(\"dump produced empty file for %s\", db.ContainerName)\n", + "line": "391", + "column": "3", + "nosec": false, + "suppressions": null + }, + { + "severity": "LOW", + "confidence": "HIGH", + "cwe": { + "id": "703", + "url": "https://cwe.mitre.org/data/definitions/703.html" + }, + "rule_id": "G104", + "details": "Errors unhandled", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/appbackup/dbdump.go", + "code": "381: \tif err := tmpFile.Close(); err != nil {\n382: \t\tos.Remove(tmpPath)\n383: \t\tresult.Error = fmt.Errorf(\"closing dump file: %w\", err)\n", + "line": "382", + "column": "3", + "nosec": false, + "suppressions": null + }, + { + "severity": "LOW", + "confidence": "HIGH", + "cwe": { + "id": "703", + "url": "https://cwe.mitre.org/data/definitions/703.html" + }, + "rule_id": "G104", + "details": "Errors unhandled", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/appbackup/dbdump.go", + "code": "375: \tif err := tmpFile.Sync(); err != nil {\n376: \t\tos.Remove(tmpPath)\n377: \t\tresult.Error = fmt.Errorf(\"syncing dump file: %w\", err)\n", + "line": "376", + "column": "3", + "nosec": false, + "suppressions": null + }, + { + "severity": "LOW", + "confidence": "HIGH", + "cwe": { + "id": "703", + "url": "https://cwe.mitre.org/data/definitions/703.html" + }, + "rule_id": "G104", + "details": "Errors unhandled", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/appbackup/dbdump.go", + "code": "360: \tif err != nil {\n361: \t\tos.Remove(tmpPath)\n362: \t\terrMsg := stderr.String()\n", + "line": "361", + "column": "3", + "nosec": false, + "suppressions": null + }, + { + "severity": "LOW", + "confidence": "HIGH", + "cwe": { + "id": "703", + "url": "https://cwe.mitre.org/data/definitions/703.html" + }, + "rule_id": "G104", + "details": "Errors unhandled", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/api/router.go", + "code": "1606: \tw.Header().Set(\"Content-Type\", \"text/yaml; charset=utf-8\")\n1607: \tw.Write(data)\n1608: }\n", + "line": "1607", + "column": "2", + "nosec": false, + "suppressions": null + }, + { + "severity": "LOW", + "confidence": "HIGH", + "cwe": { + "id": "703", + "url": "https://cwe.mitre.org/data/definitions/703.html" + }, + "rule_id": "G104", + "details": "Errors unhandled", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/api/router.go", + "code": "1579: \tif err := os.Rename(tmpPath, path); err != nil {\n1580: \t\tos.Remove(tmpPath)\n1581: \t\tif err := os.WriteFile(path, body, 0600); err != nil { // bind-mount fallback\n", + "line": "1580", + "column": "3", + "nosec": false, + "suppressions": null + }, + { + "severity": "LOW", + "confidence": "HIGH", + "cwe": { + "id": "703", + "url": "https://cwe.mitre.org/data/definitions/703.html" + }, + "rule_id": "G104", + "details": "Errors unhandled", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/cmd/controller/main.go", + "code": "3759: \tmainServer.Shutdown(shutdownCtx)\n3760: \tsetupServer.Shutdown(shutdownCtx)\n3761: \tlogger.Println(\"[INFO] Setup wizard stopped\")\n", + "line": "3760", + "column": "2", + "nosec": false, + "suppressions": null + }, + { + "severity": "LOW", + "confidence": "HIGH", + "cwe": { + "id": "703", + "url": "https://cwe.mitre.org/data/definitions/703.html" + }, + "rule_id": "G104", + "details": "Errors unhandled", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/cmd/controller/main.go", + "code": "3758: \tdefer shutdownCancel()\n3759: \tmainServer.Shutdown(shutdownCtx)\n3760: \tsetupServer.Shutdown(shutdownCtx)\n", + "line": "3759", + "column": "2", + "nosec": false, + "suppressions": null + }, + { + "severity": "LOW", + "confidence": "HIGH", + "cwe": { + "id": "703", + "url": "https://cwe.mitre.org/data/definitions/703.html" + }, + "rule_id": "G104", + "details": "Errors unhandled", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/cmd/controller/main.go", + "code": "3709: \t\tw.Header().Set(\"Content-Type\", \"application/json\")\n3710: \t\tjson.NewEncoder(w).Encode(map[string]interface{}{\n3711: \t\t\t\"ok\": true, \"message\": \"felhom-controller is healthy\",\n3712: \t\t\t\"setup_mode\": true, \"version\": Version,\n3713: \t\t})\n3714: \t})\n", + "line": "3710-3713", + "column": "3", + "nosec": false, + "suppressions": null + }, + { + "severity": "LOW", + "confidence": "HIGH", + "cwe": { + "id": "703", + "url": "https://cwe.mitre.org/data/definitions/703.html" + }, + "rule_id": "G104", + "details": "Errors unhandled", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/cmd/controller/main.go", + "code": "3238: func (a *stackAdapter) RefreshAndIsRunning(name string) bool {\n3239: \ta.mgr.RefreshStatus()\n3240: \ts, ok := a.mgr.GetStack(name)\n", + "line": "3239", + "column": "2", + "nosec": false, + "suppressions": null + }, + { + "severity": "LOW", + "confidence": "HIGH", + "cwe": { + "id": "703", + "url": "https://cwe.mitre.org/data/definitions/703.html" + }, + "rule_id": "G104", + "details": "Errors unhandled", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/cmd/controller/main.go", + "code": "2117: \t\t\t\t}\n2118: \t\t\t\tresp.Body.Close()\n2119: \t\t\t\treturn resp.StatusCode, latency, nil\n", + "line": "2118", + "column": "5", + "nosec": false, + "suppressions": null + }, + { + "severity": "LOW", + "confidence": "HIGH", + "cwe": { + "id": "703", + "url": "https://cwe.mitre.org/data/definitions/703.html" + }, + "rule_id": "G104", + "details": "Errors unhandled", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/cmd/controller/main.go", + "code": "2105: \t\t\t}\n2106: \t\t\tresp.Body.Close()\n2107: \t\t\treturn resp.StatusCode, latency, nil\n", + "line": "2106", + "column": "4", + "nosec": false, + "suppressions": null + }, + { + "severity": "LOW", + "confidence": "HIGH", + "cwe": { + "id": "703", + "url": "https://cwe.mitre.org/data/definitions/703.html" + }, + "rule_id": "G104", + "details": "Errors unhandled", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/cmd/controller/main.go", + "code": "1767: \t\t\t\t}\n1768: \t\t\t\thubPusher.PushOnce(r)\n1769: \t\t\t}\n", + "line": "1768", + "column": "5", + "nosec": false, + "suppressions": null + }, + { + "severity": "LOW", + "confidence": "HIGH", + "cwe": { + "id": "703", + "url": "https://cwe.mitre.org/data/definitions/703.html" + }, + "rule_id": "G104", + "details": "Errors unhandled", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/cmd/controller/main.go", + "code": "1094: \t\t\t} else {\n1095: \t\t\t\tsett.SetHubVerified(true, time.Now())\n1096: \t\t\t}\n", + "line": "1095", + "column": "5", + "nosec": false, + "suppressions": null + }, + { + "severity": "LOW", + "confidence": "HIGH", + "cwe": { + "id": "703", + "url": "https://cwe.mitre.org/data/definitions/703.html" + }, + "rule_id": "G104", + "details": "Errors unhandled", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/cmd/controller/main.go", + "code": "1091: \t\t\tif resp.CustomerBlocked {\n1092: \t\t\t\tsett.SetHubVerified(false, time.Now())\n1093: \t\t\t\tlogger.Printf(\"[WARN] Customer blocked on Hub — new deployments may be restricted\")\n", + "line": "1092", + "column": "5", + "nosec": false, + "suppressions": null + } + ], + "Stats": { + "files": 276, + "lines": 94504, + "nosec": 0, + "found": 470 + }, + "GosecVersion": "dev" +} \ No newline at end of file diff --git a/documentation/audits/security-review-2026-10-12/scanners/gosec-felhom.eu.json b/documentation/audits/security-review-2026-10-12/scanners/gosec-felhom.eu.json new file mode 100644 index 00000000..c6f5d8cb --- /dev/null +++ b/documentation/audits/security-review-2026-10-12/scanners/gosec-felhom.eu.json @@ -0,0 +1,3452 @@ +{ + "Golang errors": {}, + "Issues": [ + { + "severity": "HIGH", + "confidence": "LOW", + "cwe": { + "id": "798", + "url": "https://cwe.mitre.org/data/definitions/798.html" + }, + "rule_id": "G101", + "details": "Potential hardcoded credentials", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom.eu/hub/internal/offsiteheal/reconciler.go", + "code": "51: // excluded upstream, by the declaration itself, rather than filtered out here.\n52: const StateNeedsCredential = \"needs_credential\"\n53: \n", + "line": "52", + "column": "7", + "nosec": false, + "suppressions": null + }, + { + "severity": "HIGH", + "confidence": "LOW", + "cwe": { + "id": "798", + "url": "https://cwe.mitre.org/data/definitions/798.html" + }, + "rule_id": "G101", + "details": "Potential hardcoded credentials", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom.eu/hub/internal/monitor/offsite_delivery.go", + "code": "137: // are pinned together by TestDeclaredStateStringMatchesTheReconciler.\n138: const declaredNeedsCredential = \"needs_credential\"\n139: \n", + "line": "138", + "column": "7", + "nosec": false, + "suppressions": null + }, + { + "severity": "HIGH", + "confidence": "LOW", + "cwe": { + "id": "798", + "url": "https://cwe.mitre.org/data/definitions/798.html" + }, + "rule_id": "G101", + "details": "Potential hardcoded credentials", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom.eu/hub/internal/monitor/offsite_delivery.go", + "code": "34: \teventDeliveryStuck = \"offsite_delivery_stuck\" // hub-internal (not in allowedEventTypes, like pbsdr_*)\n35: \teventCredentialRestaged = \"offsite_credential_restaged\" // hub-internal\n36: \t// stuckAfter: consumed_awaiting_apply is normal for seconds (F10 repair: consume→applied in\n", + "line": "35", + "column": "2", + "nosec": false, + "suppressions": null + }, + { + "severity": "MEDIUM", + "confidence": "LOW", + "cwe": { + "id": "79", + "url": "https://cwe.mitre.org/data/definitions/79.html" + }, + "rule_id": "G203", + "details": "The used method does not auto-escape HTML. This can potentially lead to 'Cross-site Scripting' vulnerabilities, in case the attacker controls the input.", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom.eu/hub/internal/web/server.go", + "code": "1016: \ttok := s.csrfToken(r)\n1017: \treturn template.HTML(`\u003cinput type=\"hidden\" name=\"_csrf\" value=\"` + template.HTMLEscapeString(tok) + `\"\u003e`)\n1018: }\n", + "line": "1017", + "column": "9", + "nosec": false, + "suppressions": null + }, + { + "severity": "MEDIUM", + "confidence": "LOW", + "cwe": { + "id": "79", + "url": "https://cwe.mitre.org/data/definitions/79.html" + }, + "rule_id": "G203", + "details": "The used method does not auto-escape HTML. This can potentially lead to 'Cross-site Scripting' vulnerabilities, in case the attacker controls the input.", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom.eu/hub/internal/web/server.go", + "code": "153: \t\t\tb, _ := json.Marshal(v)\n154: \t\t\treturn template.JS(b)\n155: \t\t},\n", + "line": "154", + "column": "11", + "nosec": false, + "suppressions": null + }, + { + "severity": "MEDIUM", + "confidence": "HIGH", + "cwe": { + "id": "89", + "url": "https://cwe.mitre.org/data/definitions/89.html" + }, + "rule_id": "G202", + "details": "SQL string concatenation", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom.eu/hub/internal/store/telemetry.go", + "code": "574: \t}\n575: \tquery := \"DELETE FROM app_log_issues WHERE id IN (\" + strings.Join(placeholders, \",\") + \")\"\n576: \tres, err := s.db.Exec(query, args...)\n", + "line": "575", + "column": "11", + "nosec": false, + "suppressions": null + }, + { + "severity": "MEDIUM", + "confidence": "HIGH", + "cwe": { + "id": "89", + "url": "https://cwe.mitre.org/data/definitions/89.html" + }, + "rule_id": "G202", + "details": "SQL string concatenation", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom.eu/hub/internal/store/telemetry.go", + "code": "517: \t}\n518: \tquery := \"UPDATE app_log_issues SET dismissed_at = ? WHERE id IN (\" + strings.Join(placeholders, \",\") + \")\"\n519: \tres, err := s.db.Exec(query, args...)\n", + "line": "518", + "column": "11", + "nosec": false, + "suppressions": null + }, + { + "severity": "MEDIUM", + "confidence": "HIGH", + "cwe": { + "id": "89", + "url": "https://cwe.mitre.org/data/definitions/89.html" + }, + "rule_id": "G202", + "details": "SQL string concatenation", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom.eu/hub/internal/store/r879_box_seal.go", + "code": "225: \tfor _, t := range all {\n226: \t\tres, err := tx.Exec(`UPDATE `+t.table+` SET `+t.col+` = ? WHERE `+t.idCol+` = ? AND `+t.col+` = ?`, t.plain, t.id, t.sealed)\n227: \t\tif err != nil {\n", + "line": "226", + "column": "23", + "nosec": false, + "suppressions": null + }, + { + "severity": "MEDIUM", + "confidence": "HIGH", + "cwe": { + "id": "89", + "url": "https://cwe.mitre.org/data/definitions/89.html" + }, + "rule_id": "G202", + "details": "SQL string concatenation", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom.eu/hub/internal/store/r879_box_seal.go", + "code": "197: \tfor _, c := range r879Columns {\n198: \t\trows, err := s.db.Query(`SELECT ` + c.idCol + `, ` + c.col + ` FROM ` + c.table + ` WHERE ` + c.col + ` LIKE 'enc:v1:%'`)\n199: \t\tif err != nil {\n", + "line": "198", + "column": "27", + "nosec": false, + "suppressions": null + }, + { + "severity": "MEDIUM", + "confidence": "HIGH", + "cwe": { + "id": "89", + "url": "https://cwe.mitre.org/data/definitions/89.html" + }, + "rule_id": "G202", + "details": "SQL string concatenation", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom.eu/hub/internal/store/r879_box_seal.go", + "code": "143: \t\t\t} else {\n144: \t\t\t\t_, err = s.db.Exec(`UPDATE `+c.table+` SET `+c.col+` = ? WHERE `+c.idCol+` = ? AND `+c.col+` = ?`,\n145: \t\t\t\t\tsealed, r.id, r.v)\n", + "line": "144", + "column": "24", + "nosec": false, + "suppressions": null + }, + { + "severity": "MEDIUM", + "confidence": "HIGH", + "cwe": { + "id": "89", + "url": "https://cwe.mitre.org/data/definitions/89.html" + }, + "rule_id": "G202", + "details": "SQL string concatenation", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom.eu/hub/internal/store/r879_box_seal.go", + "code": "140: \t\t\tif c.withHash {\n141: \t\t\t\t_, err = s.db.Exec(`UPDATE `+c.table+` SET `+c.col+` = ?, api_key_hash = ? WHERE `+c.idCol+` = ? AND `+c.col+` = ?`,\n142: \t\t\t\t\tsealed, apiKeyHash(r.v), r.id, r.v)\n", + "line": "141", + "column": "24", + "nosec": false, + "suppressions": null + }, + { + "severity": "MEDIUM", + "confidence": "HIGH", + "cwe": { + "id": "89", + "url": "https://cwe.mitre.org/data/definitions/89.html" + }, + "rule_id": "G202", + "details": "SQL string concatenation", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom.eu/hub/internal/store/r879_box_seal.go", + "code": "118: \tfor _, c := range r879Columns {\n119: \t\trows, err := s.db.Query(`SELECT ` + c.idCol + `, ` + c.col + ` FROM ` + c.table +\n120: \t\t\t` WHERE ` + c.col + ` \u003c\u003e '' AND ` + c.col + ` NOT LIKE 'enc:v1:%'`)\n121: \t\tif err != nil {\n", + "line": "119-120", + "column": "27", + "nosec": false, + "suppressions": null + }, + { + "severity": "MEDIUM", + "confidence": "HIGH", + "cwe": { + "id": "89", + "url": "https://cwe.mitre.org/data/definitions/89.html" + }, + "rule_id": "G202", + "details": "SQL string concatenation", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom.eu/hub/internal/store/r879_box_seal.go", + "code": "96: \t\tfor _, r := range todo {\n97: \t\t\tif _, err := s.db.Exec(`UPDATE `+t.table+` SET api_key_hash = ? WHERE `+t.idCol+` = ? AND api_key = ?`,\n98: \t\t\t\tapiKeyHash(r.k), r.id, r.k); err != nil {\n", + "line": "97", + "column": "27", + "nosec": false, + "suppressions": null + }, + { + "severity": "MEDIUM", + "confidence": "HIGH", + "cwe": { + "id": "89", + "url": "https://cwe.mitre.org/data/definitions/89.html" + }, + "rule_id": "G202", + "details": "SQL string concatenation", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom.eu/hub/internal/store/r879_box_seal.go", + "code": "79: \tfor _, t := range []struct{ table, idCol string }{{\"hosts\", \"host_id\"}, {\"customer_configs\", \"customer_id\"}} {\n80: \t\trows, err := s.db.Query(`SELECT ` + t.idCol + `, api_key FROM ` + t.table +\n81: \t\t\t` WHERE api_key_hash = '' AND api_key \u003c\u003e '' AND api_key NOT LIKE 'enc:v1:%'`)\n82: \t\tif err != nil {\n", + "line": "80-81", + "column": "27", + "nosec": false, + "suppressions": null + }, + { + "severity": "MEDIUM", + "confidence": "HIGH", + "cwe": { + "id": "89", + "url": "https://cwe.mitre.org/data/definitions/89.html" + }, + "rule_id": "G202", + "details": "SQL string concatenation", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom.eu/hub/internal/store/os_updates.go", + "code": "465: \t}\n466: \tq := `SELECT ` + osReportCols + ` FROM os_reports WHERE layer = ? AND host_id IN (?` + strings.Repeat(\",?\", len(hosts)-1) + `) ORDER BY id LIMIT 1`\n467: \targs := []any{layer}\n", + "line": "466", + "column": "7", + "nosec": false, + "suppressions": null + }, + { + "severity": "MEDIUM", + "confidence": "HIGH", + "cwe": { + "id": "89", + "url": "https://cwe.mitre.org/data/definitions/89.html" + }, + "rule_id": "G202", + "details": "SQL string concatenation", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom.eu/hub/internal/store/os_updates.go", + "code": "434: func (s *Store) LatestHealthyOSReport(hostID, layer string, outcomes ...string) (*OSReport, error) {\n435: \tq := `SELECT ` + osReportCols + ` FROM os_reports WHERE host_id = ? AND layer = ? AND healthy = 1 AND outcome IN (?` +\n436: \t\tstrings.Repeat(\",?\", len(outcomes)-1) + `) ORDER BY id DESC LIMIT 1`\n437: \targs := []any{hostID, layer}\n", + "line": "435-436", + "column": "7", + "nosec": false, + "suppressions": null + }, + { + "severity": "MEDIUM", + "confidence": "HIGH", + "cwe": { + "id": "89", + "url": "https://cwe.mitre.org/data/definitions/89.html" + }, + "rule_id": "G202", + "details": "SQL string concatenation", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom.eu/hub/internal/store/customer_delete.go", + "code": "90: \tfor _, q := range residueQueries {\n91: \t\tif _, err := tx.Exec(`DELETE FROM `+q.table+` WHERE customer_id = ?`, customerID); err != nil {\n92: \t\t\treturn fmt.Errorf(\"PurgeCustomerResidue %s: purge %s: %w\", customerID, q.table, err)\n", + "line": "91", + "column": "24", + "nosec": false, + "suppressions": null + }, + { + "severity": "MEDIUM", + "confidence": "HIGH", + "cwe": { + "id": "22", + "url": "https://cwe.mitre.org/data/definitions/22.html" + }, + "rule_id": "G304", + "details": "Potential file inclusion via variable", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom.eu/hub/internal/assets/assets.go", + "code": "266: \ttmp := dst + \".tmp\"\n267: \tout, err := os.Create(tmp)\n268: \tif err != nil {\n", + "line": "267", + "column": "14", + "nosec": false, + "suppressions": null + }, + { + "severity": "MEDIUM", + "confidence": "HIGH", + "cwe": { + "id": "22", + "url": "https://cwe.mitre.org/data/definitions/22.html" + }, + "rule_id": "G304", + "details": "Potential file inclusion via variable", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom.eu/hub/internal/assets/assets.go", + "code": "259: func copyFile(src, dst string) error {\n260: \tin, err := os.Open(src)\n261: \tif err != nil {\n", + "line": "260", + "column": "13", + "nosec": false, + "suppressions": null + }, + { + "severity": "MEDIUM", + "confidence": "HIGH", + "cwe": { + "id": "22", + "url": "https://cwe.mitre.org/data/definitions/22.html" + }, + "rule_id": "G304", + "details": "Potential file inclusion via variable", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom.eu/hub/internal/assets/assets.go", + "code": "244: func fileSHA256(path string) (string, error) {\n245: \tf, err := os.Open(path)\n246: \tif err != nil {\n", + "line": "245", + "column": "12", + "nosec": false, + "suppressions": null + }, + { + "severity": "MEDIUM", + "confidence": "HIGH", + "cwe": { + "id": "22", + "url": "https://cwe.mitre.org/data/definitions/22.html" + }, + "rule_id": "G304", + "details": "Potential file inclusion via variable", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom.eu/hub/cmd/hubdb-check/main.go", + "code": "24: \tvar r result\n25: \traw, err := os.ReadFile(keyFile)\n26: \tif err != nil {\n", + "line": "25", + "column": "14", + "nosec": false, + "suppressions": null + }, + { + "severity": "MEDIUM", + "confidence": "HIGH", + "cwe": { + "id": "22", + "url": "https://cwe.mitre.org/data/definitions/22.html" + }, + "rule_id": "G304", + "details": "Potential file inclusion via variable", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom.eu/hub/cmd/hub/main.go", + "code": "948: \n949: \tdata, err := os.ReadFile(path)\n950: \tif err != nil {\n", + "line": "949", + "column": "15", + "nosec": false, + "suppressions": null + }, + { + "severity": "MEDIUM", + "confidence": "HIGH", + "cwe": { + "id": "22", + "url": "https://cwe.mitre.org/data/definitions/22.html" + }, + "rule_id": "G304", + "details": "Potential file inclusion via variable", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom.eu/hub/cmd/hub/main.go", + "code": "747: \t\tif wgAddr != \"\" \u0026\u0026 wgHostKey != \"\" \u0026\u0026 pokeKeyFile != \"\" {\n748: \t\t\tkeyPEM, err := os.ReadFile(pokeKeyFile)\n749: \t\t\tif os.IsNotExist(err) {\n", + "line": "748", + "column": "19", + "nosec": false, + "suppressions": null + }, + { + "severity": "MEDIUM", + "confidence": "HIGH", + "cwe": { + "id": "22", + "url": "https://cwe.mitre.org/data/definitions/22.html" + }, + "rule_id": "G304", + "details": "Potential file inclusion via variable", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom.eu/hub/cmd/hub/main.go", + "code": "712: \t\tif wgAddr != \"\" \u0026\u0026 wgHostKey != \"\" \u0026\u0026 tsKeyFile != \"\" {\n713: \t\t\tkeyPEM, err := os.ReadFile(tsKeyFile)\n714: \t\t\tif os.IsNotExist(err) {\n", + "line": "713", + "column": "19", + "nosec": false, + "suppressions": null + }, + { + "severity": "MEDIUM", + "confidence": "HIGH", + "cwe": { + "id": "22", + "url": "https://cwe.mitre.org/data/definitions/22.html" + }, + "rule_id": "G304", + "details": "Potential file inclusion via variable", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom.eu/hub/cmd/hub/main.go", + "code": "690: \t\tif wgAddr != \"\" \u0026\u0026 wgKeyFile != \"\" \u0026\u0026 wgHostKey != \"\" {\n691: \t\t\tkeyPEM, err := os.ReadFile(wgKeyFile)\n692: \t\t\tif err != nil {\n", + "line": "691", + "column": "19", + "nosec": false, + "suppressions": null + }, + { + "severity": "MEDIUM", + "confidence": "HIGH", + "cwe": { + "id": "276", + "url": "https://cwe.mitre.org/data/definitions/276.html" + }, + "rule_id": "G301", + "details": "Expect directory permissions to be 0750 or less", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom.eu/hub/internal/assets/assets.go", + "code": "50: \n51: \tif err := os.MkdirAll(assetsDir, 0755); err != nil {\n52: \t\tlogger.Printf(\"[ERROR] Failed to create assets dir %s: %v\", assetsDir, err)\n", + "line": "51", + "column": "12", + "nosec": false, + "suppressions": null + }, + { + "severity": "MEDIUM", + "confidence": "HIGH", + "cwe": { + "id": "276", + "url": "https://cwe.mitre.org/data/definitions/276.html" + }, + "rule_id": "G301", + "details": "Expect directory permissions to be 0750 or less", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom.eu/hub/cmd/hub/main.go", + "code": "180: \t// Ensure data dir exists\n181: \tos.MkdirAll(cfg.Server.DataDir, 0755)\n182: \n", + "line": "181", + "column": "2", + "nosec": false, + "suppressions": null + }, + { + "severity": "LOW", + "confidence": "HIGH", + "cwe": { + "id": "703", + "url": "https://cwe.mitre.org/data/definitions/703.html" + }, + "rule_id": "G104", + "details": "Errors unhandled", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom.eu/hub/internal/wgsync/client.go", + "code": "109: \tif dl, ok := ctx.Deadline(); ok {\n110: \t\tconn.SetDeadline(dl)\n111: \t}\n", + "line": "110", + "column": "3", + "nosec": false, + "suppressions": null + }, + { + "severity": "LOW", + "confidence": "HIGH", + "cwe": { + "id": "703", + "url": "https://cwe.mitre.org/data/definitions/703.html" + }, + "rule_id": "G104", + "details": "Errors unhandled", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom.eu/hub/internal/wgsync/client.go", + "code": "107: \tdefer client.Close()\n108: \tconn.SetDeadline(time.Time{}) // handshake done; session I/O below is bounded by the same conn\n109: \tif dl, ok := ctx.Deadline(); ok {\n", + "line": "108", + "column": "2", + "nosec": false, + "suppressions": null + }, + { + "severity": "LOW", + "confidence": "HIGH", + "cwe": { + "id": "703", + "url": "https://cwe.mitre.org/data/definitions/703.html" + }, + "rule_id": "G104", + "details": "Errors unhandled", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom.eu/hub/internal/wgsync/client.go", + "code": "102: \tif err != nil {\n103: \t\tconn.Close()\n104: \t\treturn fmt.Errorf(\"wgsync: ssh handshake %s: %w\", c.addr, err)\n", + "line": "103", + "column": "3", + "nosec": false, + "suppressions": null + }, + { + "severity": "LOW", + "confidence": "HIGH", + "cwe": { + "id": "703", + "url": "https://cwe.mitre.org/data/definitions/703.html" + }, + "rule_id": "G104", + "details": "Errors unhandled", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom.eu/hub/internal/wgsync/client.go", + "code": "98: \t} else {\n99: \t\tconn.SetDeadline(time.Now().Add(c.timeout))\n100: \t}\n", + "line": "99", + "column": "3", + "nosec": false, + "suppressions": null + }, + { + "severity": "LOW", + "confidence": "HIGH", + "cwe": { + "id": "703", + "url": "https://cwe.mitre.org/data/definitions/703.html" + }, + "rule_id": "G104", + "details": "Errors unhandled", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom.eu/hub/internal/wgsync/client.go", + "code": "96: \tif dl, ok := ctx.Deadline(); ok {\n97: \t\tconn.SetDeadline(dl)\n98: \t} else {\n", + "line": "97", + "column": "3", + "nosec": false, + "suppressions": null + }, + { + "severity": "LOW", + "confidence": "HIGH", + "cwe": { + "id": "703", + "url": "https://cwe.mitre.org/data/definitions/703.html" + }, + "rule_id": "G104", + "details": "Errors unhandled", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom.eu/hub/internal/web/server.go", + "code": "1115: \tw.Header().Set(\"Cache-Control\", \"public, max-age=3600\")\n1116: \tw.Write(data)\n1117: }\n", + "line": "1116", + "column": "2", + "nosec": false, + "suppressions": null + }, + { + "severity": "LOW", + "confidence": "HIGH", + "cwe": { + "id": "703", + "url": "https://cwe.mitre.org/data/definitions/703.html" + }, + "rule_id": "G104", + "details": "Errors unhandled", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom.eu/hub/internal/web/server.go", + "code": "956: \tw.WriteHeader(http.StatusOK)\n957: \tw.Write([]byte(`\u003chtml\u003e\u003chead\u003e\u003ctitle\u003eFelhom Hub — Bejelentkezés\u003c/title\u003e\u003c/head\u003e\u003cbody style=\"font-family:sans-serif;display:flex;justify-content:center;padding-top:4rem\"\u003e\u003cform method=\"post\" style=\"display:flex;flex-direction:column;gap:.75rem;width:300px\"\u003e\u003ch2\u003eFelhom Hub\u003c/h2\u003e\u003cinput type=\"password\" name=\"password\" placeholder=\"Jelszó\" autofocus style=\"padding:.5rem;border:1px solid #ccc;border-radius:4px\"\u003e\u003cbutton type=\"submit\" style=\"padding:.5rem;background:#0083D8;color:#fff;border:none;border-radius:4px;cursor:pointer\"\u003eBejelentkezés\u003c/button\u003e\u003c/form\u003e\u003c/body\u003e\u003c/html\u003e`))\n958: }\n", + "line": "957", + "column": "2", + "nosec": false, + "suppressions": null + }, + { + "severity": "LOW", + "confidence": "HIGH", + "cwe": { + "id": "703", + "url": "https://cwe.mitre.org/data/definitions/703.html" + }, + "rule_id": "G104", + "details": "Errors unhandled", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom.eu/hub/internal/web/server.go", + "code": "952: \t\tw.WriteHeader(http.StatusUnauthorized)\n953: \t\tw.Write([]byte(`\u003chtml\u003e\u003chead\u003e\u003ctitle\u003eFelhom Hub — Bejelentkezés\u003c/title\u003e\u003c/head\u003e\u003cbody style=\"font-family:sans-serif;display:flex;justify-content:center;padding-top:4rem\"\u003e\u003cform method=\"post\" style=\"display:flex;flex-direction:column;gap:.75rem;width:300px\"\u003e\u003ch2\u003eFelhom Hub\u003c/h2\u003e\u003cp style=\"color:red\"\u003eHibás jelszó\u003c/p\u003e\u003cinput type=\"password\" name=\"password\" placeholder=\"Jelszó\" autofocus style=\"padding:.5rem;border:1px solid #ccc;border-radius:4px\"\u003e\u003cbutton type=\"submit\" style=\"padding:.5rem;background:#0083D8;color:#fff;border:none;border-radius:4px;cursor:pointer\"\u003eBejelentkezés\u003c/button\u003e\u003c/form\u003e\u003c/body\u003e\u003c/html\u003e`))\n954: \t\treturn\n", + "line": "953", + "column": "3", + "nosec": false, + "suppressions": null + }, + { + "severity": "LOW", + "confidence": "HIGH", + "cwe": { + "id": "703", + "url": "https://cwe.mitre.org/data/definitions/703.html" + }, + "rule_id": "G104", + "details": "Errors unhandled", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom.eu/hub/internal/web/server.go", + "code": "482: \t\tw.Header().Set(\"Cache-Control\", \"public, max-age=31536000, immutable\")\n483: \t\tw.Write(data)\n484: \tcase path == \"/configuration\":\n", + "line": "483", + "column": "3", + "nosec": false, + "suppressions": null + }, + { + "severity": "LOW", + "confidence": "HIGH", + "cwe": { + "id": "703", + "url": "https://cwe.mitre.org/data/definitions/703.html" + }, + "rule_id": "G104", + "details": "Errors unhandled", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom.eu/hub/internal/web/server.go", + "code": "471: \t\tw.Header().Set(\"Cache-Control\", \"public, max-age=86400\")\n472: \t\tw.Write(chartJS)\n473: \tcase strings.HasPrefix(path, \"/static/fonts/\"):\n", + "line": "472", + "column": "3", + "nosec": false, + "suppressions": null + }, + { + "severity": "LOW", + "confidence": "HIGH", + "cwe": { + "id": "703", + "url": "https://cwe.mitre.org/data/definitions/703.html" + }, + "rule_id": "G104", + "details": "Errors unhandled", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom.eu/hub/internal/web/logtail.go", + "code": "63: \t\t\tw.Write([]byte(line))\n64: \t\t\tw.Write([]byte(\"\\n\"))\n65: \t\t}\n", + "line": "64", + "column": "4", + "nosec": false, + "suppressions": null + }, + { + "severity": "LOW", + "confidence": "HIGH", + "cwe": { + "id": "703", + "url": "https://cwe.mitre.org/data/definitions/703.html" + }, + "rule_id": "G104", + "details": "Errors unhandled", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom.eu/hub/internal/web/logtail.go", + "code": "62: \t\tfor _, line := range tail.Lines {\n63: \t\t\tw.Write([]byte(line))\n64: \t\t\tw.Write([]byte(\"\\n\"))\n", + "line": "63", + "column": "4", + "nosec": false, + "suppressions": null + }, + { + "severity": "LOW", + "confidence": "HIGH", + "cwe": { + "id": "703", + "url": "https://cwe.mitre.org/data/definitions/703.html" + }, + "rule_id": "G104", + "details": "Errors unhandled", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom.eu/hub/internal/web/logbundle.go", + "code": "112: \t\tw.Write([]byte(line))\n113: \t\tw.Write([]byte(\"\\n\"))\n114: \t}\n", + "line": "113", + "column": "3", + "nosec": false, + "suppressions": null + }, + { + "severity": "LOW", + "confidence": "HIGH", + "cwe": { + "id": "703", + "url": "https://cwe.mitre.org/data/definitions/703.html" + }, + "rule_id": "G104", + "details": "Errors unhandled", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom.eu/hub/internal/web/logbundle.go", + "code": "111: \tfor _, line := range lines {\n112: \t\tw.Write([]byte(line))\n113: \t\tw.Write([]byte(\"\\n\"))\n", + "line": "112", + "column": "3", + "nosec": false, + "suppressions": null + }, + { + "severity": "LOW", + "confidence": "HIGH", + "cwe": { + "id": "703", + "url": "https://cwe.mitre.org/data/definitions/703.html" + }, + "rule_id": "G104", + "details": "Errors unhandled", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom.eu/hub/internal/web/dr_recipe.go", + "code": "41: \tw.Header().Set(\"Content-Disposition\", \"attachment; filename=\\\"dr-recipe-\"+safeFilename(customerID)+\".json\\\"\")\n42: \tw.Write(out)\n43: \ts.logger.Printf(\"[INFO] DR-recipe downloaded for customer %s (v%d)\", customerID, assembled.RecipeVersion)\n", + "line": "42", + "column": "2", + "nosec": false, + "suppressions": null + }, + { + "severity": "LOW", + "confidence": "HIGH", + "cwe": { + "id": "703", + "url": "https://cwe.mitre.org/data/definitions/703.html" + }, + "rule_id": "G104", + "details": "Errors unhandled", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom.eu/hub/internal/web/configs.go", + "code": "1813: \tw.Header().Set(\"Content-Type\", \"application/json\")\n1814: \tjson.NewEncoder(w).Encode(map[string]interface{}{\"ok\": true, \"message\": \"Geo-restriction removed from Cloudflare.\"})\n1815: }\n", + "line": "1814", + "column": "2", + "nosec": false, + "suppressions": null + }, + { + "severity": "LOW", + "confidence": "HIGH", + "cwe": { + "id": "703", + "url": "https://cwe.mitre.org/data/definitions/703.html" + }, + "rule_id": "G104", + "details": "Errors unhandled", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom.eu/hub/internal/web/configs.go", + "code": "1806: \t\tw.WriteHeader(http.StatusBadGateway)\n1807: \t\tjson.NewEncoder(w).Encode(map[string]interface{}{\"ok\": false, \"error\": fmt.Sprintf(\"Cloudflare API error: %v\", err)})\n1808: \t\treturn\n", + "line": "1807", + "column": "3", + "nosec": false, + "suppressions": null + }, + { + "severity": "LOW", + "confidence": "HIGH", + "cwe": { + "id": "703", + "url": "https://cwe.mitre.org/data/definitions/703.html" + }, + "rule_id": "G104", + "details": "Errors unhandled", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom.eu/hub/internal/web/configs.go", + "code": "1797: \t\tw.WriteHeader(http.StatusBadRequest)\n1798: \t\tjson.NewEncoder(w).Encode(map[string]interface{}{\"ok\": false, \"error\": \"No domain configured for this customer\"})\n1799: \t\treturn\n", + "line": "1798", + "column": "3", + "nosec": false, + "suppressions": null + }, + { + "severity": "LOW", + "confidence": "HIGH", + "cwe": { + "id": "703", + "url": "https://cwe.mitre.org/data/definitions/703.html" + }, + "rule_id": "G104", + "details": "Errors unhandled", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom.eu/hub/internal/web/configs.go", + "code": "1791: \t\tw.WriteHeader(http.StatusBadRequest)\n1792: \t\tjson.NewEncoder(w).Encode(map[string]interface{}{\"ok\": false, \"error\": \"No Cloudflare API token configured for this customer\"})\n1793: \t\treturn\n", + "line": "1792", + "column": "3", + "nosec": false, + "suppressions": null + }, + { + "severity": "LOW", + "confidence": "HIGH", + "cwe": { + "id": "703", + "url": "https://cwe.mitre.org/data/definitions/703.html" + }, + "rule_id": "G104", + "details": "Errors unhandled", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom.eu/hub/internal/web/configs.go", + "code": "1775: \t\tw.WriteHeader(http.StatusNotFound)\n1776: \t\tjson.NewEncoder(w).Encode(map[string]interface{}{\"ok\": false, \"error\": \"Customer not found\"})\n1777: \t\treturn\n", + "line": "1776", + "column": "3", + "nosec": false, + "suppressions": null + }, + { + "severity": "LOW", + "confidence": "HIGH", + "cwe": { + "id": "703", + "url": "https://cwe.mitre.org/data/definitions/703.html" + }, + "rule_id": "G104", + "details": "Errors unhandled", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom.eu/hub/internal/web/configs.go", + "code": "1668: func (s *Server) renderConfigForm(w http.ResponseWriter, r *http.Request, isNew bool, cfg *store.CustomerConfig, overrides map[string]interface{}, errMsg string) {\n1669: \ts.templates.ExecuteTemplate(w, \"config_form.html\", s.configFormData(r, isNew, cfg, overrides, errMsg))\n1670: }\n", + "line": "1669", + "column": "2", + "nosec": false, + "suppressions": null + }, + { + "severity": "LOW", + "confidence": "HIGH", + "cwe": { + "id": "703", + "url": "https://cwe.mitre.org/data/definitions/703.html" + }, + "rule_id": "G104", + "details": "Errors unhandled", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom.eu/hub/internal/web/configs.go", + "code": "1125: \tw.Header().Set(\"Content-Type\", \"text/yaml; charset=utf-8\")\n1126: \tw.Write([]byte(yamlOutput))\n1127: }\n", + "line": "1126", + "column": "2", + "nosec": false, + "suppressions": null + }, + { + "severity": "LOW", + "confidence": "HIGH", + "cwe": { + "id": "703", + "url": "https://cwe.mitre.org/data/definitions/703.html" + }, + "rule_id": "G104", + "details": "Errors unhandled", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom.eu/hub/internal/web/configs.go", + "code": "653: \tif overrides == nil {\n654: \t\tjson.Unmarshal([]byte(cfg.ConfigJSON), \u0026overrides)\n655: \t}\n", + "line": "654", + "column": "3", + "nosec": false, + "suppressions": null + }, + { + "severity": "LOW", + "confidence": "HIGH", + "cwe": { + "id": "703", + "url": "https://cwe.mitre.org/data/definitions/703.html" + }, + "rule_id": "G104", + "details": "Errors unhandled", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom.eu/hub/internal/web/configs.go", + "code": "234: \t\t\t}\n235: \t\t\tjson.Unmarshal([]byte(customer.ReportJSON), \u0026rpt)\n236: \t\t\tcontrollerURL = rpt.ControllerURL\n", + "line": "235", + "column": "4", + "nosec": false, + "suppressions": null + }, + { + "severity": "LOW", + "confidence": "HIGH", + "cwe": { + "id": "703", + "url": "https://cwe.mitre.org/data/definitions/703.html" + }, + "rule_id": "G104", + "details": "Errors unhandled", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom.eu/hub/internal/web/configs.go", + "code": "210: \tif cfg != nil {\n211: \t\tjson.Unmarshal([]byte(cfg.ConfigJSON), \u0026overrides)\n212: \t}\n", + "line": "211", + "column": "3", + "nosec": false, + "suppressions": null + }, + { + "severity": "LOW", + "confidence": "HIGH", + "cwe": { + "id": "703", + "url": "https://cwe.mitre.org/data/definitions/703.html" + }, + "rule_id": "G104", + "details": "Errors unhandled", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom.eu/hub/internal/web/configs.go", + "code": "204: \tif customer != nil {\n205: \t\tjson.Unmarshal([]byte(customer.ReportJSON), \u0026report)\n206: \t}\n", + "line": "205", + "column": "3", + "nosec": false, + "suppressions": null + }, + { + "severity": "LOW", + "confidence": "HIGH", + "cwe": { + "id": "703", + "url": "https://cwe.mitre.org/data/definitions/703.html" + }, + "rule_id": "G104", + "details": "Errors unhandled", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom.eu/hub/internal/web/configs.go", + "code": "174: \t}\n175: \ts.templates.ExecuteTemplate(w, \"configs.html\", data)\n176: }\n", + "line": "175", + "column": "2", + "nosec": false, + "suppressions": null + }, + { + "severity": "LOW", + "confidence": "HIGH", + "cwe": { + "id": "703", + "url": "https://cwe.mitre.org/data/definitions/703.html" + }, + "rule_id": "G104", + "details": "Errors unhandled", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom.eu/hub/internal/web/apps.go", + "code": "167: \tcase \"selected\":\n168: \t\tr.ParseForm()\n169: \t\tidStrs := r.Form[\"issue_ids\"]\n", + "line": "168", + "column": "3", + "nosec": false, + "suppressions": null + }, + { + "severity": "LOW", + "confidence": "HIGH", + "cwe": { + "id": "703", + "url": "https://cwe.mitre.org/data/definitions/703.html" + }, + "rule_id": "G104", + "details": "Errors unhandled", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom.eu/hub/internal/tenantsync/client.go", + "code": "266: \tif dl, ok := ctx.Deadline(); ok {\n267: \t\tconn.SetDeadline(dl)\n268: \t}\n", + "line": "267", + "column": "3", + "nosec": false, + "suppressions": null + }, + { + "severity": "LOW", + "confidence": "HIGH", + "cwe": { + "id": "703", + "url": "https://cwe.mitre.org/data/definitions/703.html" + }, + "rule_id": "G104", + "details": "Errors unhandled", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom.eu/hub/internal/tenantsync/client.go", + "code": "264: \tdefer client.Close()\n265: \tconn.SetDeadline(time.Time{})\n266: \tif dl, ok := ctx.Deadline(); ok {\n", + "line": "265", + "column": "2", + "nosec": false, + "suppressions": null + }, + { + "severity": "LOW", + "confidence": "HIGH", + "cwe": { + "id": "703", + "url": "https://cwe.mitre.org/data/definitions/703.html" + }, + "rule_id": "G104", + "details": "Errors unhandled", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom.eu/hub/internal/tenantsync/client.go", + "code": "259: \tif err != nil {\n260: \t\tconn.Close()\n261: \t\treturn nil, nil, fmt.Errorf(\"tenantsync: ssh handshake %s: %w\", c.addr, err)\n", + "line": "260", + "column": "3", + "nosec": false, + "suppressions": null + }, + { + "severity": "LOW", + "confidence": "HIGH", + "cwe": { + "id": "703", + "url": "https://cwe.mitre.org/data/definitions/703.html" + }, + "rule_id": "G104", + "details": "Errors unhandled", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom.eu/hub/internal/tenantsync/client.go", + "code": "255: \t} else {\n256: \t\tconn.SetDeadline(time.Now().Add(c.timeout))\n257: \t}\n", + "line": "256", + "column": "3", + "nosec": false, + "suppressions": null + }, + { + "severity": "LOW", + "confidence": "HIGH", + "cwe": { + "id": "703", + "url": "https://cwe.mitre.org/data/definitions/703.html" + }, + "rule_id": "G104", + "details": "Errors unhandled", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom.eu/hub/internal/tenantsync/client.go", + "code": "253: \tif dl, ok := ctx.Deadline(); ok {\n254: \t\tconn.SetDeadline(dl)\n255: \t} else {\n", + "line": "254", + "column": "3", + "nosec": false, + "suppressions": null + }, + { + "severity": "LOW", + "confidence": "HIGH", + "cwe": { + "id": "703", + "url": "https://cwe.mitre.org/data/definitions/703.html" + }, + "rule_id": "G104", + "details": "Errors unhandled", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom.eu/hub/internal/store/wg.go", + "code": "184: \t}\n185: \trows.Close()\n186: \tif err := rows.Err(); err != nil {\n", + "line": "185", + "column": "2", + "nosec": false, + "suppressions": null + }, + { + "severity": "LOW", + "confidence": "HIGH", + "cwe": { + "id": "703", + "url": "https://cwe.mitre.org/data/definitions/703.html" + }, + "rule_id": "G104", + "details": "Errors unhandled", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom.eu/hub/internal/store/wg.go", + "code": "179: \t\tif err := rows.Scan(\u0026ip); err != nil {\n180: \t\t\trows.Close()\n181: \t\t\treturn \"\", err\n", + "line": "180", + "column": "4", + "nosec": false, + "suppressions": null + }, + { + "severity": "LOW", + "confidence": "HIGH", + "cwe": { + "id": "703", + "url": "https://cwe.mitre.org/data/definitions/703.html" + }, + "rule_id": "G104", + "details": "Errors unhandled", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom.eu/hub/internal/store/telemetry.go", + "code": "559: \t}\n560: \ts.db.Exec(\"UPDATE app_telemetry SET log_errors = 0, log_warnings = 0 WHERE app_name = ?\", appName)\n561: \treturn res.RowsAffected()\n", + "line": "560", + "column": "2", + "nosec": false, + "suppressions": null + }, + { + "severity": "LOW", + "confidence": "HIGH", + "cwe": { + "id": "703", + "url": "https://cwe.mitre.org/data/definitions/703.html" + }, + "rule_id": "G104", + "details": "Errors unhandled", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom.eu/hub/internal/store/telemetry.go", + "code": "479: \t\tif contextJSON.Valid \u0026\u0026 contextJSON.String != \"\" {\n480: \t\t\tjson.Unmarshal([]byte(contextJSON.String), \u0026ai.Context)\n481: \t\t}\n", + "line": "480", + "column": "4", + "nosec": false, + "suppressions": null + }, + { + "severity": "LOW", + "confidence": "HIGH", + "cwe": { + "id": "703", + "url": "https://cwe.mitre.org/data/definitions/703.html" + }, + "rule_id": "G104", + "details": "Errors unhandled", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom.eu/hub/internal/store/telemetry.go", + "code": "477: \t\t}\n478: \t\tjson.Unmarshal([]byte(affectedJSON), \u0026ai.AffectedCustomers)\n479: \t\tif contextJSON.Valid \u0026\u0026 contextJSON.String != \"\" {\n", + "line": "478", + "column": "3", + "nosec": false, + "suppressions": null + }, + { + "severity": "LOW", + "confidence": "HIGH", + "cwe": { + "id": "703", + "url": "https://cwe.mitre.org/data/definitions/703.html" + }, + "rule_id": "G104", + "details": "Errors unhandled", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom.eu/hub/internal/store/telemetry.go", + "code": "208: \t\tnewJSON, _ := json.Marshal(customers)\n209: \t\ttx.Exec(`UPDATE app_log_issues SET affected_customers = ? WHERE app_name = ? AND fingerprint = ?`,\n210: \t\t\tstring(newJSON), appName, fingerprint)\n211: \t}\n", + "line": "209-210", + "column": "3", + "nosec": false, + "suppressions": null + }, + { + "severity": "LOW", + "confidence": "HIGH", + "cwe": { + "id": "703", + "url": "https://cwe.mitre.org/data/definitions/703.html" + }, + "rule_id": "G104", + "details": "Errors unhandled", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom.eu/hub/internal/store/telemetry.go", + "code": "197: \tvar customers []string\n198: \tjson.Unmarshal([]byte(affectedJSON), \u0026customers)\n199: \tfound := false\n", + "line": "198", + "column": "2", + "nosec": false, + "suppressions": null + }, + { + "severity": "LOW", + "confidence": "HIGH", + "cwe": { + "id": "703", + "url": "https://cwe.mitre.org/data/definitions/703.html" + }, + "rule_id": "G104", + "details": "Errors unhandled", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom.eu/hub/internal/store/store.go", + "code": "3287: \t\tif err != nil {\n3288: \t\t\ttx.Rollback()\n3289: \t\t}\n", + "line": "3288", + "column": "4", + "nosec": false, + "suppressions": null + }, + { + "severity": "LOW", + "confidence": "HIGH", + "cwe": { + "id": "703", + "url": "https://cwe.mitre.org/data/definitions/703.html" + }, + "rule_id": "G104", + "details": "Errors unhandled", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom.eu/hub/internal/store/store.go", + "code": "2776: \t// ignore parse errors — show \"–\" on failure\n2777: \tjson.Unmarshal([]byte(reportJSON), \u0026report) //nolint:errcheck\n2778: \n", + "line": "2777", + "column": "2", + "nosec": false, + "suppressions": null + }, + { + "severity": "LOW", + "confidence": "HIGH", + "cwe": { + "id": "703", + "url": "https://cwe.mitre.org/data/definitions/703.html" + }, + "rule_id": "G104", + "details": "Errors unhandled", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom.eu/hub/internal/store/store.go", + "code": "1470: \t}\n1471: \tjson.Unmarshal([]byte(c.ReportJSON), \u0026report)\n1472: \tc.CustomerName = report.CustomerName\n", + "line": "1471", + "column": "2", + "nosec": false, + "suppressions": null + }, + { + "severity": "LOW", + "confidence": "HIGH", + "cwe": { + "id": "703", + "url": "https://cwe.mitre.org/data/definitions/703.html" + }, + "rule_id": "G104", + "details": "Errors unhandled", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom.eu/hub/internal/store/store.go", + "code": "915: \t}\n916: \trows.Close()\n917: \tchanged := []string{}\n", + "line": "916", + "column": "2", + "nosec": false, + "suppressions": null + }, + { + "severity": "LOW", + "confidence": "HIGH", + "cwe": { + "id": "703", + "url": "https://cwe.mitre.org/data/definitions/703.html" + }, + "rule_id": "G104", + "details": "Errors unhandled", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom.eu/hub/internal/store/store.go", + "code": "910: \t\tif err := rows.Scan(\u0026r.id, \u0026r.ev); err != nil {\n911: \t\t\trows.Close()\n912: \t\t\treturn nil, err\n", + "line": "911", + "column": "4", + "nosec": false, + "suppressions": null + }, + { + "severity": "LOW", + "confidence": "HIGH", + "cwe": { + "id": "703", + "url": "https://cwe.mitre.org/data/definitions/703.html" + }, + "rule_id": "G104", + "details": "Errors unhandled", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom.eu/hub/internal/store/store.go", + "code": "869: \ts.db.Exec(`ALTER TABLE hosts ADD COLUMN api_key_hash TEXT NOT NULL DEFAULT ''`)\n870: \ts.db.Exec(`ALTER TABLE customer_configs ADD COLUMN api_key_hash TEXT NOT NULL DEFAULT ''`)\n871: \t// Neither failure stops the hub: a row with no hash is matched on its plaintext key (GetHostByAPIKey),\n", + "line": "870", + "column": "2", + "nosec": false, + "suppressions": null + }, + { + "severity": "LOW", + "confidence": "HIGH", + "cwe": { + "id": "703", + "url": "https://cwe.mitre.org/data/definitions/703.html" + }, + "rule_id": "G104", + "details": "Errors unhandled", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom.eu/hub/internal/store/store.go", + "code": "868: \t// the index is complete before any box reports, whatever happens to the sealing step in main.\n869: \ts.db.Exec(`ALTER TABLE hosts ADD COLUMN api_key_hash TEXT NOT NULL DEFAULT ''`)\n870: \ts.db.Exec(`ALTER TABLE customer_configs ADD COLUMN api_key_hash TEXT NOT NULL DEFAULT ''`)\n", + "line": "869", + "column": "2", + "nosec": false, + "suppressions": null + }, + { + "severity": "LOW", + "confidence": "HIGH", + "cwe": { + "id": "703", + "url": "https://cwe.mitre.org/data/definitions/703.html" + }, + "rule_id": "G104", + "details": "Errors unhandled", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom.eu/hub/internal/store/store.go", + "code": "861: \t// R-833 (v0.129.0): the cap each window was opened with — an operator grant may raise it once.\n862: \ts.db.Exec(\"ALTER TABLE offsite_windows ADD COLUMN max_remove INTEGER\")\n863: \t// OS updates, guest fast lane (hub v0.130.0, `11` §8 step 2).\n", + "line": "862", + "column": "2", + "nosec": false, + "suppressions": null + }, + { + "severity": "LOW", + "confidence": "HIGH", + "cwe": { + "id": "703", + "url": "https://cwe.mitre.org/data/definitions/703.html" + }, + "rule_id": "G104", + "details": "Errors unhandled", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom.eu/hub/internal/store/store.go", + "code": "799: \t// column already exists, which is fine on a fresh DB where the CREATE above already added it).\n800: \ts.db.Exec(\"ALTER TABLE appliance_registrations ADD COLUMN pairing_code TEXT NOT NULL DEFAULT ''\")\n801: \n", + "line": "800", + "column": "2", + "nosec": false, + "suppressions": null + }, + { + "severity": "LOW", + "confidence": "HIGH", + "cwe": { + "id": "703", + "url": "https://cwe.mitre.org/data/definitions/703.html" + }, + "rule_id": "G104", + "details": "Errors unhandled", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom.eu/hub/internal/store/store.go", + "code": "657: \ts.db.Exec(`ALTER TABLE app_log_issues ADD COLUMN context_customer TEXT`)\n658: \ts.db.Exec(`ALTER TABLE app_log_issues ADD COLUMN dismissed_at DATETIME`)\n659: \n", + "line": "658", + "column": "2", + "nosec": false, + "suppressions": null + }, + { + "severity": "LOW", + "confidence": "HIGH", + "cwe": { + "id": "703", + "url": "https://cwe.mitre.org/data/definitions/703.html" + }, + "rule_id": "G104", + "details": "Errors unhandled", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom.eu/hub/internal/store/store.go", + "code": "656: \ts.db.Exec(`ALTER TABLE app_log_issues ADD COLUMN context TEXT`)\n657: \ts.db.Exec(`ALTER TABLE app_log_issues ADD COLUMN context_customer TEXT`)\n658: \ts.db.Exec(`ALTER TABLE app_log_issues ADD COLUMN dismissed_at DATETIME`)\n", + "line": "657", + "column": "2", + "nosec": false, + "suppressions": null + }, + { + "severity": "LOW", + "confidence": "HIGH", + "cwe": { + "id": "703", + "url": "https://cwe.mitre.org/data/definitions/703.html" + }, + "rule_id": "G104", + "details": "Errors unhandled", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom.eu/hub/internal/store/store.go", + "code": "655: \t// a genuinely NEW occurrence with last_seen \u003e dismissed_at resurfaces the row).\n656: \ts.db.Exec(`ALTER TABLE app_log_issues ADD COLUMN context TEXT`)\n657: \ts.db.Exec(`ALTER TABLE app_log_issues ADD COLUMN context_customer TEXT`)\n", + "line": "656", + "column": "2", + "nosec": false, + "suppressions": null + }, + { + "severity": "LOW", + "confidence": "HIGH", + "cwe": { + "id": "703", + "url": "https://cwe.mitre.org/data/definitions/703.html" + }, + "rule_id": "G104", + "details": "Errors unhandled", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom.eu/hub/internal/store/store.go", + "code": "624: \t// (that method's own contract says so).\n625: \ts.db.Exec(`ALTER TABLE host_pbs_secrets ADD COLUMN generation INTEGER NOT NULL DEFAULT 0`)\n626: \n", + "line": "625", + "column": "2", + "nosec": false, + "suppressions": null + }, + { + "severity": "LOW", + "confidence": "HIGH", + "cwe": { + "id": "703", + "url": "https://cwe.mitre.org/data/definitions/703.html" + }, + "rule_id": "G104", + "details": "Errors unhandled", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom.eu/hub/internal/store/store.go", + "code": "498: \t// legitimate future writer would have to prove first.\n499: \ts.db.Exec(`ALTER TABLE host_escrow ADD COLUMN stale_at DATETIME`)\n500: \n", + "line": "499", + "column": "2", + "nosec": false, + "suppressions": null + }, + { + "severity": "LOW", + "confidence": "HIGH", + "cwe": { + "id": "703", + "url": "https://cwe.mitre.org/data/definitions/703.html" + }, + "rule_id": "G104", + "details": "Errors unhandled", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom.eu/hub/internal/store/store.go", + "code": "488: \t// instead of trusting blob-presence. NULL/'' = a legacy or password-less blob (never auto-confirms).\n489: \ts.db.Exec(`ALTER TABLE host_escrow ADD COLUMN restic_pw_sha256 TEXT`)\n490: \n", + "line": "489", + "column": "2", + "nosec": false, + "suppressions": null + }, + { + "severity": "LOW", + "confidence": "HIGH", + "cwe": { + "id": "703", + "url": "https://cwe.mitre.org/data/definitions/703.html" + }, + "rule_id": "G104", + "details": "Errors unhandled", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom.eu/hub/internal/store/store.go", + "code": "482: \t// v0.93.0 report records that as a looked-at fact rather than a deduction.\n483: \ts.db.Exec(`ALTER TABLE host_escrow_superseded ADD COLUMN identity_blob BLOB`)\n484: \n", + "line": "483", + "column": "2", + "nosec": false, + "suppressions": null + }, + { + "severity": "LOW", + "confidence": "HIGH", + "cwe": { + "id": "703", + "url": "https://cwe.mitre.org/data/definitions/703.html" + }, + "rule_id": "G104", + "details": "Errors unhandled", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom.eu/hub/internal/store/store.go", + "code": "474: \ts.db.Exec(`ALTER TABLE host_escrow ADD COLUMN identity_blob BLOB`)\n475: \ts.db.Exec(`ALTER TABLE host_escrow ADD COLUMN directive_json TEXT NOT NULL DEFAULT '{}'`)\n476: \n", + "line": "475", + "column": "2", + "nosec": false, + "suppressions": null + }, + { + "severity": "LOW", + "confidence": "HIGH", + "cwe": { + "id": "703", + "url": "https://cwe.mitre.org/data/definitions/703.html" + }, + "rule_id": "G104", + "details": "Errors unhandled", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom.eu/hub/internal/store/store.go", + "code": "473: \ts.db.Exec(`ALTER TABLE hosts ADD COLUMN recovery_mode_until DATETIME`)\n474: \ts.db.Exec(`ALTER TABLE host_escrow ADD COLUMN identity_blob BLOB`)\n475: \ts.db.Exec(`ALTER TABLE host_escrow ADD COLUMN directive_json TEXT NOT NULL DEFAULT '{}'`)\n", + "line": "474", + "column": "2", + "nosec": false, + "suppressions": null + }, + { + "severity": "LOW", + "confidence": "HIGH", + "cwe": { + "id": "703", + "url": "https://cwe.mitre.org/data/definitions/703.html" + }, + "rule_id": "G104", + "details": "Errors unhandled", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom.eu/hub/internal/store/store.go", + "code": "472: \t// secret is hub-held (the blobs need R, which the hub never has).\n473: \ts.db.Exec(`ALTER TABLE hosts ADD COLUMN recovery_mode_until DATETIME`)\n474: \ts.db.Exec(`ALTER TABLE host_escrow ADD COLUMN identity_blob BLOB`)\n", + "line": "473", + "column": "2", + "nosec": false, + "suppressions": null + }, + { + "severity": "LOW", + "confidence": "HIGH", + "cwe": { + "id": "703", + "url": "https://cwe.mitre.org/data/definitions/703.html" + }, + "rule_id": "G104", + "details": "Errors unhandled", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom.eu/hub/internal/store/store.go", + "code": "340: \t\t// WAL checkpoint(TRUNCATE) so no plaintext lingers in the -wal sidecar either.\n341: \t\ts.db.Exec(`PRAGMA wal_checkpoint(TRUNCATE)`)\n342: \t\tif s.logger != nil {\n", + "line": "341", + "column": "3", + "nosec": false, + "suppressions": null + }, + { + "severity": "LOW", + "confidence": "HIGH", + "cwe": { + "id": "703", + "url": "https://cwe.mitre.org/data/definitions/703.html" + }, + "rule_id": "G104", + "details": "Errors unhandled", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom.eu/hub/internal/store/store.go", + "code": "328: \tvar infraTables int\n329: \ts.db.QueryRow(`SELECT COUNT(*) FROM sqlite_master WHERE type='table'\n330: \t\tAND name IN ('infra_backup_versions','infra_backups')`).Scan(\u0026infraTables)\n331: \tif infraTables \u003e 0 {\n", + "line": "329-330", + "column": "2", + "nosec": false, + "suppressions": null + }, + { + "severity": "LOW", + "confidence": "HIGH", + "cwe": { + "id": "703", + "url": "https://cwe.mitre.org/data/definitions/703.html" + }, + "rule_id": "G104", + "details": "Errors unhandled", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom.eu/hub/internal/store/store.go", + "code": "272: \t// v0.3.0: add channel column to notification_log (idempotent)\n273: \ts.db.Exec(\"ALTER TABLE notification_log ADD COLUMN channel TEXT NOT NULL DEFAULT 'customer'\")\n274: \n", + "line": "273", + "column": "2", + "nosec": false, + "suppressions": null + }, + { + "severity": "LOW", + "confidence": "HIGH", + "cwe": { + "id": "703", + "url": "https://cwe.mitre.org/data/definitions/703.html" + }, + "rule_id": "G104", + "details": "Errors unhandled", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom.eu/hub/internal/store/store.go", + "code": "269: \t// v0.3.0: add cooldown_hours to customer_notifications (idempotent)\n270: \ts.db.Exec(\"ALTER TABLE customer_notifications ADD COLUMN cooldown_hours INTEGER DEFAULT 6\")\n271: \n", + "line": "270", + "column": "2", + "nosec": false, + "suppressions": null + }, + { + "severity": "LOW", + "confidence": "HIGH", + "cwe": { + "id": "703", + "url": "https://cwe.mitre.org/data/definitions/703.html" + }, + "rule_id": "G104", + "details": "Errors unhandled", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom.eu/hub/internal/store/store.go", + "code": "222: \ts.db.Exec(\"ALTER TABLE reports ADD COLUMN language TEXT NOT NULL DEFAULT ''\")\n223: \ts.db.Exec(\"ALTER TABLE customer_configs ADD COLUMN language TEXT NOT NULL DEFAULT 'hu'\")\n224: \n", + "line": "223", + "column": "2", + "nosec": false, + "suppressions": null + }, + { + "severity": "LOW", + "confidence": "HIGH", + "cwe": { + "id": "703", + "url": "https://cwe.mitre.org/data/definitions/703.html" + }, + "rule_id": "G104", + "details": "Errors unhandled", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom.eu/hub/internal/store/store.go", + "code": "221: \t// migrated DB before the sync.\n222: \ts.db.Exec(\"ALTER TABLE reports ADD COLUMN language TEXT NOT NULL DEFAULT ''\")\n223: \ts.db.Exec(\"ALTER TABLE customer_configs ADD COLUMN language TEXT NOT NULL DEFAULT 'hu'\")\n", + "line": "222", + "column": "2", + "nosec": false, + "suppressions": null + }, + { + "severity": "LOW", + "confidence": "HIGH", + "cwe": { + "id": "703", + "url": "https://cwe.mitre.org/data/definitions/703.html" + }, + "rule_id": "G104", + "details": "Errors unhandled", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom.eu/hub/internal/store/store.go", + "code": "199: \t// at 1, so an already-running box records that as its baseline on its next report without restarting.\n200: \ts.db.Exec(\"ALTER TABLE customer_configs ADD COLUMN config_version INTEGER NOT NULL DEFAULT 1\")\n201: \n", + "line": "200", + "column": "2", + "nosec": false, + "suppressions": null + }, + { + "severity": "LOW", + "confidence": "HIGH", + "cwe": { + "id": "703", + "url": "https://cwe.mitre.org/data/definitions/703.html" + }, + "rule_id": "G104", + "details": "Errors unhandled", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom.eu/hub/internal/store/store.go", + "code": "191: \t// it only ever applies to the exact floor it was declared for (see floor_declared.go). Idempotent.\n192: \ts.db.Exec(\"ALTER TABLE customer_configs ADD COLUMN min_controller_declared_min_agent TEXT NOT NULL DEFAULT ''\")\n193: \n", + "line": "192", + "column": "2", + "nosec": false, + "suppressions": null + }, + { + "severity": "LOW", + "confidence": "HIGH", + "cwe": { + "id": "703", + "url": "https://cwe.mitre.org/data/definitions/703.html" + }, + "rule_id": "G104", + "details": "Errors unhandled", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom.eu/hub/internal/store/store.go", + "code": "187: \t// R-604 (v0.135.0): when the per-customer floor override was set (its age, on the System page).\n188: \ts.db.Exec(\"ALTER TABLE customer_configs ADD COLUMN min_controller_set_at TEXT NOT NULL DEFAULT ''\")\n189: \n", + "line": "188", + "column": "2", + "nosec": false, + "suppressions": null + }, + { + "severity": "LOW", + "confidence": "HIGH", + "cwe": { + "id": "703", + "url": "https://cwe.mitre.org/data/definitions/703.html" + }, + "rule_id": "G104", + "details": "Errors unhandled", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom.eu/hub/internal/store/store.go", + "code": "185: \t// config). Idempotent.\n186: \ts.db.Exec(\"ALTER TABLE customer_configs ADD COLUMN min_controller_version TEXT NOT NULL DEFAULT ''\")\n187: \t// R-604 (v0.135.0): when the per-customer floor override was set (its age, on the System page).\n", + "line": "186", + "column": "2", + "nosec": false, + "suppressions": null + }, + { + "severity": "LOW", + "confidence": "HIGH", + "cwe": { + "id": "703", + "url": "https://cwe.mitre.org/data/definitions/703.html" + }, + "rule_id": "G104", + "details": "Errors unhandled", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom.eu/hub/internal/store/store.go", + "code": "180: \t// v0.2.1: add status column to customer_configs (idempotent)\n181: \ts.db.Exec(\"ALTER TABLE customer_configs ADD COLUMN status TEXT NOT NULL DEFAULT 'active'\")\n182: \n", + "line": "181", + "column": "2", + "nosec": false, + "suppressions": null + }, + { + "severity": "LOW", + "confidence": "HIGH", + "cwe": { + "id": "703", + "url": "https://cwe.mitre.org/data/definitions/703.html" + }, + "rule_id": "G104", + "details": "Errors unhandled", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom.eu/hub/internal/store/store.go", + "code": "177: \t// v0.1.8: add controller_url column (idempotent — ignore error if already exists)\n178: \ts.db.Exec(\"ALTER TABLE reports ADD COLUMN controller_url TEXT\")\n179: \n", + "line": "178", + "column": "2", + "nosec": false, + "suppressions": null + }, + { + "severity": "LOW", + "confidence": "HIGH", + "cwe": { + "id": "703", + "url": "https://cwe.mitre.org/data/definitions/703.html" + }, + "rule_id": "G104", + "details": "Errors unhandled", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom.eu/hub/internal/store/store.go", + "code": "112: \tif err := s.migrate(); err != nil {\n113: \t\tdb.Close()\n114: \t\treturn nil, fmt.Errorf(\"migrating database: %w\", err)\n", + "line": "113", + "column": "3", + "nosec": false, + "suppressions": null + }, + { + "severity": "LOW", + "confidence": "HIGH", + "cwe": { + "id": "703", + "url": "https://cwe.mitre.org/data/definitions/703.html" + }, + "rule_id": "G104", + "details": "Errors unhandled", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom.eu/hub/internal/store/r879_box_seal.go", + "code": "209: \t\t}\n210: \t\trows.Close()\n211: \t}\n", + "line": "210", + "column": "3", + "nosec": false, + "suppressions": null + }, + { + "severity": "LOW", + "confidence": "HIGH", + "cwe": { + "id": "703", + "url": "https://cwe.mitre.org/data/definitions/703.html" + }, + "rule_id": "G104", + "details": "Errors unhandled", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom.eu/hub/internal/store/r879_box_seal.go", + "code": "204: \t\t\tif err := rows.Scan(\u0026t.id, \u0026t.sealed); err != nil {\n205: \t\t\t\trows.Close()\n206: \t\t\t\treturn 0, err\n", + "line": "205", + "column": "5", + "nosec": false, + "suppressions": null + }, + { + "severity": "LOW", + "confidence": "HIGH", + "cwe": { + "id": "703", + "url": "https://cwe.mitre.org/data/definitions/703.html" + }, + "rule_id": "G104", + "details": "Errors unhandled", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom.eu/hub/internal/store/r879_box_seal.go", + "code": "133: \t\t}\n134: \t\trows.Close()\n135: \t\tfor _, r := range todo {\n", + "line": "134", + "column": "3", + "nosec": false, + "suppressions": null + }, + { + "severity": "LOW", + "confidence": "HIGH", + "cwe": { + "id": "703", + "url": "https://cwe.mitre.org/data/definitions/703.html" + }, + "rule_id": "G104", + "details": "Errors unhandled", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom.eu/hub/internal/store/r879_box_seal.go", + "code": "128: \t\t\tif err := rows.Scan(\u0026r.id, \u0026r.v); err != nil {\n129: \t\t\t\trows.Close()\n130: \t\t\t\treturn n, err\n", + "line": "129", + "column": "5", + "nosec": false, + "suppressions": null + }, + { + "severity": "LOW", + "confidence": "HIGH", + "cwe": { + "id": "703", + "url": "https://cwe.mitre.org/data/definitions/703.html" + }, + "rule_id": "G104", + "details": "Errors unhandled", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom.eu/hub/internal/store/r879_box_seal.go", + "code": "94: \t\t}\n95: \t\trows.Close()\n96: \t\tfor _, r := range todo {\n", + "line": "95", + "column": "3", + "nosec": false, + "suppressions": null + }, + { + "severity": "LOW", + "confidence": "HIGH", + "cwe": { + "id": "703", + "url": "https://cwe.mitre.org/data/definitions/703.html" + }, + "rule_id": "G104", + "details": "Errors unhandled", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom.eu/hub/internal/store/r879_box_seal.go", + "code": "89: \t\t\tif err := rows.Scan(\u0026r.id, \u0026r.k); err != nil {\n90: \t\t\t\trows.Close()\n91: \t\t\t\treturn err\n", + "line": "90", + "column": "5", + "nosec": false, + "suppressions": null + }, + { + "severity": "LOW", + "confidence": "HIGH", + "cwe": { + "id": "703", + "url": "https://cwe.mitre.org/data/definitions/703.html" + }, + "rule_id": "G104", + "details": "Errors unhandled", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom.eu/hub/internal/store/os_updates.go", + "code": "71: \ts.db.Exec(`ALTER TABLE os_releases ADD COLUMN cancelled_at TEXT NOT NULL DEFAULT ''`)\n72: \ts.db.Exec(`ALTER TABLE os_releases ADD COLUMN cancel_reason TEXT NOT NULL DEFAULT ''`)\n73: \t// The kernel lane (hub v0.143.0, R-836, `09` §3 decision 172): every mail that told a household \"the box restarts\n", + "line": "72", + "column": "2", + "nosec": false, + "suppressions": null + }, + { + "severity": "LOW", + "confidence": "HIGH", + "cwe": { + "id": "703", + "url": "https://cwe.mitre.org/data/definitions/703.html" + }, + "rule_id": "G104", + "details": "Errors unhandled", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom.eu/hub/internal/store/os_updates.go", + "code": "70: \t}\n71: \ts.db.Exec(`ALTER TABLE os_releases ADD COLUMN cancelled_at TEXT NOT NULL DEFAULT ''`)\n72: \ts.db.Exec(`ALTER TABLE os_releases ADD COLUMN cancel_reason TEXT NOT NULL DEFAULT ''`)\n", + "line": "71", + "column": "2", + "nosec": false, + "suppressions": null + }, + { + "severity": "LOW", + "confidence": "HIGH", + "cwe": { + "id": "703", + "url": "https://cwe.mitre.org/data/definitions/703.html" + }, + "rule_id": "G104", + "details": "Errors unhandled", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom.eu/hub/internal/store/os_updates.go", + "code": "66: \t\t// unattended — operator may reverse). From hub v0.133.0 on, every approval under an override is marked.\n67: \t\ts.db.Exec(`UPDATE os_releases SET test = 1 WHERE approved_by = 'auto' AND EXISTS (SELECT 1 FROM os_candidates c\n68: \t\t\tWHERE c.fingerprint = os_releases.fingerprint\n69: \t\t\tAND (julianday(os_releases.approved_at) - julianday(c.first_seen)) * 24 \u003c 24)`)\n70: \t}\n", + "line": "67-69", + "column": "3", + "nosec": false, + "suppressions": null + }, + { + "severity": "LOW", + "confidence": "HIGH", + "cwe": { + "id": "703", + "url": "https://cwe.mitre.org/data/definitions/703.html" + }, + "rule_id": "G104", + "details": "Errors unhandled", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom.eu/hub/internal/store/os_updates.go", + "code": "54: \ts.db.Exec(`ALTER TABLE os_reports ADD COLUMN layer TEXT NOT NULL DEFAULT 'guest'`)\n55: \ts.db.Exec(`ALTER TABLE os_releases ADD COLUMN layer TEXT NOT NULL DEFAULT 'guest'`)\n56: \t// Test approvals end with the test (hub v0.133.0, `11` §5.3.1): an approval made while a TEST override is active\n", + "line": "55", + "column": "2", + "nosec": false, + "suppressions": null + }, + { + "severity": "LOW", + "confidence": "HIGH", + "cwe": { + "id": "703", + "url": "https://cwe.mitre.org/data/definitions/703.html" + }, + "rule_id": "G104", + "details": "Errors unhandled", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom.eu/hub/internal/store/os_updates.go", + "code": "53: \t// Host fast lane (hub v0.131.0): every report and release belongs to a LAYER; old rows are the guest's.\n54: \ts.db.Exec(`ALTER TABLE os_reports ADD COLUMN layer TEXT NOT NULL DEFAULT 'guest'`)\n55: \ts.db.Exec(`ALTER TABLE os_releases ADD COLUMN layer TEXT NOT NULL DEFAULT 'guest'`)\n", + "line": "54", + "column": "2", + "nosec": false, + "suppressions": null + }, + { + "severity": "LOW", + "confidence": "HIGH", + "cwe": { + "id": "703", + "url": "https://cwe.mitre.org/data/definitions/703.html" + }, + "rule_id": "G104", + "details": "Errors unhandled", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom.eu/hub/internal/store/offsite_seal.go", + "code": "142: \t}\n143: \trows.Close()\n144: \tn := 0\n", + "line": "143", + "column": "2", + "nosec": false, + "suppressions": null + }, + { + "severity": "LOW", + "confidence": "HIGH", + "cwe": { + "id": "703", + "url": "https://cwe.mitre.org/data/definitions/703.html" + }, + "rule_id": "G104", + "details": "Errors unhandled", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom.eu/hub/internal/store/offsite_seal.go", + "code": "135: \t\tif err := rows.Scan(\u0026r.id, \u0026r.v); err != nil {\n136: \t\t\trows.Close()\n137: \t\t\treturn 0, err\n", + "line": "136", + "column": "4", + "nosec": false, + "suppressions": null + }, + { + "severity": "LOW", + "confidence": "HIGH", + "cwe": { + "id": "703", + "url": "https://cwe.mitre.org/data/definitions/703.html" + }, + "rule_id": "G104", + "details": "Errors unhandled", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom.eu/hub/internal/store/logtail.go", + "code": "136: \t}\n137: \tjson.Unmarshal([]byte(linesJSON), \u0026t.Lines)\n138: \treturn t, nil\n", + "line": "137", + "column": "2", + "nosec": false, + "suppressions": null + }, + { + "severity": "LOW", + "confidence": "HIGH", + "cwe": { + "id": "703", + "url": "https://cwe.mitre.org/data/definitions/703.html" + }, + "rule_id": "G104", + "details": "Errors unhandled", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom.eu/hub/internal/store/logbundle.go", + "code": "222: \traw, err := io.ReadAll(io.LimitReader(zr, logBundleMaxRawBytes+1))\n223: \tzr.Close()\n224: \tif err != nil {\n", + "line": "223", + "column": "2", + "nosec": false, + "suppressions": null + }, + { + "severity": "LOW", + "confidence": "HIGH", + "cwe": { + "id": "703", + "url": "https://cwe.mitre.org/data/definitions/703.html" + }, + "rule_id": "G104", + "details": "Errors unhandled", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom.eu/hub/internal/store/host_recovery.go", + "code": "179: \t}\n180: \trows.Close()\n181: \tn := 0\n", + "line": "180", + "column": "2", + "nosec": false, + "suppressions": null + }, + { + "severity": "LOW", + "confidence": "HIGH", + "cwe": { + "id": "703", + "url": "https://cwe.mitre.org/data/definitions/703.html" + }, + "rule_id": "G104", + "details": "Errors unhandled", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom.eu/hub/internal/store/host_recovery.go", + "code": "172: \t\tif err := rows.Scan(\u0026r.id, \u0026r.v); err != nil {\n173: \t\t\trows.Close()\n174: \t\t\treturn 0, err\n", + "line": "173", + "column": "4", + "nosec": false, + "suppressions": null + }, + { + "severity": "LOW", + "confidence": "HIGH", + "cwe": { + "id": "703", + "url": "https://cwe.mitre.org/data/definitions/703.html" + }, + "rule_id": "G104", + "details": "Errors unhandled", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom.eu/hub/internal/store/deleted_customer_audit.go", + "code": "52: \t}\n53: \trows.Close()\n54: \tfor _, d := range dels {\n", + "line": "53", + "column": "2", + "nosec": false, + "suppressions": null + }, + { + "severity": "LOW", + "confidence": "HIGH", + "cwe": { + "id": "703", + "url": "https://cwe.mitre.org/data/definitions/703.html" + }, + "rule_id": "G104", + "details": "Errors unhandled", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom.eu/hub/internal/store/deleted_customer_audit.go", + "code": "39: \t\tif err := rows.Scan(\u0026id, \u0026at, \u0026legs); err != nil {\n40: \t\t\trows.Close()\n41: \t\t\treturn 0, 0, err\n", + "line": "40", + "column": "4", + "nosec": false, + "suppressions": null + }, + { + "severity": "LOW", + "confidence": "HIGH", + "cwe": { + "id": "703", + "url": "https://cwe.mitre.org/data/definitions/703.html" + }, + "rule_id": "G104", + "details": "Errors unhandled", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom.eu/hub/internal/poke/client.go", + "code": "114: \tif dl, ok := ctx.Deadline(); ok {\n115: \t\tconn.SetDeadline(dl)\n116: \t}\n", + "line": "115", + "column": "3", + "nosec": false, + "suppressions": null + }, + { + "severity": "LOW", + "confidence": "HIGH", + "cwe": { + "id": "703", + "url": "https://cwe.mitre.org/data/definitions/703.html" + }, + "rule_id": "G104", + "details": "Errors unhandled", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom.eu/hub/internal/poke/client.go", + "code": "112: \tdefer client.Close()\n113: \tconn.SetDeadline(time.Time{})\n114: \tif dl, ok := ctx.Deadline(); ok {\n", + "line": "113", + "column": "2", + "nosec": false, + "suppressions": null + }, + { + "severity": "LOW", + "confidence": "HIGH", + "cwe": { + "id": "703", + "url": "https://cwe.mitre.org/data/definitions/703.html" + }, + "rule_id": "G104", + "details": "Errors unhandled", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom.eu/hub/internal/poke/client.go", + "code": "107: \tif err != nil {\n108: \t\tconn.Close()\n109: \t\treturn fmt.Errorf(\"poke: ssh handshake %s: %w\", c.addr, err)\n", + "line": "108", + "column": "3", + "nosec": false, + "suppressions": null + }, + { + "severity": "LOW", + "confidence": "HIGH", + "cwe": { + "id": "703", + "url": "https://cwe.mitre.org/data/definitions/703.html" + }, + "rule_id": "G104", + "details": "Errors unhandled", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom.eu/hub/internal/poke/client.go", + "code": "103: \t} else {\n104: \t\tconn.SetDeadline(time.Now().Add(c.timeout))\n105: \t}\n", + "line": "104", + "column": "3", + "nosec": false, + "suppressions": null + }, + { + "severity": "LOW", + "confidence": "HIGH", + "cwe": { + "id": "703", + "url": "https://cwe.mitre.org/data/definitions/703.html" + }, + "rule_id": "G104", + "details": "Errors unhandled", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom.eu/hub/internal/poke/client.go", + "code": "101: \tif dl, ok := ctx.Deadline(); ok {\n102: \t\tconn.SetDeadline(dl)\n103: \t} else {\n", + "line": "102", + "column": "3", + "nosec": false, + "suppressions": null + }, + { + "severity": "LOW", + "confidence": "HIGH", + "cwe": { + "id": "703", + "url": "https://cwe.mitre.org/data/definitions/703.html" + }, + "rule_id": "G104", + "details": "Errors unhandled", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom.eu/hub/internal/offsitekeys/sshdialer.go", + "code": "66: \tif err != nil {\n67: \t\tconn.Close()\n68: \t\treturn nil, fmt.Errorf(\"offsitekeys: ssh handshake %s: %w\", addr, err)\n", + "line": "67", + "column": "3", + "nosec": false, + "suppressions": null + }, + { + "severity": "LOW", + "confidence": "HIGH", + "cwe": { + "id": "703", + "url": "https://cwe.mitre.org/data/definitions/703.html" + }, + "rule_id": "G104", + "details": "Errors unhandled", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom.eu/hub/internal/offsitekeys/service.go", + "code": "455: \t_, lerr := sh.Run(ctx, \"ls -d \"+path, nil)\n456: \tsh.Close()\n457: \tif lerr != nil {\n", + "line": "456", + "column": "2", + "nosec": false, + "suppressions": null + }, + { + "severity": "LOW", + "confidence": "HIGH", + "cwe": { + "id": "703", + "url": "https://cwe.mitre.org/data/definitions/703.html" + }, + "rule_id": "G104", + "details": "Errors unhandled", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom.eu/hub/internal/offsite/scanner.go", + "code": "48: \tif c != nil {\n49: \t\tc.Close()\n50: \t}\n", + "line": "49", + "column": "3", + "nosec": false, + "suppressions": null + }, + { + "severity": "LOW", + "confidence": "HIGH", + "cwe": { + "id": "703", + "url": "https://cwe.mitre.org/data/definitions/703.html" + }, + "rule_id": "G104", + "details": "Errors unhandled", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom.eu/hub/internal/notify/dispatcher.go", + "code": "1095: \td.logger.Printf(\"[INFO] kernel notice (%s) emailed to the household of %s (lang=%s)\", kver, customerID, lang)\n1096: \td.store.LogNotification(customerID, \"kernel_notice\", \"info\", subject, \"sent\", \"\", \"customer\")\n1097: \treturn lang, nil\n", + "line": "1096", + "column": "2", + "nosec": false, + "suppressions": null + }, + { + "severity": "LOW", + "confidence": "HIGH", + "cwe": { + "id": "703", + "url": "https://cwe.mitre.org/data/definitions/703.html" + }, + "rule_id": "G104", + "details": "Errors unhandled", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom.eu/hub/internal/notify/dispatcher.go", + "code": "1091: \t\td.logger.Printf(\"[ERROR] kernel notice (%s) to customer %s failed: %v\", kver, customerID, err)\n1092: \t\td.store.LogNotification(customerID, \"kernel_notice\", \"info\", subject, \"failed\", err.Error(), \"customer\")\n1093: \t\treturn lang, err\n", + "line": "1092", + "column": "3", + "nosec": false, + "suppressions": null + }, + { + "severity": "LOW", + "confidence": "HIGH", + "cwe": { + "id": "703", + "url": "https://cwe.mitre.org/data/definitions/703.html" + }, + "rule_id": "G104", + "details": "Errors unhandled", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom.eu/hub/internal/notify/dispatcher.go", + "code": "1087: \t\t// The caller runs no kernel step on an error (no mail, no step) — exactly right for a held hub.\n1088: \t\td.store.LogNotification(customerID, \"kernel_notice\", \"info\", subject, \"held\", \"MAIL-HOLD marker present — dropped\", \"customer\")\n1089: \t\treturn lang, err\n", + "line": "1088", + "column": "3", + "nosec": false, + "suppressions": null + }, + { + "severity": "LOW", + "confidence": "HIGH", + "cwe": { + "id": "703", + "url": "https://cwe.mitre.org/data/definitions/703.html" + }, + "rule_id": "G104", + "details": "Errors unhandled", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom.eu/hub/internal/notify/dispatcher.go", + "code": "1058: \td.logger.Printf(\"[INFO] self-bind link emailed to the registered address of %s\", customerID)\n1059: \td.store.LogNotification(customerID, \"selfbind_link\", \"info\", subject, \"sent\", \"\", \"customer\")\n1060: \treturn nil\n", + "line": "1059", + "column": "2", + "nosec": false, + "suppressions": null + }, + { + "severity": "LOW", + "confidence": "HIGH", + "cwe": { + "id": "703", + "url": "https://cwe.mitre.org/data/definitions/703.html" + }, + "rule_id": "G104", + "details": "Errors unhandled", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom.eu/hub/internal/notify/dispatcher.go", + "code": "1054: \t\td.logger.Printf(\"[ERROR] self-bind link email to customer %s failed: %v\", customerID, err)\n1055: \t\td.store.LogNotification(customerID, \"selfbind_link\", \"info\", subject, \"failed\", err.Error(), \"customer\")\n1056: \t\treturn err\n", + "line": "1055", + "column": "3", + "nosec": false, + "suppressions": null + }, + { + "severity": "LOW", + "confidence": "HIGH", + "cwe": { + "id": "703", + "url": "https://cwe.mitre.org/data/definitions/703.html" + }, + "rule_id": "G104", + "details": "Errors unhandled", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom.eu/hub/internal/notify/dispatcher.go", + "code": "1050: \tif err := d.deliver(\"self-bind link mail\", customerID, email, subject, body, nil); isHeld(err) {\n1051: \t\td.store.LogNotification(customerID, \"selfbind_link\", \"info\", subject, \"held\", \"MAIL-HOLD marker present — dropped\", \"customer\")\n1052: \t\treturn err\n", + "line": "1051", + "column": "3", + "nosec": false, + "suppressions": null + }, + { + "severity": "LOW", + "confidence": "HIGH", + "cwe": { + "id": "703", + "url": "https://cwe.mitre.org/data/definitions/703.html" + }, + "rule_id": "G104", + "details": "Errors unhandled", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom.eu/hub/internal/notify/dispatcher.go", + "code": "1034: \td.logger.Printf(\"[INFO] claim %s email sent to the registered address of %s\", kind, customerID)\n1035: \td.store.LogNotification(customerID, eventType, \"info\", subject, \"sent\", \"\", \"customer\")\n1036: \treturn nil\n", + "line": "1035", + "column": "2", + "nosec": false, + "suppressions": null + }, + { + "severity": "LOW", + "confidence": "HIGH", + "cwe": { + "id": "703", + "url": "https://cwe.mitre.org/data/definitions/703.html" + }, + "rule_id": "G104", + "details": "Errors unhandled", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom.eu/hub/internal/notify/dispatcher.go", + "code": "1030: \t\td.logger.Printf(\"[ERROR] claim %s email to customer %s failed: %v\", kind, customerID, err)\n1031: \t\td.store.LogNotification(customerID, eventType, \"info\", subject, \"failed\", err.Error(), \"customer\")\n1032: \t\treturn err\n", + "line": "1031", + "column": "3", + "nosec": false, + "suppressions": null + }, + { + "severity": "LOW", + "confidence": "HIGH", + "cwe": { + "id": "703", + "url": "https://cwe.mitre.org/data/definitions/703.html" + }, + "rule_id": "G104", + "details": "Errors unhandled", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom.eu/hub/internal/notify/dispatcher.go", + "code": "1026: \tif err := d.deliver(\"claim \"+kind+\" mail\", customerID, email, subject, body, nil); isHeld(err) {\n1027: \t\td.store.LogNotification(customerID, eventType, \"info\", subject, \"held\", \"MAIL-HOLD marker present — dropped\", \"customer\")\n1028: \t\treturn err\n", + "line": "1027", + "column": "3", + "nosec": false, + "suppressions": null + }, + { + "severity": "LOW", + "confidence": "HIGH", + "cwe": { + "id": "703", + "url": "https://cwe.mitre.org/data/definitions/703.html" + }, + "rule_id": "G104", + "details": "Errors unhandled", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom.eu/hub/internal/notify/dispatcher.go", + "code": "943: \td.logger.Printf(\"[INFO] Customer email sent for %s/%s\", customerID, eventType) // never the address (R-922)\n944: \td.store.LogNotification(customerID, eventType, severity, message, \"sent\", \"\", \"customer\")\n945: }\n", + "line": "944", + "column": "2", + "nosec": false, + "suppressions": null + }, + { + "severity": "LOW", + "confidence": "HIGH", + "cwe": { + "id": "703", + "url": "https://cwe.mitre.org/data/definitions/703.html" + }, + "rule_id": "G104", + "details": "Errors unhandled", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom.eu/hub/internal/notify/dispatcher.go", + "code": "939: \t\td.logger.Printf(\"[ERROR] Customer email failed for %s/%s: %v\", customerID, eventType, err)\n940: \t\td.store.LogNotification(customerID, eventType, severity, message, \"failed\", err.Error(), \"customer\")\n941: \t\treturn\n", + "line": "940", + "column": "3", + "nosec": false, + "suppressions": null + }, + { + "severity": "LOW", + "confidence": "HIGH", + "cwe": { + "id": "703", + "url": "https://cwe.mitre.org/data/definitions/703.html" + }, + "rule_id": "G104", + "details": "Errors unhandled", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom.eu/hub/internal/notify/dispatcher.go", + "code": "935: \t\td.forgetCustomerCooldown(cooldownKey)\n936: \t\td.store.LogNotification(customerID, eventType, severity, message, \"held\", \"MAIL-HOLD marker present — dropped\", \"customer\")\n937: \t\treturn\n", + "line": "936", + "column": "3", + "nosec": false, + "suppressions": null + }, + { + "severity": "LOW", + "confidence": "HIGH", + "cwe": { + "id": "703", + "url": "https://cwe.mitre.org/data/definitions/703.html" + }, + "rule_id": "G104", + "details": "Errors unhandled", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom.eu/hub/internal/notify/dispatcher.go", + "code": "902: \t\tif last, ok, err := d.store.LastCustomerSentAt(customerID, householdLivenessTypes); err == nil \u0026\u0026 ok \u0026\u0026 time.Since(last) \u003c householdLivenessQuiet {\n903: \t\t\td.store.LogNotification(customerID, eventType, severity, message, \"skipped\",\n904: \t\t\t\t\"liveness: the household hears this at most once per 7 days (R-873)\", \"customer\")\n905: \t\t\td.logger.Printf(\"[INFO] Customer mail skipped for %s/%s — the household was told about an outage %s ago (R-873: at most once per 7 days)\",\n", + "line": "903-904", + "column": "4", + "nosec": false, + "suppressions": null + }, + { + "severity": "LOW", + "confidence": "HIGH", + "cwe": { + "id": "703", + "url": "https://cwe.mitre.org/data/definitions/703.html" + }, + "rule_id": "G104", + "details": "Errors unhandled", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom.eu/hub/internal/notify/dispatcher.go", + "code": "872: \tif operatorOnlyEvents[eventType] {\n873: \t\td.store.LogNotification(customerID, eventType, severity, message, \"skipped\", \"operator_only\", \"customer\")\n874: \t\treturn\n", + "line": "873", + "column": "3", + "nosec": false, + "suppressions": null + }, + { + "severity": "LOW", + "confidence": "HIGH", + "cwe": { + "id": "703", + "url": "https://cwe.mitre.org/data/definitions/703.html" + }, + "rule_id": "G104", + "details": "Errors unhandled", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom.eu/hub/internal/notify/dispatcher.go", + "code": "664: \td.logger.Printf(\"[INFO] Operator email sent for %s/%s\", customerID, eventType)\n665: \td.store.LogNotification(customerID, eventType, severity, message, \"sent\", \"\", \"operator\")\n666: }\n", + "line": "665", + "column": "2", + "nosec": false, + "suppressions": null + }, + { + "severity": "LOW", + "confidence": "HIGH", + "cwe": { + "id": "703", + "url": "https://cwe.mitre.org/data/definitions/703.html" + }, + "rule_id": "G104", + "details": "Errors unhandled", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom.eu/hub/internal/notify/dispatcher.go", + "code": "659: \t\td.logger.Printf(\"[ERROR] Operator email failed for %s/%s: %v — retrying in %v\", customerID, eventType, err, operatorRetryDelays[0])\n660: \t\td.store.LogNotification(customerID, eventType, severity, message, \"failed\", err.Error(), \"operator\")\n661: \t\td.retryOperatorEmail(customerID, eventType, severity, message, subject, body, hdrs, 0)\n", + "line": "660", + "column": "3", + "nosec": false, + "suppressions": null + }, + { + "severity": "LOW", + "confidence": "HIGH", + "cwe": { + "id": "703", + "url": "https://cwe.mitre.org/data/definitions/703.html" + }, + "rule_id": "G104", + "details": "Errors unhandled", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom.eu/hub/internal/notify/dispatcher.go", + "code": "655: \t\td.mu.Unlock()\n656: \t\td.store.LogNotification(customerID, eventType, severity, message, \"held\", \"MAIL-HOLD marker present — dropped\", \"operator\")\n657: \t\treturn\n", + "line": "656", + "column": "3", + "nosec": false, + "suppressions": null + }, + { + "severity": "LOW", + "confidence": "HIGH", + "cwe": { + "id": "703", + "url": "https://cwe.mitre.org/data/definitions/703.html" + }, + "rule_id": "G104", + "details": "Errors unhandled", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom.eu/hub/internal/notify/dispatcher.go", + "code": "378: \td.logger.Printf(\"[INFO] Customer recovery email sent to %s for %s/%s\", prefs.Email, customerID, eventType)\n379: \td.store.LogNotification(customerID, eventType, severity, message, \"sent\", \"\", \"customer\")\n380: }\n", + "line": "379", + "column": "2", + "nosec": false, + "suppressions": null + }, + { + "severity": "LOW", + "confidence": "HIGH", + "cwe": { + "id": "703", + "url": "https://cwe.mitre.org/data/definitions/703.html" + }, + "rule_id": "G104", + "details": "Errors unhandled", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom.eu/hub/internal/notify/dispatcher.go", + "code": "374: \t\td.logger.Printf(\"[ERROR] Customer recovery email failed for %s/%s: %v\", customerID, eventType, err)\n375: \t\td.store.LogNotification(customerID, eventType, severity, message, \"failed\", err.Error(), \"customer\")\n376: \t\treturn\n", + "line": "375", + "column": "3", + "nosec": false, + "suppressions": null + }, + { + "severity": "LOW", + "confidence": "HIGH", + "cwe": { + "id": "703", + "url": "https://cwe.mitre.org/data/definitions/703.html" + }, + "rule_id": "G104", + "details": "Errors unhandled", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom.eu/hub/internal/notify/dispatcher.go", + "code": "370: \t\td.forgetCustomerCooldown(cooldownKey)\n371: \t\td.store.LogNotification(customerID, eventType, severity, message, \"held\", \"MAIL-HOLD marker present — dropped\", \"customer\")\n372: \t\treturn\n", + "line": "371", + "column": "3", + "nosec": false, + "suppressions": null + }, + { + "severity": "LOW", + "confidence": "HIGH", + "cwe": { + "id": "703", + "url": "https://cwe.mitre.org/data/definitions/703.html" + }, + "rule_id": "G104", + "details": "Errors unhandled", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom.eu/hub/internal/notify/dispatcher.go", + "code": "312: \td.logger.Printf(\"[INFO] Operator test email sent for %s\", customerID)\n313: \td.store.LogNotification(customerID, \"test\", \"info\", \"operator test copy\", \"sent\", \"\", \"operator\")\n314: }\n", + "line": "313", + "column": "2", + "nosec": false, + "suppressions": null + }, + { + "severity": "LOW", + "confidence": "HIGH", + "cwe": { + "id": "703", + "url": "https://cwe.mitre.org/data/definitions/703.html" + }, + "rule_id": "G104", + "details": "Errors unhandled", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom.eu/hub/internal/notify/dispatcher.go", + "code": "308: \t\td.logger.Printf(\"[ERROR] Operator test email failed for %s: %v\", customerID, err)\n309: \t\td.store.LogNotification(customerID, \"test\", \"info\", \"operator test copy\", \"failed\", err.Error(), \"operator\")\n310: \t\treturn\n", + "line": "309", + "column": "3", + "nosec": false, + "suppressions": null + }, + { + "severity": "LOW", + "confidence": "HIGH", + "cwe": { + "id": "703", + "url": "https://cwe.mitre.org/data/definitions/703.html" + }, + "rule_id": "G104", + "details": "Errors unhandled", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom.eu/hub/internal/notify/dispatcher.go", + "code": "304: \tif err := d.deliver(\"operator test mail\", \"operator\", d.operatorEmail, opSubject, opBody, priorityHeaders(\"critical\")); isHeld(err) {\n305: \t\td.store.LogNotification(customerID, \"test\", \"info\", \"operator test copy\", \"held\", \"MAIL-HOLD marker present — dropped\", \"operator\")\n306: \t\treturn\n", + "line": "305", + "column": "3", + "nosec": false, + "suppressions": null + }, + { + "severity": "LOW", + "confidence": "HIGH", + "cwe": { + "id": "703", + "url": "https://cwe.mitre.org/data/definitions/703.html" + }, + "rule_id": "G104", + "details": "Errors unhandled", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom.eu/hub/internal/notify/dispatcher.go", + "code": "286: \t\t\td.logger.Printf(\"[INFO] Test email sent to %s for %s\", prefs.Email, customerID)\n287: \t\t\td.store.LogNotification(customerID, \"test\", \"info\", \"Teszt értesítés\", \"sent\", \"\", \"customer\")\n288: \t\t}\n", + "line": "287", + "column": "4", + "nosec": false, + "suppressions": null + }, + { + "severity": "LOW", + "confidence": "HIGH", + "cwe": { + "id": "703", + "url": "https://cwe.mitre.org/data/definitions/703.html" + }, + "rule_id": "G104", + "details": "Errors unhandled", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom.eu/hub/internal/notify/dispatcher.go", + "code": "283: \t\t\td.logger.Printf(\"[ERROR] Test email to %s failed: %v\", prefs.Email, err)\n284: \t\t\td.store.LogNotification(customerID, \"test\", \"info\", \"Teszt értesítés\", \"failed\", err.Error(), \"customer\")\n285: \t\t} else {\n", + "line": "284", + "column": "4", + "nosec": false, + "suppressions": null + }, + { + "severity": "LOW", + "confidence": "HIGH", + "cwe": { + "id": "703", + "url": "https://cwe.mitre.org/data/definitions/703.html" + }, + "rule_id": "G104", + "details": "Errors unhandled", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom.eu/hub/internal/notify/dispatcher.go", + "code": "280: \t\tif err := d.deliver(\"test mail\", customerID, prefs.Email, subject, body, nil); isHeld(err) {\n281: \t\t\td.store.LogNotification(customerID, \"test\", \"info\", \"Teszt értesítés\", \"held\", \"MAIL-HOLD marker present — dropped\", \"customer\")\n282: \t\t} else if err != nil {\n", + "line": "281", + "column": "4", + "nosec": false, + "suppressions": null + }, + { + "severity": "LOW", + "confidence": "HIGH", + "cwe": { + "id": "703", + "url": "https://cwe.mitre.org/data/definitions/703.html" + }, + "rule_id": "G104", + "details": "Errors unhandled", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom.eu/hub/internal/notify/dispatcher.go", + "code": "117: \t\td.logger.Printf(\"[INFO] Operator email sent for %s/%s after retry %d\", customerID, eventType, n)\n118: \t\td.store.LogNotification(customerID, eventType, severity, message, \"sent\", fmt.Sprintf(\"after retry %d\", n), \"operator\")\n119: \t})\n", + "line": "118", + "column": "3", + "nosec": false, + "suppressions": null + }, + { + "severity": "LOW", + "confidence": "HIGH", + "cwe": { + "id": "703", + "url": "https://cwe.mitre.org/data/definitions/703.html" + }, + "rule_id": "G104", + "details": "Errors unhandled", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom.eu/hub/internal/notify/dispatcher.go", + "code": "112: \t\t\td.logger.Printf(\"[ERROR] Operator email retry %d failed for %s/%s: %v\", n, customerID, eventType, err)\n113: \t\t\td.store.LogNotification(customerID, eventType, severity, message, \"failed\", fmt.Sprintf(\"retry %d: %v\", n, err), \"operator\")\n114: \t\t\td.retryOperatorEmail(customerID, eventType, severity, message, subject, body, headers, n)\n", + "line": "113", + "column": "4", + "nosec": false, + "suppressions": null + }, + { + "severity": "LOW", + "confidence": "HIGH", + "cwe": { + "id": "703", + "url": "https://cwe.mitre.org/data/definitions/703.html" + }, + "rule_id": "G104", + "details": "Errors unhandled", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom.eu/hub/internal/notify/dispatcher.go", + "code": "108: \t\t\t\t// The hold began between tries: the mail is dropped like every other held mail, and the retries stop.\n109: \t\t\t\td.store.LogNotification(customerID, eventType, severity, message, \"held\", \"MAIL-HOLD marker present — dropped\", \"operator\")\n110: \t\t\t\treturn\n", + "line": "109", + "column": "5", + "nosec": false, + "suppressions": null + }, + { + "severity": "LOW", + "confidence": "HIGH", + "cwe": { + "id": "703", + "url": "https://cwe.mitre.org/data/definitions/703.html" + }, + "rule_id": "G104", + "details": "Errors unhandled", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom.eu/hub/internal/mailrelay/relay.go", + "code": "90: \tif _, err := wc.Write(raw); err != nil {\n91: \t\twc.Close()\n92: \t\treturn fmt.Errorf(\"writing message: %w\", err)\n", + "line": "91", + "column": "3", + "nosec": false, + "suppressions": null + }, + { + "severity": "LOW", + "confidence": "HIGH", + "cwe": { + "id": "703", + "url": "https://cwe.mitre.org/data/definitions/703.html" + }, + "rule_id": "G104", + "details": "Errors unhandled", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom.eu/hub/internal/mailrelay/relay.go", + "code": "60: \tif err != nil {\n61: \t\tconn.Close()\n62: \t\treturn fmt.Errorf(\"smtp client: %w\", err)\n", + "line": "61", + "column": "3", + "nosec": false, + "suppressions": null + }, + { + "severity": "LOW", + "confidence": "HIGH", + "cwe": { + "id": "703", + "url": "https://cwe.mitre.org/data/definitions/703.html" + }, + "rule_id": "G104", + "details": "Errors unhandled", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom.eu/hub/internal/assets/assets.go", + "code": "277: \tif err := out.Close(); err != nil {\n278: \t\tos.Remove(tmp)\n279: \t\treturn err\n", + "line": "278", + "column": "3", + "nosec": false, + "suppressions": null + }, + { + "severity": "LOW", + "confidence": "HIGH", + "cwe": { + "id": "703", + "url": "https://cwe.mitre.org/data/definitions/703.html" + }, + "rule_id": "G104", + "details": "Errors unhandled", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom.eu/hub/internal/assets/assets.go", + "code": "273: \t\tout.Close()\n274: \t\tos.Remove(tmp)\n275: \t\treturn err\n", + "line": "274", + "column": "3", + "nosec": false, + "suppressions": null + }, + { + "severity": "LOW", + "confidence": "HIGH", + "cwe": { + "id": "703", + "url": "https://cwe.mitre.org/data/definitions/703.html" + }, + "rule_id": "G104", + "details": "Errors unhandled", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom.eu/hub/internal/assets/assets.go", + "code": "272: \tif _, err := io.Copy(out, in); err != nil {\n273: \t\tout.Close()\n274: \t\tos.Remove(tmp)\n", + "line": "273", + "column": "3", + "nosec": false, + "suppressions": null + }, + { + "severity": "LOW", + "confidence": "HIGH", + "cwe": { + "id": "703", + "url": "https://cwe.mitre.org/data/definitions/703.html" + }, + "rule_id": "G104", + "details": "Errors unhandled", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom.eu/hub/internal/api/wg.go", + "code": "537: \tw.Header().Set(\"Content-Type\", \"application/json\")\n538: \tjson.NewEncoder(w).Encode(map[string]interface{}{\n539: \t\t\"pubkey\": op.Pubkey, \"assigned_ip\": op.AssignedIP + \"/32\",\n540: \t})\n541: }\n", + "line": "538-540", + "column": "2", + "nosec": false, + "suppressions": null + }, + { + "severity": "LOW", + "confidence": "HIGH", + "cwe": { + "id": "703", + "url": "https://cwe.mitre.org/data/definitions/703.html" + }, + "rule_id": "G104", + "details": "Errors unhandled", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom.eu/hub/internal/api/wg.go", + "code": "513: \tw.WriteHeader(http.StatusOK)\n514: \tjson.NewEncoder(w).Encode(map[string]interface{}{\n515: \t\t\"pubkey\": req.Pubkey, \"assigned_ip\": req.AssignedIP + \"/32\", \"sync\": syncStatus, \"hosts_bumped\": bumped,\n516: \t})\n517: }\n", + "line": "514-516", + "column": "2", + "nosec": false, + "suppressions": null + }, + { + "severity": "LOW", + "confidence": "HIGH", + "cwe": { + "id": "703", + "url": "https://cwe.mitre.org/data/definitions/703.html" + }, + "rule_id": "G104", + "details": "Errors unhandled", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom.eu/hub/internal/api/wg.go", + "code": "454: \tw.Header().Set(\"Content-Type\", \"application/json\")\n455: \tjson.NewEncoder(w).Encode(map[string]interface{}{\"peers\": out})\n456: }\n", + "line": "455", + "column": "2", + "nosec": false, + "suppressions": null + }, + { + "severity": "LOW", + "confidence": "HIGH", + "cwe": { + "id": "703", + "url": "https://cwe.mitre.org/data/definitions/703.html" + }, + "rule_id": "G104", + "details": "Errors unhandled", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom.eu/hub/internal/api/wg.go", + "code": "431: \tw.WriteHeader(http.StatusOK)\n432: \tjson.NewEncoder(w).Encode(map[string]interface{}{\"status\": \"ok\", \"sync\": syncStatus})\n433: }\n", + "line": "432", + "column": "2", + "nosec": false, + "suppressions": null + }, + { + "severity": "LOW", + "confidence": "HIGH", + "cwe": { + "id": "703", + "url": "https://cwe.mitre.org/data/definitions/703.html" + }, + "rule_id": "G104", + "details": "Errors unhandled", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom.eu/hub/internal/api/wg.go", + "code": "309: \tw.WriteHeader(http.StatusOK)\n310: \tjson.NewEncoder(w).Encode(map[string]interface{}{\n311: \t\t\"pubkey\": req.Pubkey, \"assigned_ip\": ip + \"/32\", \"existed\": !changed,\n312: \t\t\"generation\": gen, \"sync\": syncStatus,\n313: \t})\n314: }\n", + "line": "310-313", + "column": "2", + "nosec": false, + "suppressions": null + }, + { + "severity": "LOW", + "confidence": "HIGH", + "cwe": { + "id": "703", + "url": "https://cwe.mitre.org/data/definitions/703.html" + }, + "rule_id": "G104", + "details": "Errors unhandled", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom.eu/hub/internal/api/wg.go", + "code": "219: \tw.WriteHeader(http.StatusOK)\n220: \tjson.NewEncoder(w).Encode(map[string]interface{}{\n221: \t\t\"pubkey\": req.Pubkey, \"assigned_ip\": ip + \"/32\", \"existed\": existed, \"sync\": syncStatus,\n222: \t})\n223: }\n", + "line": "220-222", + "column": "2", + "nosec": false, + "suppressions": null + }, + { + "severity": "LOW", + "confidence": "HIGH", + "cwe": { + "id": "703", + "url": "https://cwe.mitre.org/data/definitions/703.html" + }, + "rule_id": "G104", + "details": "Errors unhandled", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom.eu/hub/internal/api/wg.go", + "code": "169: \tw.Header().Set(\"Content-Type\", \"application/json\")\n170: \tjson.NewEncoder(w).Encode(map[string]interface{}{\n171: \t\t\"endpoint_id\": e.EndpointID, \"dns_name\": e.DNSName, \"wg_port\": e.WGPort,\n172: \t\t\"server_pubkey\": e.ServerPubkey, \"tunnel_subnet\": e.TunnelSubnet, \"pbs_tunnel_ip\": e.PBSTunnelIP,\n173: \t})\n174: }\n", + "line": "170-173", + "column": "2", + "nosec": false, + "suppressions": null + }, + { + "severity": "LOW", + "confidence": "HIGH", + "cwe": { + "id": "703", + "url": "https://cwe.mitre.org/data/definitions/703.html" + }, + "rule_id": "G104", + "details": "Errors unhandled", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom.eu/hub/internal/api/wg.go", + "code": "148: \tw.WriteHeader(http.StatusOK)\n149: \tw.Write([]byte(`{\"status\":\"ok\"}`))\n150: }\n", + "line": "149", + "column": "2", + "nosec": false, + "suppressions": null + }, + { + "severity": "LOW", + "confidence": "HIGH", + "cwe": { + "id": "703", + "url": "https://cwe.mitre.org/data/definitions/703.html" + }, + "rule_id": "G104", + "details": "Errors unhandled", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom.eu/hub/internal/api/pbsdr.go", + "code": "45: \tw.WriteHeader(http.StatusOK)\n46: \tjson.NewEncoder(w).Encode(map[string]string{\"token_secret\": secret})\n47: }\n", + "line": "46", + "column": "2", + "nosec": false, + "suppressions": null + }, + { + "severity": "LOW", + "confidence": "HIGH", + "cwe": { + "id": "703", + "url": "https://cwe.mitre.org/data/definitions/703.html" + }, + "rule_id": "G104", + "details": "Errors unhandled", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom.eu/hub/internal/api/mail.go", + "code": "170: \tw.WriteHeader(http.StatusOK)\n171: \tw.Write([]byte(`{\"status\":\"ok\"}`))\n172: }\n", + "line": "171", + "column": "2", + "nosec": false, + "suppressions": null + }, + { + "severity": "LOW", + "confidence": "HIGH", + "cwe": { + "id": "703", + "url": "https://cwe.mitre.org/data/definitions/703.html" + }, + "rule_id": "G104", + "details": "Errors unhandled", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom.eu/hub/internal/api/handler.go", + "code": "3004: \tw.Header().Set(\"Content-Type\", \"application/json\")\n3005: \tw.Write(data)\n3006: }\n", + "line": "3005", + "column": "2", + "nosec": false, + "suppressions": null + }, + { + "severity": "LOW", + "confidence": "HIGH", + "cwe": { + "id": "703", + "url": "https://cwe.mitre.org/data/definitions/703.html" + }, + "rule_id": "G104", + "details": "Errors unhandled", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom.eu/hub/internal/api/handler.go", + "code": "2904: \tw.WriteHeader(http.StatusOK)\n2905: \tjson.NewEncoder(w).Encode(resp)\n2906: }\n", + "line": "2905", + "column": "2", + "nosec": false, + "suppressions": null + }, + { + "severity": "LOW", + "confidence": "HIGH", + "cwe": { + "id": "703", + "url": "https://cwe.mitre.org/data/definitions/703.html" + }, + "rule_id": "G104", + "details": "Errors unhandled", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom.eu/hub/internal/api/handler.go", + "code": "2835: \tw.Header().Set(\"Content-Type\", \"text/yaml; charset=utf-8\")\n2836: \tw.Write([]byte(yamlOutput))\n2837: }\n", + "line": "2836", + "column": "2", + "nosec": false, + "suppressions": null + }, + { + "severity": "LOW", + "confidence": "HIGH", + "cwe": { + "id": "703", + "url": "https://cwe.mitre.org/data/definitions/703.html" + }, + "rule_id": "G104", + "details": "Errors unhandled", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom.eu/hub/internal/api/handler.go", + "code": "2766: \tw.Header().Set(\"Content-Type\", \"application/json\")\n2767: \tjson.NewEncoder(w).Encode(resp)\n2768: }\n", + "line": "2767", + "column": "2", + "nosec": false, + "suppressions": null + }, + { + "severity": "LOW", + "confidence": "HIGH", + "cwe": { + "id": "703", + "url": "https://cwe.mitre.org/data/definitions/703.html" + }, + "rule_id": "G104", + "details": "Errors unhandled", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom.eu/hub/internal/api/handler.go", + "code": "2689: \tw.WriteHeader(http.StatusOK)\n2690: \tw.Write([]byte(`{\"status\":\"ok\"}`))\n2691: }\n", + "line": "2690", + "column": "2", + "nosec": false, + "suppressions": null + }, + { + "severity": "LOW", + "confidence": "HIGH", + "cwe": { + "id": "703", + "url": "https://cwe.mitre.org/data/definitions/703.html" + }, + "rule_id": "G104", + "details": "Errors unhandled", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom.eu/hub/internal/api/handler.go", + "code": "2622: \tw.WriteHeader(http.StatusOK)\n2623: \tw.Write([]byte(`{\"status\":\"ok\",\"sent\":true}`))\n2624: }\n", + "line": "2623", + "column": "2", + "nosec": false, + "suppressions": null + }, + { + "severity": "LOW", + "confidence": "HIGH", + "cwe": { + "id": "703", + "url": "https://cwe.mitre.org/data/definitions/703.html" + }, + "rule_id": "G104", + "details": "Errors unhandled", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom.eu/hub/internal/api/handler.go", + "code": "2619: \th.logger.Printf(\"[INFO] Notification email sent to %s for %s/%s\", prefs.Email, payload.CustomerID, payload.EventType)\n2620: \th.store.LogNotification(payload.CustomerID, payload.EventType, payload.Severity, payload.Message, \"sent\", \"\", \"customer\")\n2621: \n", + "line": "2620", + "column": "2", + "nosec": false, + "suppressions": null + }, + { + "severity": "LOW", + "confidence": "HIGH", + "cwe": { + "id": "703", + "url": "https://cwe.mitre.org/data/definitions/703.html" + }, + "rule_id": "G104", + "details": "Errors unhandled", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom.eu/hub/internal/api/handler.go", + "code": "2613: \t\th.logger.Printf(\"[ERROR] Failed to send notification email to %s: %v\", prefs.Email, sendErr)\n2614: \t\th.store.LogNotification(payload.CustomerID, payload.EventType, payload.Severity, payload.Message, \"failed\", sendErr.Error(), \"customer\")\n2615: \t\thttp.Error(w, \"Failed to send email\", http.StatusInternalServerError)\n", + "line": "2614", + "column": "3", + "nosec": false, + "suppressions": null + }, + { + "severity": "LOW", + "confidence": "HIGH", + "cwe": { + "id": "703", + "url": "https://cwe.mitre.org/data/definitions/703.html" + }, + "rule_id": "G104", + "details": "Errors unhandled", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom.eu/hub/internal/api/handler.go", + "code": "2605: \t\tw.WriteHeader(http.StatusOK)\n2606: \t\tw.Write([]byte(`{\"status\":\"ok\",\"sent\":false,\"reason\":\"mail_hold\"}`))\n2607: \t\treturn\n", + "line": "2606", + "column": "3", + "nosec": false, + "suppressions": null + }, + { + "severity": "LOW", + "confidence": "HIGH", + "cwe": { + "id": "703", + "url": "https://cwe.mitre.org/data/definitions/703.html" + }, + "rule_id": "G104", + "details": "Errors unhandled", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom.eu/hub/internal/api/handler.go", + "code": "2603: \tif err := h.mailHold.Check(\"customer event \"+payload.EventType, payload.CustomerID); err != nil {\n2604: \t\th.store.LogNotification(payload.CustomerID, payload.EventType, payload.Severity, payload.Message, \"held\", \"MAIL-HOLD marker present — dropped\", \"customer\")\n2605: \t\tw.WriteHeader(http.StatusOK)\n", + "line": "2604", + "column": "3", + "nosec": false, + "suppressions": null + }, + { + "severity": "LOW", + "confidence": "HIGH", + "cwe": { + "id": "703", + "url": "https://cwe.mitre.org/data/definitions/703.html" + }, + "rule_id": "G104", + "details": "Errors unhandled", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom.eu/hub/internal/api/handler.go", + "code": "2597: \t\tw.WriteHeader(http.StatusOK)\n2598: \t\tw.Write([]byte(`{\"status\":\"ok\",\"sent\":false,\"reason\":\"no_api_key\"}`))\n2599: \t\treturn\n", + "line": "2598", + "column": "3", + "nosec": false, + "suppressions": null + }, + { + "severity": "LOW", + "confidence": "HIGH", + "cwe": { + "id": "703", + "url": "https://cwe.mitre.org/data/definitions/703.html" + }, + "rule_id": "G104", + "details": "Errors unhandled", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom.eu/hub/internal/api/handler.go", + "code": "2595: \t\th.logger.Printf(\"[WARN] Resend API key not configured, cannot send notification email\")\n2596: \t\th.store.LogNotification(payload.CustomerID, payload.EventType, payload.Severity, payload.Message, \"skipped\", \"resend api key not configured\", \"customer\")\n2597: \t\tw.WriteHeader(http.StatusOK)\n", + "line": "2596", + "column": "3", + "nosec": false, + "suppressions": null + }, + { + "severity": "LOW", + "confidence": "HIGH", + "cwe": { + "id": "703", + "url": "https://cwe.mitre.org/data/definitions/703.html" + }, + "rule_id": "G104", + "details": "Errors unhandled", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom.eu/hub/internal/api/handler.go", + "code": "2588: \t\tw.WriteHeader(http.StatusOK)\n2589: \t\tw.Write([]byte(`{\"status\":\"ok\",\"sent\":false,\"reason\":\"event_disabled\"}`))\n2590: \t\treturn\n", + "line": "2589", + "column": "3", + "nosec": false, + "suppressions": null + }, + { + "severity": "LOW", + "confidence": "HIGH", + "cwe": { + "id": "703", + "url": "https://cwe.mitre.org/data/definitions/703.html" + }, + "rule_id": "G104", + "details": "Errors unhandled", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom.eu/hub/internal/api/handler.go", + "code": "2586: \t\th.logger.Printf(\"[INFO] Event %s not enabled for %s, skipping\", payload.EventType, payload.CustomerID)\n2587: \t\th.store.LogNotification(payload.CustomerID, payload.EventType, payload.Severity, payload.Message, \"skipped\", \"event not enabled\", \"customer\")\n2588: \t\tw.WriteHeader(http.StatusOK)\n", + "line": "2587", + "column": "3", + "nosec": false, + "suppressions": null + }, + { + "severity": "LOW", + "confidence": "HIGH", + "cwe": { + "id": "703", + "url": "https://cwe.mitre.org/data/definitions/703.html" + }, + "rule_id": "G104", + "details": "Errors unhandled", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom.eu/hub/internal/api/handler.go", + "code": "2572: \t\tw.WriteHeader(http.StatusOK)\n2573: \t\tw.Write([]byte(`{\"status\":\"ok\",\"sent\":false,\"reason\":\"no_email\"}`))\n2574: \t\treturn\n", + "line": "2573", + "column": "3", + "nosec": false, + "suppressions": null + }, + { + "severity": "LOW", + "confidence": "HIGH", + "cwe": { + "id": "703", + "url": "https://cwe.mitre.org/data/definitions/703.html" + }, + "rule_id": "G104", + "details": "Errors unhandled", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom.eu/hub/internal/api/handler.go", + "code": "2570: \t\th.logger.Printf(\"[INFO] No email configured for %s, skipping notification\", payload.CustomerID)\n2571: \t\th.store.LogNotification(payload.CustomerID, payload.EventType, payload.Severity, payload.Message, \"skipped\", \"no email configured\", \"customer\")\n2572: \t\tw.WriteHeader(http.StatusOK)\n", + "line": "2571", + "column": "3", + "nosec": false, + "suppressions": null + }, + { + "severity": "LOW", + "confidence": "HIGH", + "cwe": { + "id": "703", + "url": "https://cwe.mitre.org/data/definitions/703.html" + }, + "rule_id": "G104", + "details": "Errors unhandled", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom.eu/hub/internal/api/handler.go", + "code": "2555: \t\tw.WriteHeader(http.StatusOK)\n2556: \t\tw.Write([]byte(`{\"status\":\"ok\",\"sent\":false,\"reason\":\"blocked\"}`))\n2557: \t\treturn\n", + "line": "2556", + "column": "3", + "nosec": false, + "suppressions": null + }, + { + "severity": "LOW", + "confidence": "HIGH", + "cwe": { + "id": "703", + "url": "https://cwe.mitre.org/data/definitions/703.html" + }, + "rule_id": "G104", + "details": "Errors unhandled", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom.eu/hub/internal/api/handler.go", + "code": "2553: \t\th.logger.Printf(\"[INFO] Notification suppressed for blocked customer %s\", payload.CustomerID)\n2554: \t\th.store.LogNotification(payload.CustomerID, payload.EventType, payload.Severity, payload.Message, \"skipped\", \"customer blocked\", \"customer\")\n2555: \t\tw.WriteHeader(http.StatusOK)\n", + "line": "2554", + "column": "3", + "nosec": false, + "suppressions": null + }, + { + "severity": "LOW", + "confidence": "HIGH", + "cwe": { + "id": "703", + "url": "https://cwe.mitre.org/data/definitions/703.html" + }, + "rule_id": "G104", + "details": "Errors unhandled", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom.eu/hub/internal/api/handler.go", + "code": "2513: \tw.Header().Set(\"Content-Type\", \"application/json\")\n2514: \tjson.NewEncoder(w).Encode(result)\n2515: }\n", + "line": "2514", + "column": "2", + "nosec": false, + "suppressions": null + }, + { + "severity": "LOW", + "confidence": "HIGH", + "cwe": { + "id": "703", + "url": "https://cwe.mitre.org/data/definitions/703.html" + }, + "rule_id": "G104", + "details": "Errors unhandled", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom.eu/hub/internal/api/handler.go", + "code": "2473: \t// Return the full report JSON directly\n2474: \tw.Write([]byte(customer.ReportJSON))\n2475: }\n", + "line": "2474", + "column": "2", + "nosec": false, + "suppressions": null + }, + { + "severity": "LOW", + "confidence": "HIGH", + "cwe": { + "id": "703", + "url": "https://cwe.mitre.org/data/definitions/703.html" + }, + "rule_id": "G104", + "details": "Errors unhandled", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom.eu/hub/internal/api/handler.go", + "code": "2456: \tw.Header().Set(\"Content-Type\", \"application/json\")\n2457: \tjson.NewEncoder(w).Encode(result)\n2458: }\n", + "line": "2457", + "column": "2", + "nosec": false, + "suppressions": null + }, + { + "severity": "LOW", + "confidence": "HIGH", + "cwe": { + "id": "703", + "url": "https://cwe.mitre.org/data/definitions/703.html" + }, + "rule_id": "G104", + "details": "Errors unhandled", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom.eu/hub/internal/api/handler.go", + "code": "2413: \tw.WriteHeader(http.StatusOK)\n2414: \tw.Write([]byte(`{\"ok\":true}`))\n2415: }\n", + "line": "2414", + "column": "2", + "nosec": false, + "suppressions": null + }, + { + "severity": "LOW", + "confidence": "HIGH", + "cwe": { + "id": "703", + "url": "https://cwe.mitre.org/data/definitions/703.html" + }, + "rule_id": "G104", + "details": "Errors unhandled", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom.eu/hub/internal/api/handler.go", + "code": "2104: \tw.WriteHeader(http.StatusOK)\n2105: \tjson.NewEncoder(w).Encode(resp)\n2106: }\n", + "line": "2105", + "column": "2", + "nosec": false, + "suppressions": null + }, + { + "severity": "LOW", + "confidence": "HIGH", + "cwe": { + "id": "703", + "url": "https://cwe.mitre.org/data/definitions/703.html" + }, + "rule_id": "G104", + "details": "Errors unhandled", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom.eu/hub/internal/api/handler.go", + "code": "2044: \tw.WriteHeader(http.StatusCreated)\n2045: \tjson.NewEncoder(w).Encode(map[string]interface{}{\"status\": \"ok\", \"job_id\": req.JobID})\n2046: }\n", + "line": "2045", + "column": "2", + "nosec": false, + "suppressions": null + }, + { + "severity": "LOW", + "confidence": "HIGH", + "cwe": { + "id": "703", + "url": "https://cwe.mitre.org/data/definitions/703.html" + }, + "rule_id": "G104", + "details": "Errors unhandled", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom.eu/hub/internal/api/handler.go", + "code": "1993: \tw.WriteHeader(http.StatusOK)\n1994: \tjson.NewEncoder(w).Encode(map[string]interface{}{\"status\": \"ok\", \"generation\": gen})\n1995: }\n", + "line": "1994", + "column": "2", + "nosec": false, + "suppressions": null + }, + { + "severity": "LOW", + "confidence": "HIGH", + "cwe": { + "id": "703", + "url": "https://cwe.mitre.org/data/definitions/703.html" + }, + "rule_id": "G104", + "details": "Errors unhandled", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom.eu/hub/internal/api/handler.go", + "code": "1939: \tw.WriteHeader(http.StatusOK)\n1940: \tw.Write([]byte(`{\"status\":\"ok\"}`))\n1941: }\n", + "line": "1940", + "column": "2", + "nosec": false, + "suppressions": null + }, + { + "severity": "LOW", + "confidence": "HIGH", + "cwe": { + "id": "703", + "url": "https://cwe.mitre.org/data/definitions/703.html" + }, + "rule_id": "G104", + "details": "Errors unhandled", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom.eu/hub/internal/api/handler.go", + "code": "1912: \tw.WriteHeader(http.StatusOK)\n1913: \tjson.NewEncoder(w).Encode(map[string]interface{}{\"jobs\": out})\n1914: }\n", + "line": "1913", + "column": "2", + "nosec": false, + "suppressions": null + }, + { + "severity": "LOW", + "confidence": "HIGH", + "cwe": { + "id": "703", + "url": "https://cwe.mitre.org/data/definitions/703.html" + }, + "rule_id": "G104", + "details": "Errors unhandled", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom.eu/hub/internal/api/handler.go", + "code": "1876: \tw.WriteHeader(http.StatusOK)\n1877: \tjson.NewEncoder(w).Encode(resp)\n1878: }\n", + "line": "1877", + "column": "2", + "nosec": false, + "suppressions": null + }, + { + "severity": "LOW", + "confidence": "HIGH", + "cwe": { + "id": "703", + "url": "https://cwe.mitre.org/data/definitions/703.html" + }, + "rule_id": "G104", + "details": "Errors unhandled", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom.eu/hub/internal/api/handler.go", + "code": "1831: \tw.WriteHeader(http.StatusOK)\n1832: \tw.Write(resp)\n1833: }\n", + "line": "1832", + "column": "2", + "nosec": false, + "suppressions": null + }, + { + "severity": "LOW", + "confidence": "HIGH", + "cwe": { + "id": "703", + "url": "https://cwe.mitre.org/data/definitions/703.html" + }, + "rule_id": "G104", + "details": "Errors unhandled", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom.eu/hub/internal/api/handler.go", + "code": "1795: \tw.WriteHeader(http.StatusOK)\n1796: \tw.Write([]byte(`{\"status\":\"ok\"}`))\n1797: }\n", + "line": "1796", + "column": "2", + "nosec": false, + "suppressions": null + }, + { + "severity": "LOW", + "confidence": "HIGH", + "cwe": { + "id": "703", + "url": "https://cwe.mitre.org/data/definitions/703.html" + }, + "rule_id": "G104", + "details": "Errors unhandled", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom.eu/hub/internal/api/handler.go", + "code": "1353: \tw.WriteHeader(http.StatusOK)\n1354: \tw.Write([]byte(`{\"status\":\"ok\"}`))\n1355: }\n", + "line": "1354", + "column": "2", + "nosec": false, + "suppressions": null + }, + { + "severity": "LOW", + "confidence": "HIGH", + "cwe": { + "id": "703", + "url": "https://cwe.mitre.org/data/definitions/703.html" + }, + "rule_id": "G104", + "details": "Errors unhandled", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom.eu/hub/internal/api/handler.go", + "code": "1212: \tw.WriteHeader(http.StatusCreated)\n1213: \tjson.NewEncoder(w).Encode(map[string]string{\"host_id\": hostID, \"api_key\": apiKey})\n1214: }\n", + "line": "1213", + "column": "2", + "nosec": false, + "suppressions": null + }, + { + "severity": "LOW", + "confidence": "HIGH", + "cwe": { + "id": "703", + "url": "https://cwe.mitre.org/data/definitions/703.html" + }, + "rule_id": "G104", + "details": "Errors unhandled", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom.eu/hub/internal/api/handler.go", + "code": "1178: \t\tw.WriteHeader(http.StatusOK)\n1179: \t\tjson.NewEncoder(w).Encode(map[string]string{\"host_id\": existing.HostID, \"api_key\": existing.APIKey})\n1180: \t\treturn\n", + "line": "1179", + "column": "3", + "nosec": false, + "suppressions": null + }, + { + "severity": "LOW", + "confidence": "HIGH", + "cwe": { + "id": "703", + "url": "https://cwe.mitre.org/data/definitions/703.html" + }, + "rule_id": "G104", + "details": "Errors unhandled", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom.eu/hub/internal/api/handler.go", + "code": "1108: \tw.WriteHeader(http.StatusCreated)\n1109: \tjson.NewEncoder(w).Encode(map[string]string{\"host_id\": hostID, \"api_key\": apiKey})\n1110: }\n", + "line": "1109", + "column": "2", + "nosec": false, + "suppressions": null + }, + { + "severity": "LOW", + "confidence": "HIGH", + "cwe": { + "id": "703", + "url": "https://cwe.mitre.org/data/definitions/703.html" + }, + "rule_id": "G104", + "details": "Errors unhandled", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom.eu/hub/internal/api/handler.go", + "code": "1047: \tw.WriteHeader(http.StatusOK)\n1048: \tjson.NewEncoder(w).Encode(resp)\n1049: }\n", + "line": "1048", + "column": "2", + "nosec": false, + "suppressions": null + }, + { + "severity": "LOW", + "confidence": "HIGH", + "cwe": { + "id": "703", + "url": "https://cwe.mitre.org/data/definitions/703.html" + }, + "rule_id": "G104", + "details": "Errors unhandled", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom.eu/hub/internal/api/handler.go", + "code": "674: \tw.WriteHeader(http.StatusOK)\n675: \tjson.NewEncoder(w).Encode(resp)\n676: }\n", + "line": "675", + "column": "2", + "nosec": false, + "suppressions": null + }, + { + "severity": "LOW", + "confidence": "HIGH", + "cwe": { + "id": "703", + "url": "https://cwe.mitre.org/data/definitions/703.html" + }, + "rule_id": "G104", + "details": "Errors unhandled", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom.eu/hub/internal/api/dr.go", + "code": "143: \tw.WriteHeader(http.StatusOK)\n144: \tjson.NewEncoder(w).Encode(map[string]any{\n145: \t\t\"host_id\": hostID, \"api_key_rotated\": true, \"new_api_key\": req.NewAPIKey,\n146: \t\t\"directive\": resp.Directive, \"k_escrow_b64\": resp.KEscrowB64, \"identity_escrow_b64\": resp.IdentityEscrowB64,\n147: \t})\n148: }\n", + "line": "144-147", + "column": "2", + "nosec": false, + "suppressions": null + }, + { + "severity": "LOW", + "confidence": "HIGH", + "cwe": { + "id": "703", + "url": "https://cwe.mitre.org/data/definitions/703.html" + }, + "rule_id": "G104", + "details": "Errors unhandled", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom.eu/hub/internal/api/dr.go", + "code": "46: \t}\n47: \tjson.Unmarshal(body, \u0026req)\n48: \tttl := defaultRecoveryTTL\n", + "line": "47", + "column": "2", + "nosec": false, + "suppressions": null + }, + { + "severity": "LOW", + "confidence": "HIGH", + "cwe": { + "id": "703", + "url": "https://cwe.mitre.org/data/definitions/703.html" + }, + "rule_id": "G104", + "details": "Errors unhandled", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom.eu/hub/internal/api/dr.go", + "code": "27: \tw.WriteHeader(code)\n28: \tjson.NewEncoder(w).Encode(v)\n29: }\n", + "line": "28", + "column": "2", + "nosec": false, + "suppressions": null + }, + { + "severity": "LOW", + "confidence": "HIGH", + "cwe": { + "id": "703", + "url": "https://cwe.mitre.org/data/definitions/703.html" + }, + "rule_id": "G104", + "details": "Errors unhandled", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom.eu/hub/internal/api/appliance.go", + "code": "227: \t\tw.WriteHeader(http.StatusOK)\n228: \t\tjson.NewEncoder(w).Encode(map[string]string{\n229: \t\t\t\"customer_id\": appl.CustomerID,\n230: \t\t\t\"retrieval_passphrase\": cc.RetrievalPassword,\n231: \t\t\t\"mode\": mode,\n232: \t\t\t\"extra_args\": appl.ExtraArgs,\n233: \t\t})\n234: \t\treturn\n", + "line": "228-233", + "column": "3", + "nosec": false, + "suppressions": null + }, + { + "severity": "LOW", + "confidence": "HIGH", + "cwe": { + "id": "703", + "url": "https://cwe.mitre.org/data/definitions/703.html" + }, + "rule_id": "G104", + "details": "Errors unhandled", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom.eu/hub/internal/api/appliance.go", + "code": "164: \t// pairing_code is additive — a pre-v0.66.0 bootstrap ignores it and stays operator-bind-only.\n165: \tjson.NewEncoder(w).Encode(map[string]any{\n166: \t\t\"appliance_token\": token, \"poll_interval_sec\": 30, \"pairing_code\": configgen.FormatPairingCode(pairingCode),\n167: \t})\n168: }\n", + "line": "165-167", + "column": "2", + "nosec": false, + "suppressions": null + }, + { + "severity": "LOW", + "confidence": "HIGH", + "cwe": { + "id": "703", + "url": "https://cwe.mitre.org/data/definitions/703.html" + }, + "rule_id": "G104", + "details": "Errors unhandled", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom.eu/hub/cmd/hub/main.go", + "code": "635: \t\tw.WriteHeader(http.StatusOK)\n636: \t\tw.Write([]byte(\"ok\"))\n637: \t})\n", + "line": "636", + "column": "3", + "nosec": false, + "suppressions": null + }, + { + "severity": "LOW", + "confidence": "HIGH", + "cwe": { + "id": "703", + "url": "https://cwe.mitre.org/data/definitions/703.html" + }, + "rule_id": "G104", + "details": "Errors unhandled", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom.eu/hub/cmd/hub/main.go", + "code": "631: \t\t\tw.WriteHeader(http.StatusServiceUnavailable)\n632: \t\t\tw.Write([]byte(\"db unhealthy\"))\n633: \t\t\treturn\n", + "line": "632", + "column": "4", + "nosec": false, + "suppressions": null + }, + { + "severity": "LOW", + "confidence": "HIGH", + "cwe": { + "id": "703", + "url": "https://cwe.mitre.org/data/definitions/703.html" + }, + "rule_id": "G104", + "details": "Errors unhandled", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom.eu/hub/cmd/hub/main.go", + "code": "196: \t\tcode := runUnsealBoxSecrets(dataStore, logger)\n197: \t\tdataStore.Close()\n198: \t\tos.Exit(code)\n", + "line": "197", + "column": "3", + "nosec": false, + "suppressions": null + }, + { + "severity": "LOW", + "confidence": "HIGH", + "cwe": { + "id": "703", + "url": "https://cwe.mitre.org/data/definitions/703.html" + }, + "rule_id": "G104", + "details": "Errors unhandled", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom.eu/hub/cmd/hub/main.go", + "code": "180: \t// Ensure data dir exists\n181: \tos.MkdirAll(cfg.Server.DataDir, 0755)\n182: \n", + "line": "181", + "column": "2", + "nosec": false, + "suppressions": null + } + ], + "Stats": { + "files": 112, + "lines": 38224, + "nosec": 0, + "found": 215 + }, + "GosecVersion": "dev" +} \ No newline at end of file diff --git a/documentation/audits/security-review-2026-10-12/scanners/govulncheck-binary-felhom-agent-0.154.0.txt b/documentation/audits/security-review-2026-10-12/scanners/govulncheck-binary-felhom-agent-0.154.0.txt new file mode 100644 index 00000000..b0999439 --- /dev/null +++ b/documentation/audits/security-review-2026-10-12/scanners/govulncheck-binary-felhom-agent-0.154.0.txt @@ -0,0 +1,327 @@ +=== Symbol Results === + +Vulnerability #1: GO-2026-6617 + HTTP/2 server crash due to HPACK encoder race in net/http + More info: https://pkg.go.dev/vuln/GO-2026-6617 + Standard library + Found in: net/http@go1.26 + Fixed in: net/http@go1.26.9 + Vulnerable symbols found: + #1: http.CanonicalHeaderKey + #2: http.CanonicalHeaderKey + #3: http.Client.Do + #4: http.Client.Do + #5: http.Cookie.String + Use '-show traces' to see the other 267 found symbols + +Vulnerability #2: GO-2026-6613 + HTTP/1 server connection desynchronization after 2xx CONNECT response in + net/http + More info: https://pkg.go.dev/vuln/GO-2026-6613 + Standard library + Found in: net/http@go1.26 + Fixed in: net/http@go1.26.9 + Vulnerable symbols found: + #1: http.CanonicalHeaderKey + #2: http.Client.Do + #3: http.Cookie.String + #4: http.Error + #5: http.HandlerFunc.ServeHTTP + Use '-show traces' to see the other 66 found symbols + +Vulnerability #3: GO-2026-6612 + Double flow control refund on HTTP/2 server streams in net/http + More info: https://pkg.go.dev/vuln/GO-2026-6612 + Standard library + Found in: net/http@go1.26 + Fixed in: net/http@go1.26.9 + Vulnerable symbols found: + #1: http.CanonicalHeaderKey + #2: http.CanonicalHeaderKey + #3: http.Client.Do + #4: http.Client.Do + #5: http.Cookie.String + Use '-show traces' to see the other 267 found symbols + +Vulnerability #4: GO-2026-6611 + Excessive CPU consumption from repeated initial window changes in net/http + More info: https://pkg.go.dev/vuln/GO-2026-6611 + Standard library + Found in: net/http@go1.26 + Fixed in: net/http@go1.26.9 + Vulnerable symbols found: + #1: http.CanonicalHeaderKey + #2: http.CanonicalHeaderKey + #3: http.Client.Do + #4: http.Client.Do + #5: http.Cookie.String + Use '-show traces' to see the other 271 found symbols + +Vulnerability #5: GO-2026-6610 + HTTP/2 transport accepts malformed framing-related headers in net/http + More info: https://pkg.go.dev/vuln/GO-2026-6610 + Standard library + Found in: net/http@go1.26 + Fixed in: net/http@go1.26.9 + Vulnerable symbols found: + #1: http.Client.Do + #2: http.Client.Do + #3: http.Transport.RoundTrip + #4: http.Transport.RoundTrip + #5: http.http2Transport.NewClientConn + Use '-show traces' to see the other 15 found symbols + +Vulnerability #6: GO-2026-6608 + Memory limit bypass when parsing MIME headers in net/textproto, + mime/multipart + More info: https://pkg.go.dev/vuln/GO-2026-6608 + Standard library + Found in: net/textproto@go1.26 + Fixed in: net/textproto@go1.26.9 + Vulnerable symbols found: + #1: textproto.Reader.ReadMIMEHeader + +Vulnerability #7: GO-2026-6607 + Reject malformed ECH outer extension references in crypto/tls + More info: https://pkg.go.dev/vuln/GO-2026-6607 + Standard library + Found in: crypto/tls@go1.26 + Fixed in: crypto/tls@go1.26.9 + Vulnerable symbols found: + #1: tls.Conn.Handshake + #2: tls.Conn.HandshakeContext + #3: tls.Conn.Read + #4: tls.Conn.Write + #5: tls.Dialer.DialContext + +Vulnerability #8: GO-2026-6605 + HTTP/1 client connection desynchronization after CONNECT rejection in + net/http + More info: https://pkg.go.dev/vuln/GO-2026-6605 + Standard library + Found in: net/http@go1.26 + Fixed in: net/http@go1.26.9 + Vulnerable symbols found: + #1: http.Client.Do + #2: http.Transport.RoundTrip + +Vulnerability #9: GO-2026-6603 + HTTP/2 server memory exhaustion due to Trailer headers in net/http + More info: https://pkg.go.dev/vuln/GO-2026-6603 + Standard library + Found in: net/http@go1.26 + Fixed in: net/http@go1.26.9 + Vulnerable symbols found: + #1: http.CanonicalHeaderKey + #2: http.CanonicalHeaderKey + #3: http.Client.Do + #4: http.Client.Do + #5: http.Cookie.String + Use '-show traces' to see the other 267 found symbols + +Vulnerability #10: GO-2026-6218 + Avoid quadratic complexity in resolvePath in net/url + More info: https://pkg.go.dev/vuln/GO-2026-6218 + Standard library + Found in: net/url@go1.26 + Fixed in: net/url@go1.26.6 + Vulnerable symbols found: + #1: url.URL.Parse + #2: url.URL.ResolveReference + +Vulnerability #11: GO-2026-6090 + Limit handshake messages we are willing to accept post-handshake in + crypto/tls + More info: https://pkg.go.dev/vuln/GO-2026-6090 + Standard library + Found in: crypto/tls@go1.26 + Fixed in: crypto/tls@go1.26.6 + Vulnerable symbols found: + #1: tls.Conn.Handshake + #2: tls.Conn.HandshakeContext + #3: tls.Conn.Read + #4: tls.Conn.Write + #5: tls.Dialer.DialContext + +Vulnerability #12: GO-2026-6089 + Apply ReadHeaderTimeout when doing unencrypted HTTP/2 check in net/http + More info: https://pkg.go.dev/vuln/GO-2026-6089 + Standard library + Found in: net/http@go1.26 + Fixed in: net/http@go1.26.6 + Vulnerable symbols found: + #1: http.Server.Serve + #2: http.Server.ServeTLS + +Vulnerability #13: GO-2026-5972 + Enforce maximum recursion depth in encoding/asn1 + More info: https://pkg.go.dev/vuln/GO-2026-5972 + Standard library + Found in: encoding/asn1@go1.26 + Fixed in: encoding/asn1@go1.26.6 + Vulnerable symbols found: + #1: asn1.Unmarshal + #2: asn1.UnmarshalWithParams + +Vulnerability #14: GO-2026-5856 + Invoking Encrypted Client Hello privacy leak in crypto/tls + More info: https://pkg.go.dev/vuln/GO-2026-5856 + Standard library + Found in: crypto/tls@go1.26 + Fixed in: crypto/tls@go1.26.5 + Vulnerable symbols found: + #1: tls.Conn.Handshake + #2: tls.Conn.HandshakeContext + #3: tls.Conn.Read + #4: tls.Conn.Write + #5: tls.Dialer.DialContext + +Vulnerability #15: GO-2026-5039 + Arbitrary inputs are included in errors without any escaping in + net/textproto + More info: https://pkg.go.dev/vuln/GO-2026-5039 + Standard library + Found in: net/textproto@go1.26 + Fixed in: net/textproto@go1.26.4 + Vulnerable symbols found: + #1: textproto.Reader.ReadMIMEHeader + +Vulnerability #16: GO-2026-5037 + Inefficient candidate hostname parsing in crypto/x509 + More info: https://pkg.go.dev/vuln/GO-2026-5037 + Standard library + Found in: crypto/x509@go1.26 + Fixed in: crypto/x509@go1.26.4 + Vulnerable symbols found: + #1: x509.Certificate.Verify + #2: x509.Certificate.VerifyHostname + #3: x509.HostnameError.Error + +Vulnerability #17: GO-2026-5026 + Invoking failure to reject ASCII-only Punycode-encoded labels in + golang.org/x/net/idna + More info: https://pkg.go.dev/vuln/GO-2026-5026 + Standard library + Found in: net/http@go1.26 + Fixed in: net/http@go1.26.6 + Vulnerable symbols found: + #1: http.Client.Do + #2: http.Transport.RoundTrip + #3: http.http2ClientConn.RoundTrip + +Vulnerability #18: GO-2026-4971 + Panic in Dial and LookupPort when handling NUL byte on Windows in net + More info: https://pkg.go.dev/vuln/GO-2026-4971 + Standard library + Found in: net@go1.26 + Fixed in: net@go1.26.3 + Vulnerable symbols found: + #1: net.DialTimeout + #2: net.Dialer.Dial + #3: net.Dialer.DialContext + #4: net.Listen + #5: net.ListenConfig.Listen + Use '-show traces' to see the other 4 found symbols + +Vulnerability #19: GO-2026-4947 + Unexpected work during chain building in crypto/x509 + More info: https://pkg.go.dev/vuln/GO-2026-4947 + Standard library + Found in: crypto/x509@go1.26 + Fixed in: crypto/x509@go1.26.2 + Vulnerable symbols found: + #1: x509.Certificate.Verify + +Vulnerability #20: GO-2026-4946 + Inefficient policy validation in crypto/x509 + More info: https://pkg.go.dev/vuln/GO-2026-4946 + Standard library + Found in: crypto/x509@go1.26 + Fixed in: crypto/x509@go1.26.2 + Vulnerable symbols found: + #1: x509.Certificate.Verify + +Vulnerability #21: GO-2026-4918 + Infinite loop in HTTP/2 transport when given bad SETTINGS_MAX_FRAME_SIZE in + net/http/internal/http2 in golang.org/x/net + More info: https://pkg.go.dev/vuln/GO-2026-4918 + Standard library + Found in: net/http@go1.26 + Fixed in: net/http@go1.26.3 + Vulnerable symbols found: + #1: http.Client.Do + #2: http.Transport.RoundTrip + #3: http.http2Transport.NewClientConn + #4: http.http2Transport.RoundTrip + #5: http.http2Transport.RoundTripOpt + Use '-show traces' to see the other 5 found symbols + +Vulnerability #22: GO-2026-4870 + Unauthenticated TLS 1.3 KeyUpdate record can cause persistent connection + retention and DoS in crypto/tls + More info: https://pkg.go.dev/vuln/GO-2026-4870 + Standard library + Found in: crypto/tls@go1.26 + Fixed in: crypto/tls@go1.26.2 + Vulnerable symbols found: + #1: tls.Conn.Handshake + #2: tls.Conn.HandshakeContext + #3: tls.Conn.Read + #4: tls.Conn.Write + #5: tls.Dialer.DialContext + +Vulnerability #23: GO-2026-4866 + Case-sensitive excludedSubtrees name constraints cause Auth Bypass in + crypto/x509 + More info: https://pkg.go.dev/vuln/GO-2026-4866 + Standard library + Found in: crypto/x509@go1.26 + Fixed in: crypto/x509@go1.26.2 + Vulnerable symbols found: + #1: x509.Certificate.Verify + +Vulnerability #24: GO-2026-4602 + FileInfo can escape from a Root in os + More info: https://pkg.go.dev/vuln/GO-2026-4602 + Standard library + Found in: os@go1.26 + Fixed in: os@go1.26.1 + Vulnerable symbols found: + #1: os.File.ReadDir + #2: os.ReadDir + +Vulnerability #25: GO-2026-4601 + Incorrect parsing of IPv6 host literals in net/url + More info: https://pkg.go.dev/vuln/GO-2026-4601 + Standard library + Found in: net/url@go1.26 + Fixed in: net/url@go1.26.1 + Vulnerable symbols found: + #1: url.Parse + #2: url.ParseRequestURI + #3: url.URL.Parse + #4: url.URL.UnmarshalBinary + +Vulnerability #26: GO-2026-4600 + Panic in name constraint checking for malformed certificates in crypto/x509 + More info: https://pkg.go.dev/vuln/GO-2026-4600 + Standard library + Found in: crypto/x509@go1.26 + Fixed in: crypto/x509@go1.26.1 + Vulnerable symbols found: + #1: x509.Certificate.Verify + +Vulnerability #27: GO-2026-4599 + Incorrect enforcement of email constraints in crypto/x509 + More info: https://pkg.go.dev/vuln/GO-2026-4599 + Standard library + Found in: crypto/x509@go1.26 + Fixed in: crypto/x509@go1.26.1 + Vulnerable symbols found: + #1: x509.Certificate.Verify + +Your code is affected by 27 vulnerabilities from the Go standard library. +This scan also found 9 vulnerabilities in packages you import and 13 +vulnerabilities in modules you require, but your code doesn't appear to call +these vulnerabilities. +Use '-show verbose' for more details. diff --git a/documentation/audits/security-review-2026-10-12/scanners/govulncheck-binary-felhom-controller-0.307.0.txt b/documentation/audits/security-review-2026-10-12/scanners/govulncheck-binary-felhom-controller-0.307.0.txt new file mode 100644 index 00000000..ce3c4bfa --- /dev/null +++ b/documentation/audits/security-review-2026-10-12/scanners/govulncheck-binary-felhom-controller-0.307.0.txt @@ -0,0 +1,840 @@ +=== Symbol Results === + +Vulnerability #1: GO-2026-6617 + HTTP/2 server crash due to HPACK encoder race in net/http + More info: https://pkg.go.dev/vuln/GO-2026-6617 + Standard library + Found in: net/http@go1.24.13 + Fixed in: net/http@go1.26.9 + Vulnerable symbols found: + #1: http.CanonicalHeaderKey + #2: http.CanonicalHeaderKey + #3: http.CanonicalHeaderKey + #4: http.CanonicalHeaderKey + #5: http.CanonicalHeaderKey + Use '-show traces' to see the other 3999 found symbols + +Vulnerability #2: GO-2026-6613 + HTTP/1 server connection desynchronization after 2xx CONNECT response in + net/http + More info: https://pkg.go.dev/vuln/GO-2026-6613 + Standard library + Found in: net/http@go1.24.13 + Fixed in: net/http@go1.26.9 + Vulnerable symbols found: + #1: http.CanonicalHeaderKey + #2: http.CanonicalHeaderKey + #3: http.CanonicalHeaderKey + #4: http.CanonicalHeaderKey + #5: http.CanonicalHeaderKey + Use '-show traces' to see the other 1388 found symbols + +Vulnerability #3: GO-2026-6612 + Double flow control refund on HTTP/2 server streams in net/http + More info: https://pkg.go.dev/vuln/GO-2026-6612 + Standard library + Found in: net/http@go1.24.13 + Fixed in: net/http@go1.26.9 + Vulnerable symbols found: + #1: http.CanonicalHeaderKey + #2: http.CanonicalHeaderKey + #3: http.CanonicalHeaderKey + #4: http.CanonicalHeaderKey + #5: http.CanonicalHeaderKey + Use '-show traces' to see the other 3999 found symbols + +Vulnerability #4: GO-2026-6611 + Excessive CPU consumption from repeated initial window changes in net/http + More info: https://pkg.go.dev/vuln/GO-2026-6611 + Standard library + Found in: net/http@go1.24.13 + Fixed in: net/http@go1.26.9 + Vulnerable symbols found: + #1: http.CanonicalHeaderKey + #2: http.CanonicalHeaderKey + #3: http.CanonicalHeaderKey + #4: http.CanonicalHeaderKey + #5: http.CanonicalHeaderKey + Use '-show traces' to see the other 4019 found symbols + +Vulnerability #5: GO-2026-6610 + HTTP/2 transport accepts malformed framing-related headers in net/http + More info: https://pkg.go.dev/vuln/GO-2026-6610 + Standard library + Found in: net/http@go1.24.13 + Fixed in: net/http@go1.26.9 + Vulnerable symbols found: + #1: http.Client.CloseIdleConnections + #2: http.Client.CloseIdleConnections + #3: http.Client.CloseIdleConnections + #4: http.Client.CloseIdleConnections + #5: http.Client.CloseIdleConnections + Use '-show traces' to see the other 647 found symbols + +Vulnerability #6: GO-2026-6609 + Lack of limit on size of parsed Range headers in net/http + More info: https://pkg.go.dev/vuln/GO-2026-6609 + Standard library + Found in: net/http@go1.24.13 + Fixed in: net/http@go1.26.9 + Vulnerable symbols found: + #1: http.ServeContent + #2: http.ServeContent + #3: http.ServeContent + #4: http.ServeContent + #5: http.ServeContent + Use '-show traces' to see the other 45 found symbols + +Vulnerability #7: GO-2026-6608 + Memory limit bypass when parsing MIME headers in net/textproto, + mime/multipart + More info: https://pkg.go.dev/vuln/GO-2026-6608 + Standard library + Found in: mime/multipart@go1.24.13 + Fixed in: mime/multipart@go1.26.9 + Vulnerable symbols found: + #1: multipart.Reader.NextPart + #2: multipart.Reader.NextRawPart + #3: multipart.Reader.ReadForm + #4: textproto.Reader.ReadContinuedLine + #5: textproto.Reader.ReadContinuedLineBytes + Use '-show traces' to see the other 2 found symbols + +Vulnerability #8: GO-2026-6607 + Reject malformed ECH outer extension references in crypto/tls + More info: https://pkg.go.dev/vuln/GO-2026-6607 + Standard library + Found in: crypto/tls@go1.24.13 + Fixed in: crypto/tls@go1.26.9 + Vulnerable symbols found: + #1: tls.Conn.Handshake + #2: tls.Conn.Handshake + #3: tls.Conn.Handshake + #4: tls.Conn.Handshake + #5: tls.Conn.HandshakeContext + Use '-show traces' to see the other 31 found symbols + +Vulnerability #9: GO-2026-6605 + HTTP/1 client connection desynchronization after CONNECT rejection in + net/http + More info: https://pkg.go.dev/vuln/GO-2026-6605 + Standard library + Found in: net/http/httputil@go1.24.13 + Fixed in: net/http/httputil@go1.26.9 + Vulnerable symbols found: + #1: http.Client.CloseIdleConnections + #2: http.Client.CloseIdleConnections + #3: http.Client.CloseIdleConnections + #4: http.Client.CloseIdleConnections + #5: http.Client.CloseIdleConnections + Use '-show traces' to see the other 236 found symbols + +Vulnerability #10: GO-2026-6603 + HTTP/2 server memory exhaustion due to Trailer headers in net/http + More info: https://pkg.go.dev/vuln/GO-2026-6603 + Standard library + Found in: net/http@go1.24.13 + Fixed in: net/http@go1.26.9 + Vulnerable symbols found: + #1: http.CanonicalHeaderKey + #2: http.CanonicalHeaderKey + #3: http.CanonicalHeaderKey + #4: http.CanonicalHeaderKey + #5: http.CanonicalHeaderKey + Use '-show traces' to see the other 3999 found symbols + +Vulnerability #11: GO-2026-6600 + Recognize yield as regexp preceder keyword in html/template + More info: https://pkg.go.dev/vuln/GO-2026-6600 + Standard library + Found in: html/template@go1.24.13 + Fixed in: html/template@go1.26.9 + Vulnerable symbols found: + #1: template.Template.Execute + #2: template.Template.Execute + #3: template.Template.Execute + #4: template.Template.Execute + #5: template.Template.Execute + Use '-show traces' to see the other 9 found symbols + +Vulnerability #12: GO-2026-6599 + Reset context tracking on consecutive template expressions in html/template + More info: https://pkg.go.dev/vuln/GO-2026-6599 + Standard library + Found in: html/template@go1.24.13 + Fixed in: html/template@go1.26.9 + Vulnerable symbols found: + #1: template.Template.Execute + #2: template.Template.Execute + #3: template.Template.Execute + #4: template.Template.Execute + #5: template.Template.Execute + Use '-show traces' to see the other 9 found symbols + +Vulnerability #13: GO-2026-6355 + Prevent DoS on deadlocked established channel in golang.org/x/crypto/ssh + More info: https://pkg.go.dev/vuln/GO-2026-6355 + Module: golang.org/x/crypto + Found in: golang.org/x/crypto@v0.31.0 + Fixed in: golang.org/x/crypto@v0.56.0 + Vulnerable symbols found: + #1: ssh.Dial + #2: ssh.Dial + #3: ssh.Dial + #4: ssh.Dial + #5: ssh.Dial + Use '-show traces' to see the other 25 found symbols + +Vulnerability #14: GO-2026-6354 + Prevent DoS on deadlocked undecided channel in golang.org/x/crypto/ssh + More info: https://pkg.go.dev/vuln/GO-2026-6354 + Module: golang.org/x/crypto + Found in: golang.org/x/crypto@v0.31.0 + Fixed in: golang.org/x/crypto@v0.56.0 + Vulnerable symbols found: + #1: ssh.Dial + #2: ssh.Dial + #3: ssh.Dial + #4: ssh.Dial + #5: ssh.Dial + Use '-show traces' to see the other 27 found symbols + +Vulnerability #15: GO-2026-6303 + Source-address critical option not enforced for non-public-key auth + callbacks in golang.org/x/crypto/ssh + More info: https://pkg.go.dev/vuln/GO-2026-6303 + Module: golang.org/x/crypto + Found in: golang.org/x/crypto@v0.31.0 + Fixed in: golang.org/x/crypto@v0.55.0 + Vulnerable symbols found: + #1: ssh.NewServerConn + #2: ssh.NewServerConn + #3: ssh.NewServerConn + #4: ssh.NewServerConn + #5: ssh.NewServerConn + Use '-show traces' to see the other 7 found symbols + +Vulnerability #16: GO-2026-6218 + Avoid quadratic complexity in resolvePath in net/url + More info: https://pkg.go.dev/vuln/GO-2026-6218 + Standard library + Found in: net/url@go1.24.13 + Fixed in: net/url@go1.25.13 + Vulnerable symbols found: + #1: url.URL.Parse + #2: url.URL.Parse + #3: url.URL.ResolveReference + +Vulnerability #17: GO-2026-6091 + Fix Javascript regexp context tracking in html/template + More info: https://pkg.go.dev/vuln/GO-2026-6091 + Standard library + Found in: html/template@go1.24.13 + Fixed in: html/template@go1.25.13 + Vulnerable symbols found: + #1: template.Template.Execute + #2: template.Template.Execute + #3: template.Template.Execute + #4: template.Template.Execute + #5: template.Template.Execute + Use '-show traces' to see the other 9 found symbols + +Vulnerability #18: GO-2026-6090 + Limit handshake messages we are willing to accept post-handshake in + crypto/tls + More info: https://pkg.go.dev/vuln/GO-2026-6090 + Standard library + Found in: crypto/tls@go1.24.13 + Fixed in: crypto/tls@go1.25.13 + Vulnerable symbols found: + #1: tls.Conn.Handshake + #2: tls.Conn.Handshake + #3: tls.Conn.Handshake + #4: tls.Conn.Handshake + #5: tls.Conn.HandshakeContext + Use '-show traces' to see the other 34 found symbols + +Vulnerability #19: GO-2026-6089 + Apply ReadHeaderTimeout when doing unencrypted HTTP/2 check in net/http + More info: https://pkg.go.dev/vuln/GO-2026-6089 + Standard library + Found in: net/http@go1.24.13 + Fixed in: net/http@go1.25.13 + Vulnerable symbols found: + #1: http.ListenAndServe + #2: http.ListenAndServe + #3: http.ListenAndServe + #4: http.ListenAndServe + #5: http.ListenAndServe + Use '-show traces' to see the other 75 found symbols + +Vulnerability #20: GO-2026-6088 + Add recursion depth guard during decode in encoding/xml + More info: https://pkg.go.dev/vuln/GO-2026-6088 + Standard library + Found in: encoding/xml@go1.24.13 + Fixed in: encoding/xml@go1.25.13 + Vulnerable symbols found: + #1: xml.Decoder.Decode + #2: xml.Decoder.DecodeElement + #3: xml.Decoder.RawToken + #4: xml.Decoder.Skip + #5: xml.Decoder.Token + Use '-show traces' to see the other 1 found symbols + +Vulnerability #21: GO-2026-5972 + Enforce maximum recursion depth in encoding/asn1 + More info: https://pkg.go.dev/vuln/GO-2026-5972 + Standard library + Found in: encoding/asn1@go1.24.13 + Fixed in: encoding/asn1@go1.25.13 + Vulnerable symbols found: + #1: asn1.Unmarshal + #2: asn1.UnmarshalWithParams + +Vulnerability #22: GO-2026-5932 + The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, + and has known security issues + More info: https://pkg.go.dev/vuln/GO-2026-5932 + Module: golang.org/x/crypto + Found in: golang.org/x/crypto@v0.31.0 + Fixed in: N/A + Vulnerable symbols found: + #1: armor.golang.org/x/crypto/openpgp/armor/* + #2: clearsign.golang.org/x/crypto/openpgp/clearsign/* + #3: elgamal.golang.org/x/crypto/openpgp/elgamal/* + #4: errors.golang.org/x/crypto/openpgp/errors/* + #5: openpgp.golang.org/x/crypto/openpgp/* + Use '-show traces' to see the other 2 found symbols + +Vulnerability #23: GO-2026-5856 + Invoking Encrypted Client Hello privacy leak in crypto/tls + More info: https://pkg.go.dev/vuln/GO-2026-5856 + Standard library + Found in: crypto/tls@go1.24.13 + Fixed in: crypto/tls@go1.25.12 + Vulnerable symbols found: + #1: tls.Conn.Handshake + #2: tls.Conn.Handshake + #3: tls.Conn.Handshake + #4: tls.Conn.Handshake + #5: tls.Conn.HandshakeContext + Use '-show traces' to see the other 35 found symbols + +Vulnerability #24: GO-2026-5039 + Arbitrary inputs are included in errors without any escaping in + net/textproto + More info: https://pkg.go.dev/vuln/GO-2026-5039 + Standard library + Found in: net/textproto@go1.24.13 + Fixed in: net/textproto@go1.25.11 + Vulnerable symbols found: + #1: textproto.Error.Error + #2: textproto.Reader.ReadCodeLine + #3: textproto.Reader.ReadMIMEHeader + #4: textproto.Reader.ReadMIMEHeader + #5: textproto.Reader.ReadResponse + +Vulnerability #25: GO-2026-5038 + Quadratic complexity in WordDecoder.DecodeHeader in mime + More info: https://pkg.go.dev/vuln/GO-2026-5038 + Standard library + Found in: mime@go1.24.13 + Fixed in: mime@go1.25.11 + Vulnerable symbols found: + #1: mime.WordDecoder.DecodeHeader + +Vulnerability #26: GO-2026-5037 + Inefficient candidate hostname parsing in crypto/x509 + More info: https://pkg.go.dev/vuln/GO-2026-5037 + Standard library + Found in: crypto/x509@go1.24.13 + Fixed in: crypto/x509@go1.25.11 + Vulnerable symbols found: + #1: x509.Certificate.Verify + #2: x509.Certificate.Verify + #3: x509.Certificate.Verify + #4: x509.Certificate.VerifyHostname + #5: x509.HostnameError.Error + +Vulnerability #27: GO-2026-5033 + Invoking pathological inputs can lead to client panic in + golang.org/x/crypto/ssh/agent + More info: https://pkg.go.dev/vuln/GO-2026-5033 + Module: golang.org/x/crypto + Found in: golang.org/x/crypto@v0.31.0 + Fixed in: golang.org/x/crypto@v0.52.0 + Vulnerable symbols found: + #1: agent.ForwardToAgent + #2: agent.ForwardToAgent + #3: agent.ServeAgent + #4: agent.ServeAgent + +Vulnerability #28: GO-2026-5026 + Invoking failure to reject ASCII-only Punycode-encoded labels in + golang.org/x/net/idna + More info: https://pkg.go.dev/vuln/GO-2026-5026 + Standard library + Found in: net/http/internal/http2@go1.24.13 + Fixed in: net/http/internal/http2@go1.25.13 + Vulnerable symbols found: + #1: http.Client.CloseIdleConnections + #2: http.Client.CloseIdleConnections + #3: http.Client.CloseIdleConnections + #4: http.Client.CloseIdleConnections + #5: http.Client.CloseIdleConnections + Use '-show traces' to see the other 248 found symbols + +Vulnerability #29: GO-2026-5023 + Invoking VerifiedPublicKeyCallback permissions skip enforcement in + golang.org/x/crypto/ssh + More info: https://pkg.go.dev/vuln/GO-2026-5023 + Module: golang.org/x/crypto + Found in: golang.org/x/crypto@v0.31.0 + Fixed in: golang.org/x/crypto@v0.52.0 + Vulnerable symbols found: + #1: ssh.NewServerConn + #2: ssh.NewServerConn + #3: ssh.NewServerConn + #4: ssh.NewServerConn + #5: ssh.NewServerConn + Use '-show traces' to see the other 7 found symbols + +Vulnerability #30: GO-2026-5021 + Invoking auth bypass via unenforced @revoked status in + golang.org/x/crypto/ssh/knownhosts + More info: https://pkg.go.dev/vuln/GO-2026-5021 + Module: golang.org/x/crypto + Found in: golang.org/x/crypto@v0.31.0 + Fixed in: golang.org/x/crypto@v0.52.0 + Vulnerable symbols found: + #1: knownhosts.hostKeyDB.IsRevoked + +Vulnerability #31: GO-2026-5020 + Invoking infinite loop on large channel writes in golang.org/x/crypto/ssh + More info: https://pkg.go.dev/vuln/GO-2026-5020 + Module: golang.org/x/crypto + Found in: golang.org/x/crypto@v0.31.0 + Fixed in: golang.org/x/crypto@v0.52.0 + Vulnerable symbols found: + #1: ssh.Dial + #2: ssh.Dial + #3: ssh.Dial + #4: ssh.Dial + #5: ssh.Dial + Use '-show traces' to see the other 72 found symbols + +Vulnerability #32: GO-2026-5019 + Invoking bypass of FIDO/U2F security keys physical interaction in + golang.org/x/crypto/ssh + More info: https://pkg.go.dev/vuln/GO-2026-5019 + Module: golang.org/x/crypto + Found in: golang.org/x/crypto@v0.31.0 + Fixed in: golang.org/x/crypto@v0.52.0 + Vulnerable symbols found: + #1: ssh.CertChecker.Authenticate + #2: ssh.CertChecker.Authenticate + #3: ssh.CertChecker.CheckCert + #4: ssh.CertChecker.CheckHostKey + #5: ssh.CertChecker.CheckHostKey + Use '-show traces' to see the other 31 found symbols + +Vulnerability #33: GO-2026-5018 + Invoking pathological RSA/DSA parameters may cause DoS in + golang.org/x/crypto/ssh + More info: https://pkg.go.dev/vuln/GO-2026-5018 + Module: golang.org/x/crypto + Found in: golang.org/x/crypto@v0.31.0 + Fixed in: golang.org/x/crypto@v0.52.0 + Vulnerable symbols found: + #1: ssh.Dial + #2: ssh.Dial + #3: ssh.Dial + #4: ssh.Dial + #5: ssh.Dial + Use '-show traces' to see the other 31 found symbols + +Vulnerability #34: GO-2026-5017 + Invoking client can cause server deadlock on unexpected responses in + golang.org/x/crypto/ssh + More info: https://pkg.go.dev/vuln/GO-2026-5017 + Module: golang.org/x/crypto + Found in: golang.org/x/crypto@v0.31.0 + Fixed in: golang.org/x/crypto@v0.52.0 + Vulnerable symbols found: + #1: ssh.Client.Listen + #2: ssh.Client.Listen + #3: ssh.Client.ListenTCP + #4: ssh.Client.ListenTCP + #5: ssh.Client.ListenUnix + Use '-show traces' to see the other 64 found symbols + +Vulnerability #35: GO-2026-5016 + Invoking memory leak when rejecting channels can lead to DoS in + golang.org/x/crypto/ssh + More info: https://pkg.go.dev/vuln/GO-2026-5016 + Module: golang.org/x/crypto + Found in: golang.org/x/crypto@v0.31.0 + Fixed in: golang.org/x/crypto@v0.52.0 + Vulnerable symbols found: + #1: ssh.channel.Reject + #2: ssh.channel.Reject + +Vulnerability #36: GO-2026-5015 + Invoking server panic during CheckHostKey/Authenticate in + golang.org/x/crypto/ssh + More info: https://pkg.go.dev/vuln/GO-2026-5015 + Module: golang.org/x/crypto + Found in: golang.org/x/crypto@v0.31.0 + Fixed in: golang.org/x/crypto@v0.52.0 + Vulnerable symbols found: + #1: ssh.CertChecker.Authenticate + #2: ssh.CertChecker.Authenticate + #3: ssh.CertChecker.CheckHostKey + #4: ssh.CertChecker.CheckHostKey + +Vulnerability #37: GO-2026-5014 + Invoking bypass of certificate restrictions in golang.org/x/crypto/ssh + More info: https://pkg.go.dev/vuln/GO-2026-5014 + Module: golang.org/x/crypto + Found in: golang.org/x/crypto@v0.31.0 + Fixed in: golang.org/x/crypto@v0.52.0 + Vulnerable symbols found: + #1: ssh.NewServerConn + #2: ssh.NewServerConn + #3: ssh.NewServerConn + #4: ssh.NewServerConn + #5: ssh.NewServerConn + Use '-show traces' to see the other 7 found symbols + +Vulnerability #38: GO-2026-5013 + Invoking byte arithmetic causes underflow and panic in + golang.org/x/crypto/ssh + More info: https://pkg.go.dev/vuln/GO-2026-5013 + Module: golang.org/x/crypto + Found in: golang.org/x/crypto@v0.31.0 + Fixed in: golang.org/x/crypto@v0.52.0 + Vulnerable symbols found: + #1: ssh.Dial + #2: ssh.Dial + #3: ssh.Dial + #4: ssh.Dial + #5: ssh.Dial + Use '-show traces' to see the other 51 found symbols + +Vulnerability #39: GO-2026-5006 + Invoking agent constraints dropped when forwarding keys in + golang.org/x/crypto/ssh/agent + More info: https://pkg.go.dev/vuln/GO-2026-5006 + Module: golang.org/x/crypto + Found in: golang.org/x/crypto@v0.31.0 + Fixed in: golang.org/x/crypto@v0.52.0 + Vulnerable symbols found: + #1: agent.client.Add + #2: agent.keyring.Add + #3: agent.keyring.Add + +Vulnerability #40: GO-2026-5005 + Invoking key constraints not enforced in golang.org/x/crypto/ssh/agent + More info: https://pkg.go.dev/vuln/GO-2026-5005 + Module: golang.org/x/crypto + Found in: golang.org/x/crypto@v0.31.0 + Fixed in: golang.org/x/crypto@v0.52.0 + Vulnerable symbols found: + #1: agent.keyring.Add + #2: agent.keyring.Add + +Vulnerability #41: GO-2026-4986 + Quadratic string concatentation in consumeComment in net/mail + More info: https://pkg.go.dev/vuln/GO-2026-4986 + Standard library + Found in: net/mail@go1.24.13 + Fixed in: net/mail@go1.25.10 + Vulnerable symbols found: + #1: mail.AddressParser.Parse + #2: mail.AddressParser.Parse + #3: mail.AddressParser.ParseList + #4: mail.AddressParser.ParseList + #5: mail.Header.AddressList + Use '-show traces' to see the other 7 found symbols + +Vulnerability #42: GO-2026-4982 + Bypass of meta content URL escaping causes XSS in html/template + More info: https://pkg.go.dev/vuln/GO-2026-4982 + Standard library + Found in: html/template@go1.24.13 + Fixed in: html/template@go1.25.10 + Vulnerable symbols found: + #1: template.Template.Execute + #2: template.Template.Execute + #3: template.Template.Execute + #4: template.Template.Execute + #5: template.Template.Execute + Use '-show traces' to see the other 9 found symbols + +Vulnerability #43: GO-2026-4981 + Crash when handling long CNAME response in net + More info: https://pkg.go.dev/vuln/GO-2026-4981 + Standard library + Found in: net@go1.24.13 + Fixed in: net@go1.25.10 + Vulnerable symbols found: + #1: net.LookupCNAME + #2: net.LookupCNAME + #3: net.Resolver.LookupCNAME + #4: net.Resolver.LookupCNAME + +Vulnerability #44: GO-2026-4980 + Escaper bypass leads to XSS in html/template + More info: https://pkg.go.dev/vuln/GO-2026-4980 + Standard library + Found in: html/template@go1.24.13 + Fixed in: html/template@go1.25.10 + Vulnerable symbols found: + #1: template.Template.Execute + #2: template.Template.Execute + #3: template.Template.Execute + #4: template.Template.Execute + #5: template.Template.Execute + Use '-show traces' to see the other 9 found symbols + +Vulnerability #45: GO-2026-4977 + Quadratic string concatenation in consumePhrase in net/mail + More info: https://pkg.go.dev/vuln/GO-2026-4977 + Standard library + Found in: net/mail@go1.24.13 + Fixed in: net/mail@go1.25.10 + Vulnerable symbols found: + #1: mail.AddressParser.Parse + #2: mail.AddressParser.Parse + #3: mail.AddressParser.ParseList + #4: mail.AddressParser.ParseList + #5: mail.Header.AddressList + Use '-show traces' to see the other 5 found symbols + +Vulnerability #46: GO-2026-4976 + ReverseProxy forwards queries with more than urlmaxqueryparams parameters in + net/http/httputil + More info: https://pkg.go.dev/vuln/GO-2026-4976 + Standard library + Found in: net/http/httputil@go1.24.13 + Fixed in: net/http/httputil@go1.25.10 + Vulnerable symbols found: + #1: httputil.ReverseProxy.ServeHTTP + #2: httputil.ReverseProxy.ServeHTTP + +Vulnerability #47: GO-2026-4971 + Panic in Dial and LookupPort when handling NUL byte on Windows in net + More info: https://pkg.go.dev/vuln/GO-2026-4971 + Standard library + Found in: net@go1.24.13 + Fixed in: net@go1.25.10 + Vulnerable symbols found: + #1: net.Dial + #2: net.DialTimeout + #3: net.Dialer.Dial + #4: net.Dialer.DialContext + #5: net.Listen + Use '-show traces' to see the other 28 found symbols + +Vulnerability #48: GO-2026-4970 + Root escape via symlink plus trailing slash in os + More info: https://pkg.go.dev/vuln/GO-2026-4970 + Standard library + Found in: os@go1.24.13 + Fixed in: os@go1.25.12 + Vulnerable symbols found: + #1: os.OpenInRoot + #2: os.Root.Create + #3: os.Root.Open + #4: os.Root.OpenFile + #5: os.Root.OpenRoot + Use '-show traces' to see the other 6 found symbols + +Vulnerability #49: GO-2026-4947 + Unexpected work during chain building in crypto/x509 + More info: https://pkg.go.dev/vuln/GO-2026-4947 + Standard library + Found in: crypto/x509@go1.24.13 + Fixed in: crypto/x509@go1.25.9 + Vulnerable symbols found: + #1: x509.Certificate.Verify + #2: x509.Certificate.Verify + #3: x509.Certificate.Verify + +Vulnerability #50: GO-2026-4946 + Inefficient policy validation in crypto/x509 + More info: https://pkg.go.dev/vuln/GO-2026-4946 + Standard library + Found in: crypto/x509@go1.24.13 + Fixed in: crypto/x509@go1.25.9 + Vulnerable symbols found: + #1: x509.Certificate.Verify + #2: x509.Certificate.Verify + #3: x509.Certificate.Verify + +Vulnerability #51: GO-2026-4918 + Infinite loop in HTTP/2 transport when given bad SETTINGS_MAX_FRAME_SIZE in + net/http/internal/http2 in golang.org/x/net + More info: https://pkg.go.dev/vuln/GO-2026-4918 + Standard library + Found in: net/http@go1.24.13 + Fixed in: net/http@go1.25.10 + Vulnerable symbols found: + #1: http.Client.CloseIdleConnections + #2: http.Client.CloseIdleConnections + #3: http.Client.CloseIdleConnections + #4: http.Client.CloseIdleConnections + #5: http.Client.CloseIdleConnections + Use '-show traces' to see the other 321 found symbols + +Vulnerability #52: GO-2026-4870 + Unauthenticated TLS 1.3 KeyUpdate record can cause persistent connection + retention and DoS in crypto/tls + More info: https://pkg.go.dev/vuln/GO-2026-4870 + Standard library + Found in: crypto/tls@go1.24.13 + Fixed in: crypto/tls@go1.25.9 + Vulnerable symbols found: + #1: tls.Conn.Handshake + #2: tls.Conn.Handshake + #3: tls.Conn.Handshake + #4: tls.Conn.Handshake + #5: tls.Conn.HandshakeContext + Use '-show traces' to see the other 34 found symbols + +Vulnerability #53: GO-2026-4869 + Unbounded allocation for old GNU sparse in archive/tar + More info: https://pkg.go.dev/vuln/GO-2026-4869 + Standard library + Found in: archive/tar@go1.24.13 + Fixed in: archive/tar@go1.25.9 + Vulnerable symbols found: + #1: tar.Reader.Next + +Vulnerability #54: GO-2026-4865 + JsBraceDepth Context Tracking Bugs (XSS) in html/template + More info: https://pkg.go.dev/vuln/GO-2026-4865 + Standard library + Found in: html/template@go1.24.13 + Fixed in: html/template@go1.25.9 + Vulnerable symbols found: + #1: template.Error.Error + #2: template.HTMLEscaper + #3: template.JSEscape + #4: template.JSEscapeString + #5: template.JSEscaper + Use '-show traces' to see the other 27 found symbols + +Vulnerability #55: GO-2026-4864 + TOCTOU permits root escape on Linux via Root.Chmod in os in + internal/syscall/unix + More info: https://pkg.go.dev/vuln/GO-2026-4864 + Standard library + Found in: internal/syscall/unix@go1.24.13 + Fixed in: internal/syscall/unix@go1.25.9 + Platforms: linux + Vulnerable symbols found: + #1: unix.Fchmodat + +Vulnerability #56: GO-2026-4603 + URLs in meta content attribute actions are not escaped in html/template + More info: https://pkg.go.dev/vuln/GO-2026-4603 + Standard library + Found in: html/template@go1.24.13 + Fixed in: html/template@go1.25.8 + Vulnerable symbols found: + #1: template.Template.Execute + #2: template.Template.Execute + #3: template.Template.Execute + #4: template.Template.Execute + #5: template.Template.Execute + Use '-show traces' to see the other 9 found symbols + +Vulnerability #57: GO-2026-4602 + FileInfo can escape from a Root in os + More info: https://pkg.go.dev/vuln/GO-2026-4602 + Standard library + Found in: os@go1.24.13 + Fixed in: os@go1.25.8 + Vulnerable symbols found: + #1: os.File.ReadDir + #2: os.File.Readdir + #3: os.ReadDir + #4: os.dirFS.ReadDir + #5: os.rootFS.ReadDir + Use '-show traces' to see the other 1 found symbols + +Vulnerability #58: GO-2026-4601 + Incorrect parsing of IPv6 host literals in net/url + More info: https://pkg.go.dev/vuln/GO-2026-4601 + Standard library + Found in: net/url@go1.24.13 + Fixed in: net/url@go1.25.8 + Vulnerable symbols found: + #1: url.JoinPath + #2: url.Parse + #3: url.ParseRequestURI + #4: url.URL.Parse + #5: url.URL.Parse + Use '-show traces' to see the other 1 found symbols + +Vulnerability #59: GO-2025-4135 + Malformed constraint may cause denial of service in + golang.org/x/crypto/ssh/agent + More info: https://pkg.go.dev/vuln/GO-2025-4135 + Module: golang.org/x/crypto + Found in: golang.org/x/crypto@v0.31.0 + Fixed in: golang.org/x/crypto@v0.45.0 + Vulnerable symbols found: + #1: agent.ForwardToAgent + #2: agent.ForwardToAgent + #3: agent.ServeAgent + #4: agent.ServeAgent + +Vulnerability #60: GO-2025-4134 + Unbounded memory consumption in golang.org/x/crypto/ssh + More info: https://pkg.go.dev/vuln/GO-2025-4134 + Module: golang.org/x/crypto + Found in: golang.org/x/crypto@v0.31.0 + Fixed in: golang.org/x/crypto@v0.45.0 + Vulnerable symbols found: + #1: ssh.NewServerConn + #2: ssh.NewServerConn + #3: ssh.NewServerConn + #4: ssh.NewServerConn + #5: ssh.NewServerConn + Use '-show traces' to see the other 7 found symbols + +Vulnerability #61: GO-2025-4116 + Potential denial of service in golang.org/x/crypto/ssh/agent + More info: https://pkg.go.dev/vuln/GO-2025-4116 + Module: golang.org/x/crypto + Found in: golang.org/x/crypto@v0.31.0 + Fixed in: golang.org/x/crypto@v0.43.0 + Vulnerable symbols found: + #1: agent.agentKeyringSigner.Sign + #2: agent.agentKeyringSigner.SignWithAlgorithm + #3: agent.client.List + #4: agent.client.Sign + #5: agent.client.SignWithFlags + Use '-show traces' to see the other 1 found symbols + +Vulnerability #62: GO-2025-3487 + Potential denial of service in golang.org/x/crypto + More info: https://pkg.go.dev/vuln/GO-2025-3487 + Module: golang.org/x/crypto + Found in: golang.org/x/crypto@v0.31.0 + Fixed in: golang.org/x/crypto@v0.35.0 + Vulnerable symbols found: + #1: ssh.Client.Dial + #2: ssh.Client.DialContext + #3: ssh.Client.DialTCP + #4: ssh.Client.Listen + #5: ssh.Client.Listen + Use '-show traces' to see the other 117 found symbols + +Your code is affected by 62 vulnerabilities from 1 module and the Go standard library. +This scan found no other vulnerabilities in packages you import or modules you +require. +Use '-show verbose' for more details. diff --git a/documentation/audits/security-review-2026-10-12/scanners/govulncheck-binary-felhom-hub-0.146.0.txt b/documentation/audits/security-review-2026-10-12/scanners/govulncheck-binary-felhom-hub-0.146.0.txt new file mode 100644 index 00000000..86cacdb6 --- /dev/null +++ b/documentation/audits/security-review-2026-10-12/scanners/govulncheck-binary-felhom-hub-0.146.0.txt @@ -0,0 +1,840 @@ +=== Symbol Results === + +Vulnerability #1: GO-2026-6617 + HTTP/2 server crash due to HPACK encoder race in net/http + More info: https://pkg.go.dev/vuln/GO-2026-6617 + Standard library + Found in: net/http@go1.24.13 + Fixed in: net/http@go1.26.9 + Vulnerable symbols found: + #1: http.CanonicalHeaderKey + #2: http.CanonicalHeaderKey + #3: http.CanonicalHeaderKey + #4: http.CanonicalHeaderKey + #5: http.CanonicalHeaderKey + Use '-show traces' to see the other 3999 found symbols + +Vulnerability #2: GO-2026-6613 + HTTP/1 server connection desynchronization after 2xx CONNECT response in + net/http + More info: https://pkg.go.dev/vuln/GO-2026-6613 + Standard library + Found in: net/http@go1.24.13 + Fixed in: net/http@go1.26.9 + Vulnerable symbols found: + #1: http.CanonicalHeaderKey + #2: http.CanonicalHeaderKey + #3: http.CanonicalHeaderKey + #4: http.CanonicalHeaderKey + #5: http.CanonicalHeaderKey + Use '-show traces' to see the other 1388 found symbols + +Vulnerability #3: GO-2026-6612 + Double flow control refund on HTTP/2 server streams in net/http + More info: https://pkg.go.dev/vuln/GO-2026-6612 + Standard library + Found in: net/http@go1.24.13 + Fixed in: net/http@go1.26.9 + Vulnerable symbols found: + #1: http.CanonicalHeaderKey + #2: http.CanonicalHeaderKey + #3: http.CanonicalHeaderKey + #4: http.CanonicalHeaderKey + #5: http.CanonicalHeaderKey + Use '-show traces' to see the other 3999 found symbols + +Vulnerability #4: GO-2026-6611 + Excessive CPU consumption from repeated initial window changes in net/http + More info: https://pkg.go.dev/vuln/GO-2026-6611 + Standard library + Found in: net/http@go1.24.13 + Fixed in: net/http@go1.26.9 + Vulnerable symbols found: + #1: http.CanonicalHeaderKey + #2: http.CanonicalHeaderKey + #3: http.CanonicalHeaderKey + #4: http.CanonicalHeaderKey + #5: http.CanonicalHeaderKey + Use '-show traces' to see the other 4019 found symbols + +Vulnerability #5: GO-2026-6610 + HTTP/2 transport accepts malformed framing-related headers in net/http + More info: https://pkg.go.dev/vuln/GO-2026-6610 + Standard library + Found in: net/http@go1.24.13 + Fixed in: net/http@go1.26.9 + Vulnerable symbols found: + #1: http.Client.CloseIdleConnections + #2: http.Client.CloseIdleConnections + #3: http.Client.CloseIdleConnections + #4: http.Client.CloseIdleConnections + #5: http.Client.CloseIdleConnections + Use '-show traces' to see the other 647 found symbols + +Vulnerability #6: GO-2026-6609 + Lack of limit on size of parsed Range headers in net/http + More info: https://pkg.go.dev/vuln/GO-2026-6609 + Standard library + Found in: net/http@go1.24.13 + Fixed in: net/http@go1.26.9 + Vulnerable symbols found: + #1: http.ServeContent + #2: http.ServeContent + #3: http.ServeContent + #4: http.ServeContent + #5: http.ServeContent + Use '-show traces' to see the other 45 found symbols + +Vulnerability #7: GO-2026-6608 + Memory limit bypass when parsing MIME headers in net/textproto, + mime/multipart + More info: https://pkg.go.dev/vuln/GO-2026-6608 + Standard library + Found in: net/textproto@go1.24.13 + Fixed in: net/textproto@go1.26.9 + Vulnerable symbols found: + #1: multipart.Reader.NextPart + #2: multipart.Reader.NextRawPart + #3: multipart.Reader.ReadForm + #4: textproto.Reader.ReadContinuedLine + #5: textproto.Reader.ReadContinuedLineBytes + Use '-show traces' to see the other 2 found symbols + +Vulnerability #8: GO-2026-6607 + Reject malformed ECH outer extension references in crypto/tls + More info: https://pkg.go.dev/vuln/GO-2026-6607 + Standard library + Found in: crypto/tls@go1.24.13 + Fixed in: crypto/tls@go1.26.9 + Vulnerable symbols found: + #1: tls.Conn.Handshake + #2: tls.Conn.Handshake + #3: tls.Conn.Handshake + #4: tls.Conn.Handshake + #5: tls.Conn.HandshakeContext + Use '-show traces' to see the other 31 found symbols + +Vulnerability #9: GO-2026-6605 + HTTP/1 client connection desynchronization after CONNECT rejection in + net/http + More info: https://pkg.go.dev/vuln/GO-2026-6605 + Standard library + Found in: net/http@go1.24.13 + Fixed in: net/http@go1.26.9 + Vulnerable symbols found: + #1: http.Client.CloseIdleConnections + #2: http.Client.CloseIdleConnections + #3: http.Client.CloseIdleConnections + #4: http.Client.CloseIdleConnections + #5: http.Client.CloseIdleConnections + Use '-show traces' to see the other 236 found symbols + +Vulnerability #10: GO-2026-6603 + HTTP/2 server memory exhaustion due to Trailer headers in net/http + More info: https://pkg.go.dev/vuln/GO-2026-6603 + Standard library + Found in: net/http@go1.24.13 + Fixed in: net/http@go1.26.9 + Vulnerable symbols found: + #1: http.CanonicalHeaderKey + #2: http.CanonicalHeaderKey + #3: http.CanonicalHeaderKey + #4: http.CanonicalHeaderKey + #5: http.CanonicalHeaderKey + Use '-show traces' to see the other 3999 found symbols + +Vulnerability #11: GO-2026-6600 + Recognize yield as regexp preceder keyword in html/template + More info: https://pkg.go.dev/vuln/GO-2026-6600 + Standard library + Found in: html/template@go1.24.13 + Fixed in: html/template@go1.26.9 + Vulnerable symbols found: + #1: template.Template.Execute + #2: template.Template.Execute + #3: template.Template.Execute + #4: template.Template.Execute + #5: template.Template.Execute + Use '-show traces' to see the other 9 found symbols + +Vulnerability #12: GO-2026-6599 + Reset context tracking on consecutive template expressions in html/template + More info: https://pkg.go.dev/vuln/GO-2026-6599 + Standard library + Found in: html/template@go1.24.13 + Fixed in: html/template@go1.26.9 + Vulnerable symbols found: + #1: template.Template.Execute + #2: template.Template.Execute + #3: template.Template.Execute + #4: template.Template.Execute + #5: template.Template.Execute + Use '-show traces' to see the other 9 found symbols + +Vulnerability #13: GO-2026-6355 + Prevent DoS on deadlocked established channel in golang.org/x/crypto/ssh + More info: https://pkg.go.dev/vuln/GO-2026-6355 + Module: golang.org/x/crypto + Found in: golang.org/x/crypto@v0.31.0 + Fixed in: golang.org/x/crypto@v0.56.0 + Vulnerable symbols found: + #1: ssh.Dial + #2: ssh.Dial + #3: ssh.Dial + #4: ssh.Dial + #5: ssh.Dial + Use '-show traces' to see the other 25 found symbols + +Vulnerability #14: GO-2026-6354 + Prevent DoS on deadlocked undecided channel in golang.org/x/crypto/ssh + More info: https://pkg.go.dev/vuln/GO-2026-6354 + Module: golang.org/x/crypto + Found in: golang.org/x/crypto@v0.31.0 + Fixed in: golang.org/x/crypto@v0.56.0 + Vulnerable symbols found: + #1: ssh.Dial + #2: ssh.Dial + #3: ssh.Dial + #4: ssh.Dial + #5: ssh.Dial + Use '-show traces' to see the other 27 found symbols + +Vulnerability #15: GO-2026-6303 + Source-address critical option not enforced for non-public-key auth + callbacks in golang.org/x/crypto/ssh + More info: https://pkg.go.dev/vuln/GO-2026-6303 + Module: golang.org/x/crypto + Found in: golang.org/x/crypto@v0.31.0 + Fixed in: golang.org/x/crypto@v0.55.0 + Vulnerable symbols found: + #1: ssh.NewServerConn + #2: ssh.NewServerConn + #3: ssh.NewServerConn + #4: ssh.NewServerConn + #5: ssh.NewServerConn + Use '-show traces' to see the other 7 found symbols + +Vulnerability #16: GO-2026-6218 + Avoid quadratic complexity in resolvePath in net/url + More info: https://pkg.go.dev/vuln/GO-2026-6218 + Standard library + Found in: net/url@go1.24.13 + Fixed in: net/url@go1.25.13 + Vulnerable symbols found: + #1: url.URL.Parse + #2: url.URL.Parse + #3: url.URL.ResolveReference + +Vulnerability #17: GO-2026-6091 + Fix Javascript regexp context tracking in html/template + More info: https://pkg.go.dev/vuln/GO-2026-6091 + Standard library + Found in: html/template@go1.24.13 + Fixed in: html/template@go1.25.13 + Vulnerable symbols found: + #1: template.Template.Execute + #2: template.Template.Execute + #3: template.Template.Execute + #4: template.Template.Execute + #5: template.Template.Execute + Use '-show traces' to see the other 9 found symbols + +Vulnerability #18: GO-2026-6090 + Limit handshake messages we are willing to accept post-handshake in + crypto/tls + More info: https://pkg.go.dev/vuln/GO-2026-6090 + Standard library + Found in: crypto/tls@go1.24.13 + Fixed in: crypto/tls@go1.25.13 + Vulnerable symbols found: + #1: tls.Conn.Handshake + #2: tls.Conn.Handshake + #3: tls.Conn.Handshake + #4: tls.Conn.Handshake + #5: tls.Conn.HandshakeContext + Use '-show traces' to see the other 34 found symbols + +Vulnerability #19: GO-2026-6089 + Apply ReadHeaderTimeout when doing unencrypted HTTP/2 check in net/http + More info: https://pkg.go.dev/vuln/GO-2026-6089 + Standard library + Found in: net/http@go1.24.13 + Fixed in: net/http@go1.25.13 + Vulnerable symbols found: + #1: http.ListenAndServe + #2: http.ListenAndServe + #3: http.ListenAndServe + #4: http.ListenAndServe + #5: http.ListenAndServe + Use '-show traces' to see the other 75 found symbols + +Vulnerability #20: GO-2026-6088 + Add recursion depth guard during decode in encoding/xml + More info: https://pkg.go.dev/vuln/GO-2026-6088 + Standard library + Found in: encoding/xml@go1.24.13 + Fixed in: encoding/xml@go1.25.13 + Vulnerable symbols found: + #1: xml.Decoder.Decode + #2: xml.Decoder.DecodeElement + #3: xml.Decoder.RawToken + #4: xml.Decoder.Skip + #5: xml.Decoder.Token + Use '-show traces' to see the other 1 found symbols + +Vulnerability #21: GO-2026-5972 + Enforce maximum recursion depth in encoding/asn1 + More info: https://pkg.go.dev/vuln/GO-2026-5972 + Standard library + Found in: encoding/asn1@go1.24.13 + Fixed in: encoding/asn1@go1.25.13 + Vulnerable symbols found: + #1: asn1.Unmarshal + #2: asn1.UnmarshalWithParams + +Vulnerability #22: GO-2026-5932 + The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, + and has known security issues + More info: https://pkg.go.dev/vuln/GO-2026-5932 + Module: golang.org/x/crypto + Found in: golang.org/x/crypto@v0.31.0 + Fixed in: N/A + Vulnerable symbols found: + #1: armor.golang.org/x/crypto/openpgp/armor/* + #2: clearsign.golang.org/x/crypto/openpgp/clearsign/* + #3: elgamal.golang.org/x/crypto/openpgp/elgamal/* + #4: errors.golang.org/x/crypto/openpgp/errors/* + #5: openpgp.golang.org/x/crypto/openpgp/* + Use '-show traces' to see the other 2 found symbols + +Vulnerability #23: GO-2026-5856 + Invoking Encrypted Client Hello privacy leak in crypto/tls + More info: https://pkg.go.dev/vuln/GO-2026-5856 + Standard library + Found in: crypto/tls@go1.24.13 + Fixed in: crypto/tls@go1.25.12 + Vulnerable symbols found: + #1: tls.Conn.Handshake + #2: tls.Conn.Handshake + #3: tls.Conn.Handshake + #4: tls.Conn.Handshake + #5: tls.Conn.HandshakeContext + Use '-show traces' to see the other 35 found symbols + +Vulnerability #24: GO-2026-5039 + Arbitrary inputs are included in errors without any escaping in + net/textproto + More info: https://pkg.go.dev/vuln/GO-2026-5039 + Standard library + Found in: net/textproto@go1.24.13 + Fixed in: net/textproto@go1.25.11 + Vulnerable symbols found: + #1: textproto.Error.Error + #2: textproto.Reader.ReadCodeLine + #3: textproto.Reader.ReadMIMEHeader + #4: textproto.Reader.ReadMIMEHeader + #5: textproto.Reader.ReadResponse + +Vulnerability #25: GO-2026-5038 + Quadratic complexity in WordDecoder.DecodeHeader in mime + More info: https://pkg.go.dev/vuln/GO-2026-5038 + Standard library + Found in: mime@go1.24.13 + Fixed in: mime@go1.25.11 + Vulnerable symbols found: + #1: mime.WordDecoder.DecodeHeader + +Vulnerability #26: GO-2026-5037 + Inefficient candidate hostname parsing in crypto/x509 + More info: https://pkg.go.dev/vuln/GO-2026-5037 + Standard library + Found in: crypto/x509@go1.24.13 + Fixed in: crypto/x509@go1.25.11 + Vulnerable symbols found: + #1: x509.Certificate.Verify + #2: x509.Certificate.Verify + #3: x509.Certificate.Verify + #4: x509.Certificate.VerifyHostname + #5: x509.HostnameError.Error + +Vulnerability #27: GO-2026-5033 + Invoking pathological inputs can lead to client panic in + golang.org/x/crypto/ssh/agent + More info: https://pkg.go.dev/vuln/GO-2026-5033 + Module: golang.org/x/crypto + Found in: golang.org/x/crypto@v0.31.0 + Fixed in: golang.org/x/crypto@v0.52.0 + Vulnerable symbols found: + #1: agent.ForwardToAgent + #2: agent.ForwardToAgent + #3: agent.ServeAgent + #4: agent.ServeAgent + +Vulnerability #28: GO-2026-5026 + Invoking failure to reject ASCII-only Punycode-encoded labels in + golang.org/x/net/idna + More info: https://pkg.go.dev/vuln/GO-2026-5026 + Standard library + Found in: net/http@go1.24.13 + Fixed in: net/http@go1.25.13 + Vulnerable symbols found: + #1: http.Client.CloseIdleConnections + #2: http.Client.CloseIdleConnections + #3: http.Client.CloseIdleConnections + #4: http.Client.CloseIdleConnections + #5: http.Client.CloseIdleConnections + Use '-show traces' to see the other 248 found symbols + +Vulnerability #29: GO-2026-5023 + Invoking VerifiedPublicKeyCallback permissions skip enforcement in + golang.org/x/crypto/ssh + More info: https://pkg.go.dev/vuln/GO-2026-5023 + Module: golang.org/x/crypto + Found in: golang.org/x/crypto@v0.31.0 + Fixed in: golang.org/x/crypto@v0.52.0 + Vulnerable symbols found: + #1: ssh.NewServerConn + #2: ssh.NewServerConn + #3: ssh.NewServerConn + #4: ssh.NewServerConn + #5: ssh.NewServerConn + Use '-show traces' to see the other 7 found symbols + +Vulnerability #30: GO-2026-5021 + Invoking auth bypass via unenforced @revoked status in + golang.org/x/crypto/ssh/knownhosts + More info: https://pkg.go.dev/vuln/GO-2026-5021 + Module: golang.org/x/crypto + Found in: golang.org/x/crypto@v0.31.0 + Fixed in: golang.org/x/crypto@v0.52.0 + Vulnerable symbols found: + #1: knownhosts.hostKeyDB.IsRevoked + +Vulnerability #31: GO-2026-5020 + Invoking infinite loop on large channel writes in golang.org/x/crypto/ssh + More info: https://pkg.go.dev/vuln/GO-2026-5020 + Module: golang.org/x/crypto + Found in: golang.org/x/crypto@v0.31.0 + Fixed in: golang.org/x/crypto@v0.52.0 + Vulnerable symbols found: + #1: ssh.Dial + #2: ssh.Dial + #3: ssh.Dial + #4: ssh.Dial + #5: ssh.Dial + Use '-show traces' to see the other 72 found symbols + +Vulnerability #32: GO-2026-5019 + Invoking bypass of FIDO/U2F security keys physical interaction in + golang.org/x/crypto/ssh + More info: https://pkg.go.dev/vuln/GO-2026-5019 + Module: golang.org/x/crypto + Found in: golang.org/x/crypto@v0.31.0 + Fixed in: golang.org/x/crypto@v0.52.0 + Vulnerable symbols found: + #1: ssh.CertChecker.Authenticate + #2: ssh.CertChecker.Authenticate + #3: ssh.CertChecker.CheckCert + #4: ssh.CertChecker.CheckHostKey + #5: ssh.CertChecker.CheckHostKey + Use '-show traces' to see the other 31 found symbols + +Vulnerability #33: GO-2026-5018 + Invoking pathological RSA/DSA parameters may cause DoS in + golang.org/x/crypto/ssh + More info: https://pkg.go.dev/vuln/GO-2026-5018 + Module: golang.org/x/crypto + Found in: golang.org/x/crypto@v0.31.0 + Fixed in: golang.org/x/crypto@v0.52.0 + Vulnerable symbols found: + #1: ssh.Dial + #2: ssh.Dial + #3: ssh.Dial + #4: ssh.Dial + #5: ssh.Dial + Use '-show traces' to see the other 31 found symbols + +Vulnerability #34: GO-2026-5017 + Invoking client can cause server deadlock on unexpected responses in + golang.org/x/crypto/ssh + More info: https://pkg.go.dev/vuln/GO-2026-5017 + Module: golang.org/x/crypto + Found in: golang.org/x/crypto@v0.31.0 + Fixed in: golang.org/x/crypto@v0.52.0 + Vulnerable symbols found: + #1: ssh.Client.Listen + #2: ssh.Client.Listen + #3: ssh.Client.ListenTCP + #4: ssh.Client.ListenTCP + #5: ssh.Client.ListenUnix + Use '-show traces' to see the other 64 found symbols + +Vulnerability #35: GO-2026-5016 + Invoking memory leak when rejecting channels can lead to DoS in + golang.org/x/crypto/ssh + More info: https://pkg.go.dev/vuln/GO-2026-5016 + Module: golang.org/x/crypto + Found in: golang.org/x/crypto@v0.31.0 + Fixed in: golang.org/x/crypto@v0.52.0 + Vulnerable symbols found: + #1: ssh.channel.Reject + #2: ssh.channel.Reject + +Vulnerability #36: GO-2026-5015 + Invoking server panic during CheckHostKey/Authenticate in + golang.org/x/crypto/ssh + More info: https://pkg.go.dev/vuln/GO-2026-5015 + Module: golang.org/x/crypto + Found in: golang.org/x/crypto@v0.31.0 + Fixed in: golang.org/x/crypto@v0.52.0 + Vulnerable symbols found: + #1: ssh.CertChecker.Authenticate + #2: ssh.CertChecker.Authenticate + #3: ssh.CertChecker.CheckHostKey + #4: ssh.CertChecker.CheckHostKey + +Vulnerability #37: GO-2026-5014 + Invoking bypass of certificate restrictions in golang.org/x/crypto/ssh + More info: https://pkg.go.dev/vuln/GO-2026-5014 + Module: golang.org/x/crypto + Found in: golang.org/x/crypto@v0.31.0 + Fixed in: golang.org/x/crypto@v0.52.0 + Vulnerable symbols found: + #1: ssh.NewServerConn + #2: ssh.NewServerConn + #3: ssh.NewServerConn + #4: ssh.NewServerConn + #5: ssh.NewServerConn + Use '-show traces' to see the other 7 found symbols + +Vulnerability #38: GO-2026-5013 + Invoking byte arithmetic causes underflow and panic in + golang.org/x/crypto/ssh + More info: https://pkg.go.dev/vuln/GO-2026-5013 + Module: golang.org/x/crypto + Found in: golang.org/x/crypto@v0.31.0 + Fixed in: golang.org/x/crypto@v0.52.0 + Vulnerable symbols found: + #1: ssh.Dial + #2: ssh.Dial + #3: ssh.Dial + #4: ssh.Dial + #5: ssh.Dial + Use '-show traces' to see the other 51 found symbols + +Vulnerability #39: GO-2026-5006 + Invoking agent constraints dropped when forwarding keys in + golang.org/x/crypto/ssh/agent + More info: https://pkg.go.dev/vuln/GO-2026-5006 + Module: golang.org/x/crypto + Found in: golang.org/x/crypto@v0.31.0 + Fixed in: golang.org/x/crypto@v0.52.0 + Vulnerable symbols found: + #1: agent.client.Add + #2: agent.keyring.Add + #3: agent.keyring.Add + +Vulnerability #40: GO-2026-5005 + Invoking key constraints not enforced in golang.org/x/crypto/ssh/agent + More info: https://pkg.go.dev/vuln/GO-2026-5005 + Module: golang.org/x/crypto + Found in: golang.org/x/crypto@v0.31.0 + Fixed in: golang.org/x/crypto@v0.52.0 + Vulnerable symbols found: + #1: agent.keyring.Add + #2: agent.keyring.Add + +Vulnerability #41: GO-2026-4986 + Quadratic string concatentation in consumeComment in net/mail + More info: https://pkg.go.dev/vuln/GO-2026-4986 + Standard library + Found in: net/mail@go1.24.13 + Fixed in: net/mail@go1.25.10 + Vulnerable symbols found: + #1: mail.AddressParser.Parse + #2: mail.AddressParser.Parse + #3: mail.AddressParser.ParseList + #4: mail.AddressParser.ParseList + #5: mail.Header.AddressList + Use '-show traces' to see the other 7 found symbols + +Vulnerability #42: GO-2026-4982 + Bypass of meta content URL escaping causes XSS in html/template + More info: https://pkg.go.dev/vuln/GO-2026-4982 + Standard library + Found in: html/template@go1.24.13 + Fixed in: html/template@go1.25.10 + Vulnerable symbols found: + #1: template.Template.Execute + #2: template.Template.Execute + #3: template.Template.Execute + #4: template.Template.Execute + #5: template.Template.Execute + Use '-show traces' to see the other 9 found symbols + +Vulnerability #43: GO-2026-4981 + Crash when handling long CNAME response in net + More info: https://pkg.go.dev/vuln/GO-2026-4981 + Standard library + Found in: net@go1.24.13 + Fixed in: net@go1.25.10 + Vulnerable symbols found: + #1: net.LookupCNAME + #2: net.LookupCNAME + #3: net.Resolver.LookupCNAME + #4: net.Resolver.LookupCNAME + +Vulnerability #44: GO-2026-4980 + Escaper bypass leads to XSS in html/template + More info: https://pkg.go.dev/vuln/GO-2026-4980 + Standard library + Found in: html/template@go1.24.13 + Fixed in: html/template@go1.25.10 + Vulnerable symbols found: + #1: template.Template.Execute + #2: template.Template.Execute + #3: template.Template.Execute + #4: template.Template.Execute + #5: template.Template.Execute + Use '-show traces' to see the other 9 found symbols + +Vulnerability #45: GO-2026-4977 + Quadratic string concatenation in consumePhrase in net/mail + More info: https://pkg.go.dev/vuln/GO-2026-4977 + Standard library + Found in: net/mail@go1.24.13 + Fixed in: net/mail@go1.25.10 + Vulnerable symbols found: + #1: mail.AddressParser.Parse + #2: mail.AddressParser.Parse + #3: mail.AddressParser.ParseList + #4: mail.AddressParser.ParseList + #5: mail.Header.AddressList + Use '-show traces' to see the other 5 found symbols + +Vulnerability #46: GO-2026-4976 + ReverseProxy forwards queries with more than urlmaxqueryparams parameters in + net/http/httputil + More info: https://pkg.go.dev/vuln/GO-2026-4976 + Standard library + Found in: net/http/httputil@go1.24.13 + Fixed in: net/http/httputil@go1.25.10 + Vulnerable symbols found: + #1: httputil.ReverseProxy.ServeHTTP + #2: httputil.ReverseProxy.ServeHTTP + +Vulnerability #47: GO-2026-4971 + Panic in Dial and LookupPort when handling NUL byte on Windows in net + More info: https://pkg.go.dev/vuln/GO-2026-4971 + Standard library + Found in: net@go1.24.13 + Fixed in: net@go1.25.10 + Vulnerable symbols found: + #1: net.Dial + #2: net.DialTimeout + #3: net.Dialer.Dial + #4: net.Dialer.DialContext + #5: net.Listen + Use '-show traces' to see the other 28 found symbols + +Vulnerability #48: GO-2026-4970 + Root escape via symlink plus trailing slash in os + More info: https://pkg.go.dev/vuln/GO-2026-4970 + Standard library + Found in: os@go1.24.13 + Fixed in: os@go1.25.12 + Vulnerable symbols found: + #1: os.OpenInRoot + #2: os.Root.Create + #3: os.Root.Open + #4: os.Root.OpenFile + #5: os.Root.OpenRoot + Use '-show traces' to see the other 6 found symbols + +Vulnerability #49: GO-2026-4947 + Unexpected work during chain building in crypto/x509 + More info: https://pkg.go.dev/vuln/GO-2026-4947 + Standard library + Found in: crypto/x509@go1.24.13 + Fixed in: crypto/x509@go1.25.9 + Vulnerable symbols found: + #1: x509.Certificate.Verify + #2: x509.Certificate.Verify + #3: x509.Certificate.Verify + +Vulnerability #50: GO-2026-4946 + Inefficient policy validation in crypto/x509 + More info: https://pkg.go.dev/vuln/GO-2026-4946 + Standard library + Found in: crypto/x509@go1.24.13 + Fixed in: crypto/x509@go1.25.9 + Vulnerable symbols found: + #1: x509.Certificate.Verify + #2: x509.Certificate.Verify + #3: x509.Certificate.Verify + +Vulnerability #51: GO-2026-4918 + Infinite loop in HTTP/2 transport when given bad SETTINGS_MAX_FRAME_SIZE in + net/http/internal/http2 in golang.org/x/net + More info: https://pkg.go.dev/vuln/GO-2026-4918 + Standard library + Found in: net/http@go1.24.13 + Fixed in: net/http@go1.25.10 + Vulnerable symbols found: + #1: http.Client.CloseIdleConnections + #2: http.Client.CloseIdleConnections + #3: http.Client.CloseIdleConnections + #4: http.Client.CloseIdleConnections + #5: http.Client.CloseIdleConnections + Use '-show traces' to see the other 321 found symbols + +Vulnerability #52: GO-2026-4870 + Unauthenticated TLS 1.3 KeyUpdate record can cause persistent connection + retention and DoS in crypto/tls + More info: https://pkg.go.dev/vuln/GO-2026-4870 + Standard library + Found in: crypto/tls@go1.24.13 + Fixed in: crypto/tls@go1.25.9 + Vulnerable symbols found: + #1: tls.Conn.Handshake + #2: tls.Conn.Handshake + #3: tls.Conn.Handshake + #4: tls.Conn.Handshake + #5: tls.Conn.HandshakeContext + Use '-show traces' to see the other 34 found symbols + +Vulnerability #53: GO-2026-4869 + Unbounded allocation for old GNU sparse in archive/tar + More info: https://pkg.go.dev/vuln/GO-2026-4869 + Standard library + Found in: archive/tar@go1.24.13 + Fixed in: archive/tar@go1.25.9 + Vulnerable symbols found: + #1: tar.Reader.Next + +Vulnerability #54: GO-2026-4865 + JsBraceDepth Context Tracking Bugs (XSS) in html/template + More info: https://pkg.go.dev/vuln/GO-2026-4865 + Standard library + Found in: html/template@go1.24.13 + Fixed in: html/template@go1.25.9 + Vulnerable symbols found: + #1: template.Error.Error + #2: template.HTMLEscaper + #3: template.JSEscape + #4: template.JSEscapeString + #5: template.JSEscaper + Use '-show traces' to see the other 27 found symbols + +Vulnerability #55: GO-2026-4864 + TOCTOU permits root escape on Linux via Root.Chmod in os in + internal/syscall/unix + More info: https://pkg.go.dev/vuln/GO-2026-4864 + Standard library + Found in: internal/syscall/unix@go1.24.13 + Fixed in: internal/syscall/unix@go1.25.9 + Platforms: linux + Vulnerable symbols found: + #1: unix.Fchmodat + +Vulnerability #56: GO-2026-4603 + URLs in meta content attribute actions are not escaped in html/template + More info: https://pkg.go.dev/vuln/GO-2026-4603 + Standard library + Found in: html/template@go1.24.13 + Fixed in: html/template@go1.25.8 + Vulnerable symbols found: + #1: template.Template.Execute + #2: template.Template.Execute + #3: template.Template.Execute + #4: template.Template.Execute + #5: template.Template.Execute + Use '-show traces' to see the other 9 found symbols + +Vulnerability #57: GO-2026-4602 + FileInfo can escape from a Root in os + More info: https://pkg.go.dev/vuln/GO-2026-4602 + Standard library + Found in: os@go1.24.13 + Fixed in: os@go1.25.8 + Vulnerable symbols found: + #1: os.File.ReadDir + #2: os.File.Readdir + #3: os.ReadDir + #4: os.dirFS.ReadDir + #5: os.rootFS.ReadDir + Use '-show traces' to see the other 1 found symbols + +Vulnerability #58: GO-2026-4601 + Incorrect parsing of IPv6 host literals in net/url + More info: https://pkg.go.dev/vuln/GO-2026-4601 + Standard library + Found in: net/url@go1.24.13 + Fixed in: net/url@go1.25.8 + Vulnerable symbols found: + #1: url.JoinPath + #2: url.Parse + #3: url.ParseRequestURI + #4: url.URL.Parse + #5: url.URL.Parse + Use '-show traces' to see the other 1 found symbols + +Vulnerability #59: GO-2025-4135 + Malformed constraint may cause denial of service in + golang.org/x/crypto/ssh/agent + More info: https://pkg.go.dev/vuln/GO-2025-4135 + Module: golang.org/x/crypto + Found in: golang.org/x/crypto@v0.31.0 + Fixed in: golang.org/x/crypto@v0.45.0 + Vulnerable symbols found: + #1: agent.ForwardToAgent + #2: agent.ForwardToAgent + #3: agent.ServeAgent + #4: agent.ServeAgent + +Vulnerability #60: GO-2025-4134 + Unbounded memory consumption in golang.org/x/crypto/ssh + More info: https://pkg.go.dev/vuln/GO-2025-4134 + Module: golang.org/x/crypto + Found in: golang.org/x/crypto@v0.31.0 + Fixed in: golang.org/x/crypto@v0.45.0 + Vulnerable symbols found: + #1: ssh.NewServerConn + #2: ssh.NewServerConn + #3: ssh.NewServerConn + #4: ssh.NewServerConn + #5: ssh.NewServerConn + Use '-show traces' to see the other 7 found symbols + +Vulnerability #61: GO-2025-4116 + Potential denial of service in golang.org/x/crypto/ssh/agent + More info: https://pkg.go.dev/vuln/GO-2025-4116 + Module: golang.org/x/crypto + Found in: golang.org/x/crypto@v0.31.0 + Fixed in: golang.org/x/crypto@v0.43.0 + Vulnerable symbols found: + #1: agent.agentKeyringSigner.Sign + #2: agent.agentKeyringSigner.SignWithAlgorithm + #3: agent.client.List + #4: agent.client.Sign + #5: agent.client.SignWithFlags + Use '-show traces' to see the other 1 found symbols + +Vulnerability #62: GO-2025-3487 + Potential denial of service in golang.org/x/crypto + More info: https://pkg.go.dev/vuln/GO-2025-3487 + Module: golang.org/x/crypto + Found in: golang.org/x/crypto@v0.31.0 + Fixed in: golang.org/x/crypto@v0.35.0 + Vulnerable symbols found: + #1: ssh.Client.Dial + #2: ssh.Client.DialContext + #3: ssh.Client.DialTCP + #4: ssh.Client.Listen + #5: ssh.Client.Listen + Use '-show traces' to see the other 117 found symbols + +Your code is affected by 62 vulnerabilities from 1 module and the Go standard library. +This scan found no other vulnerabilities in packages you import or modules you +require. +Use '-show verbose' for more details. diff --git a/documentation/audits/security-review-2026-10-12/scanners/govulncheck-source-agent.txt b/documentation/audits/security-review-2026-10-12/scanners/govulncheck-source-agent.txt new file mode 100644 index 00000000..8e7641a1 --- /dev/null +++ b/documentation/audits/security-review-2026-10-12/scanners/govulncheck-source-agent.txt @@ -0,0 +1,794 @@ +=== Symbol Results === + +Vulnerability #1: GO-2026-6617 + HTTP/2 server crash due to HPACK encoder race in net/http + More info: https://pkg.go.dev/vuln/GO-2026-6617 + Standard library + Found in: net/http@go1.26 + Fixed in: net/http@go1.26.9 + Example traces found: + #1: internal/hub/client.go:441:22: hub.Client.PostOSReport calls http.Client.Do + #2: internal/hub/client.go:441:22: hub.Client.PostOSReport calls http.Client.Do + #3: internal/hub/client.go:439:16: hub.Client.PostOSReport calls http.Header.Set + #4: internal/hub/client.go:439:16: hub.Client.PostOSReport calls http.Header.Set + #5: cmd/felhom-opsign/main.go:217:29: felhom.upload calls http.NewRequest + #6: cmd/felhom-opsign/main.go:217:29: felhom.upload calls http.NewRequest + #7: internal/hub/client.go:435:40: hub.Client.PostOSReport calls http.NewRequestWithContext + #8: internal/hub/client.go:435:40: hub.Client.PostOSReport calls http.NewRequestWithContext + #9: internal/selfupdate/executor.go:203:19: selfupdate.Executor.download calls http.Request.SetBasicAuth + #10: internal/selfupdate/executor.go:203:19: selfupdate.Executor.download calls http.Request.SetBasicAuth + #11: internal/localapi/server.go:526:16: localapi.Server.Handler calls http.ServeMux.HandleFunc + #12: internal/localapi/server.go:526:16: localapi.Server.Handler calls http.ServeMux.HandleFunc + #13: internal/localapi/server.go:624:34: localapi.Run calls http.Server.ServeTLS + #14: internal/localapi/server.go:624:34: localapi.Run calls http.Server.ServeTLS + #15: internal/localapi/server.go:630:19: localapi.Server.Run calls http.Server.Shutdown + #16: internal/localapi/server.go:630:19: localapi.Server.Run calls http.Server.Shutdown + #17: internal/hub/client.go:445:2: hub.Client.PostOSReport calls http.body.Close + #18: internal/hub/client.go:445:2: hub.Client.PostOSReport calls http.body.Close + #19: internal/hub/client.go:446:22: hub.Client.PostOSReport calls io.ReadAll, which calls http.body.Read + #20: internal/hub/client.go:446:22: hub.Client.PostOSReport calls io.ReadAll, which calls http.body.Read + #21: internal/hub/client.go:445:2: hub.Client.PostOSReport calls http.bodyEOFSignal.Close + #22: internal/hub/client.go:445:2: hub.Client.PostOSReport calls http.bodyEOFSignal.Close + #23: internal/hub/client.go:446:22: hub.Client.PostOSReport calls io.ReadAll, which calls http.bodyEOFSignal.Read + #24: internal/hub/client.go:446:22: hub.Client.PostOSReport calls io.ReadAll, which calls http.bodyEOFSignal.Read + #25: internal/hub/client.go:446:22: hub.Client.PostOSReport calls io.ReadAll, which eventually calls http.bodyLocked.Read + #26: internal/hub/client.go:446:22: hub.Client.PostOSReport calls io.ReadAll, which eventually calls http.bodyLocked.Read + #27: internal/selfupdate/executor.go:218:22: selfupdate.Executor.download calls io.Copy, which eventually calls http.bufioFlushWriter.Write + #28: internal/selfupdate/executor.go:218:22: selfupdate.Executor.download calls io.Copy, which eventually calls http.bufioFlushWriter.Write + #29: internal/hub/client.go:445:2: hub.Client.PostOSReport calls http.cancelTimerBody.Close + #30: internal/hub/client.go:445:2: hub.Client.PostOSReport calls http.cancelTimerBody.Close + #31: internal/hub/client.go:446:22: hub.Client.PostOSReport calls io.ReadAll, which calls http.cancelTimerBody.Read + #32: internal/hub/client.go:446:22: hub.Client.PostOSReport calls io.ReadAll, which calls http.cancelTimerBody.Read + #33: internal/lanresolver/lanresolver.go:48:13: lanresolver.RenderBase calls fmt.Fprintf, which eventually calls http.checkConnErrorWriter.Write + #34: internal/lanresolver/lanresolver.go:48:13: lanresolver.RenderBase calls fmt.Fprintf, which eventually calls http.checkConnErrorWriter.Write + #35: internal/lanresolver/lanresolver.go:48:13: lanresolver.RenderBase calls fmt.Fprintf, which eventually calls http.chunkWriter.Write + #36: internal/lanresolver/lanresolver.go:48:13: lanresolver.RenderBase calls fmt.Fprintf, which eventually calls http.chunkWriter.Write + #37: internal/hub/client.go:446:22: hub.Client.PostOSReport calls io.ReadAll, which eventually calls http.connReader.Read + #38: internal/hub/client.go:446:22: hub.Client.PostOSReport calls io.ReadAll, which eventually calls http.connReader.Read + #39: internal/hub/client.go:446:22: hub.Client.PostOSReport calls io.ReadAll, which eventually calls http.expectContinueReader.Read + #40: internal/hub/client.go:446:22: hub.Client.PostOSReport calls io.ReadAll, which eventually calls http.expectContinueReader.Read + #41: internal/hub/client.go:445:2: hub.Client.PostOSReport calls http.gzipReader.Close + #42: internal/hub/client.go:445:2: hub.Client.PostOSReport calls http.gzipReader.Close + #43: internal/hub/client.go:446:22: hub.Client.PostOSReport calls io.ReadAll, which calls http.gzipReader.Read + #44: internal/hub/client.go:446:22: hub.Client.PostOSReport calls io.ReadAll, which calls http.gzipReader.Read + #45: internal/localapi/stalelock.go:284:35: localapi.runnerError.Error calls http.http2ConnectionError.Error + #46: internal/localapi/stalelock.go:284:35: localapi.runnerError.Error calls http.http2ConnectionError.Error + #47: cmd/felhom-agent/main.go:220:16: felhom.main calls fmt.Fprintln, which eventually calls http.http2ErrCode.String + #48: cmd/felhom-agent/main.go:220:16: felhom.main calls fmt.Fprintln, which eventually calls http.http2ErrCode.String + #49: cmd/felhom-agent/main.go:220:16: felhom.main calls fmt.Fprintln, which eventually calls http.http2FrameHeader.String + #50: cmd/felhom-agent/main.go:220:16: felhom.main calls fmt.Fprintln, which eventually calls http.http2FrameHeader.String + #51: cmd/felhom-agent/main.go:220:16: felhom.main calls fmt.Fprintln, which eventually calls http.http2FrameType.String + #52: cmd/felhom-agent/main.go:220:16: felhom.main calls fmt.Fprintln, which eventually calls http.http2FrameType.String + #53: cmd/felhom-agent/main.go:220:16: felhom.main calls fmt.Fprintln, which eventually calls http.http2FrameWriteRequest.String + #54: cmd/felhom-agent/main.go:220:16: felhom.main calls fmt.Fprintln, which eventually calls http.http2FrameWriteRequest.String + #55: internal/localapi/stalelock.go:284:35: localapi.runnerError.Error calls http.http2GoAwayError.Error + #56: internal/localapi/stalelock.go:284:35: localapi.runnerError.Error calls http.http2GoAwayError.Error + #57: cmd/felhom-agent/main.go:220:16: felhom.main calls fmt.Fprintln, which eventually calls http.http2Setting.String + #58: cmd/felhom-agent/main.go:220:16: felhom.main calls fmt.Fprintln, which eventually calls http.http2Setting.String + #59: cmd/felhom-agent/main.go:220:16: felhom.main calls fmt.Fprintln, which eventually calls http.http2SettingID.String + #60: cmd/felhom-agent/main.go:220:16: felhom.main calls fmt.Fprintln, which eventually calls http.http2SettingID.String + #61: internal/localapi/stalelock.go:284:35: localapi.runnerError.Error calls http.http2StreamError.Error + #62: internal/localapi/stalelock.go:284:35: localapi.runnerError.Error calls http.http2StreamError.Error + #63: internal/lanresolver/lanresolver.go:48:13: lanresolver.RenderBase calls fmt.Fprintf, which eventually calls http.http2bufferedWriterTimeoutWriter.Write + #64: internal/lanresolver/lanresolver.go:48:13: lanresolver.RenderBase calls fmt.Fprintf, which eventually calls http.http2bufferedWriterTimeoutWriter.Write + #65: internal/lanresolver/lanresolver.go:48:13: lanresolver.RenderBase calls fmt.Fprintf, which eventually calls http.http2chunkWriter.Write + #66: internal/lanresolver/lanresolver.go:48:13: lanresolver.RenderBase calls fmt.Fprintf, which eventually calls http.http2chunkWriter.Write + #67: internal/localapi/stalelock.go:284:35: localapi.runnerError.Error calls http.http2connError.Error + #68: internal/localapi/stalelock.go:284:35: localapi.runnerError.Error calls http.http2connError.Error + #69: internal/localapi/stalelock.go:284:35: localapi.runnerError.Error calls http.http2duplicatePseudoHeaderError.Error + #70: internal/localapi/stalelock.go:284:35: localapi.runnerError.Error calls http.http2duplicatePseudoHeaderError.Error + #71: internal/hub/client.go:445:2: hub.Client.PostOSReport calls http.http2gzipReader.Close + #72: internal/hub/client.go:445:2: hub.Client.PostOSReport calls http.http2gzipReader.Close + #73: internal/hub/client.go:446:22: hub.Client.PostOSReport calls io.ReadAll, which calls http.http2gzipReader.Read + #74: internal/hub/client.go:446:22: hub.Client.PostOSReport calls io.ReadAll, which calls http.http2gzipReader.Read + #75: internal/localapi/stalelock.go:284:35: localapi.runnerError.Error calls http.http2headerFieldNameError.Error + #76: internal/localapi/stalelock.go:284:35: localapi.runnerError.Error calls http.http2headerFieldNameError.Error + #77: internal/localapi/stalelock.go:284:35: localapi.runnerError.Error calls http.http2headerFieldValueError.Error + #78: internal/localapi/stalelock.go:284:35: localapi.runnerError.Error calls http.http2headerFieldValueError.Error + #79: internal/localapi/stalelock.go:284:35: localapi.runnerError.Error calls http.http2pseudoHeaderError.Error + #80: internal/localapi/stalelock.go:284:35: localapi.runnerError.Error calls http.http2pseudoHeaderError.Error + #81: internal/hub/client.go:446:22: hub.Client.PostOSReport calls io.ReadAll, which eventually calls http.http2requestBody.Read + #82: internal/hub/client.go:446:22: hub.Client.PostOSReport calls io.ReadAll, which eventually calls http.http2requestBody.Read + #83: cmd/felhom-agent/main.go:220:16: felhom.main calls fmt.Fprintln, which calls http.http2responseWriter.Write + #84: cmd/felhom-agent/main.go:220:16: felhom.main calls fmt.Fprintln, which calls http.http2responseWriter.Write + #85: internal/localapi/debuglogs.go:50:31: localapi.statusRecorder.WriteHeader calls http.http2responseWriter.WriteHeader + #86: internal/localapi/debuglogs.go:50:31: localapi.statusRecorder.WriteHeader calls http.http2responseWriter.WriteHeader + #87: internal/selfupdate/executor.go:218:22: selfupdate.Executor.download calls io.Copy, which eventually calls http.http2responseWriter.WriteString + #88: internal/selfupdate/executor.go:218:22: selfupdate.Executor.download calls io.Copy, which eventually calls http.http2responseWriter.WriteString + #89: internal/lanresolver/lanresolver.go:48:13: lanresolver.RenderBase calls fmt.Fprintf, which eventually calls http.http2stickyErrWriter.Write + #90: internal/lanresolver/lanresolver.go:48:13: lanresolver.RenderBase calls fmt.Fprintf, which eventually calls http.http2stickyErrWriter.Write + #91: internal/hub/client.go:445:2: hub.Client.PostOSReport calls http.http2transportResponseBody.Close + #92: internal/hub/client.go:445:2: hub.Client.PostOSReport calls http.http2transportResponseBody.Close + #93: internal/hub/client.go:446:22: hub.Client.PostOSReport calls io.ReadAll, which calls http.http2transportResponseBody.Read + #94: internal/hub/client.go:446:22: hub.Client.PostOSReport calls io.ReadAll, which calls http.http2transportResponseBody.Read + #95: cmd/felhom-agent/main.go:220:16: felhom.main calls fmt.Fprintln, which eventually calls http.http2writeData.String + #96: cmd/felhom-agent/main.go:220:16: felhom.main calls fmt.Fprintln, which eventually calls http.http2writeData.String + #97: internal/hub/client.go:446:22: hub.Client.PostOSReport calls io.ReadAll, which eventually calls http.loggingConn.Read + #98: internal/hub/client.go:446:22: hub.Client.PostOSReport calls io.ReadAll, which eventually calls http.loggingConn.Read + #99: internal/lanresolver/lanresolver.go:48:13: lanresolver.RenderBase calls fmt.Fprintf, which calls http.loggingConn.Write + #100: internal/lanresolver/lanresolver.go:48:13: lanresolver.RenderBase calls fmt.Fprintf, which calls http.loggingConn.Write + #101: internal/hub/client.go:446:22: hub.Client.PostOSReport calls io.ReadAll, which eventually calls http.maxBytesReader.Read + #102: internal/hub/client.go:446:22: hub.Client.PostOSReport calls io.ReadAll, which eventually calls http.maxBytesReader.Read + #103: internal/pvegate/pvegate.go:76:10: pvegate.Step calls sync.Once.Do, which eventually calls http.onceCloseListener.Close + #104: internal/pvegate/pvegate.go:76:10: pvegate.Step calls sync.Once.Do, which eventually calls http.onceCloseListener.Close + #105: internal/hub/client.go:446:22: hub.Client.PostOSReport calls io.ReadAll, which eventually calls http.persistConn.Read + #106: internal/hub/client.go:446:22: hub.Client.PostOSReport calls io.ReadAll, which eventually calls http.persistConn.Read + #107: internal/selfupdate/executor.go:218:22: selfupdate.Executor.download calls io.Copy, which eventually calls http.persistConnWriter.ReadFrom + #108: internal/selfupdate/executor.go:218:22: selfupdate.Executor.download calls io.Copy, which eventually calls http.persistConnWriter.ReadFrom + #109: internal/lanresolver/lanresolver.go:48:13: lanresolver.RenderBase calls fmt.Fprintf, which eventually calls http.persistConnWriter.Write + #110: internal/lanresolver/lanresolver.go:48:13: lanresolver.RenderBase calls fmt.Fprintf, which eventually calls http.persistConnWriter.Write + #111: internal/hub/client.go:446:22: hub.Client.PostOSReport calls io.ReadAll, which eventually calls http.readTrackingBody.Read + #112: internal/hub/client.go:446:22: hub.Client.PostOSReport calls io.ReadAll, which eventually calls http.readTrackingBody.Read + #113: internal/hub/client.go:446:22: hub.Client.PostOSReport calls io.ReadAll, which calls http.readWriteCloserBody.Read + #114: internal/hub/client.go:446:22: hub.Client.PostOSReport calls io.ReadAll, which calls http.readWriteCloserBody.Read + #115: cmd/felhom-agent/main.go:220:16: felhom.main calls fmt.Fprintln, which calls http.response.Write + #116: cmd/felhom-agent/main.go:220:16: felhom.main calls fmt.Fprintln, which calls http.response.Write + #117: internal/localapi/debuglogs.go:50:31: localapi.statusRecorder.WriteHeader calls http.response.WriteHeader + #118: internal/localapi/debuglogs.go:50:31: localapi.statusRecorder.WriteHeader calls http.response.WriteHeader + #119: internal/localapi/stalelock.go:284:35: localapi.runnerError.Error calls http.transportReadFromServerError.Error + #120: internal/localapi/stalelock.go:284:35: localapi.runnerError.Error calls http.transportReadFromServerError.Error + +Vulnerability #2: GO-2026-6613 + HTTP/1 server connection desynchronization after 2xx CONNECT response in + net/http + More info: https://pkg.go.dev/vuln/GO-2026-6613 + Standard library + Found in: net/http@go1.26 + Fixed in: net/http@go1.26.9 + Example traces found: + #1: internal/lanresolver/lanresolver.go:48:13: lanresolver.RenderBase calls fmt.Fprintf, which eventually calls http.CanonicalHeaderKey + #2: internal/hub/client.go:441:22: hub.Client.PostOSReport calls http.Client.Do + #3: internal/localapi/debuglogs.go:50:31: localapi.statusRecorder.WriteHeader calls http.http2responseWriter.WriteHeader, which eventually calls http.Header.Del + #4: internal/lanresolver/lanresolver.go:48:13: lanresolver.RenderBase calls fmt.Fprintf, which eventually calls http.Header.Get + #5: internal/hub/client.go:439:16: hub.Client.PostOSReport calls http.Header.Set + #6: cmd/felhom-opsign/main.go:217:29: felhom.upload calls http.NewRequest + #7: internal/hub/client.go:435:40: hub.Client.PostOSReport calls http.NewRequestWithContext + #8: internal/selfupdate/executor.go:203:19: selfupdate.Executor.download calls http.Request.SetBasicAuth + #9: internal/localapi/server.go:526:16: localapi.Server.Handler calls http.ServeMux.HandleFunc + #10: internal/localapi/server.go:624:34: localapi.Run calls http.Server.ServeTLS + #11: internal/localapi/server.go:630:19: localapi.Server.Run calls http.Server.Shutdown + #12: internal/hub/client.go:445:2: hub.Client.PostOSReport calls http.body.Close + #13: internal/hub/client.go:446:22: hub.Client.PostOSReport calls io.ReadAll, which calls http.body.Read + #14: internal/hub/client.go:445:2: hub.Client.PostOSReport calls http.bodyEOFSignal.Close + #15: internal/hub/client.go:446:22: hub.Client.PostOSReport calls io.ReadAll, which calls http.bodyEOFSignal.Read + #16: internal/hub/client.go:446:22: hub.Client.PostOSReport calls io.ReadAll, which eventually calls http.bodyLocked.Read + #17: internal/selfupdate/executor.go:218:22: selfupdate.Executor.download calls io.Copy, which eventually calls http.bufioFlushWriter.Write + #18: internal/hub/client.go:445:2: hub.Client.PostOSReport calls http.cancelTimerBody.Close + #19: internal/hub/client.go:446:22: hub.Client.PostOSReport calls io.ReadAll, which calls http.cancelTimerBody.Read + #20: internal/lanresolver/lanresolver.go:48:13: lanresolver.RenderBase calls fmt.Fprintf, which eventually calls http.checkConnErrorWriter.Write + #21: internal/lanresolver/lanresolver.go:48:13: lanresolver.RenderBase calls fmt.Fprintf, which eventually calls http.chunkWriter.Write + #22: internal/hub/client.go:446:22: hub.Client.PostOSReport calls io.ReadAll, which eventually calls http.connReader.Read + #23: internal/hub/client.go:445:2: hub.Client.PostOSReport calls http.http2transportResponseBody.Close, which eventually calls http.expectContinueReader.Close + #24: internal/hub/client.go:446:22: hub.Client.PostOSReport calls io.ReadAll, which eventually calls http.expectContinueReader.Read + #25: internal/hub/client.go:445:2: hub.Client.PostOSReport calls http.gzipReader.Close + #26: internal/hub/client.go:446:22: hub.Client.PostOSReport calls io.ReadAll, which calls http.gzipReader.Read + #27: internal/hub/client.go:446:22: hub.Client.PostOSReport calls io.ReadAll, which eventually calls http.loggingConn.Read + #28: internal/lanresolver/lanresolver.go:48:13: lanresolver.RenderBase calls fmt.Fprintf, which calls http.loggingConn.Write + #29: internal/hub/client.go:446:22: hub.Client.PostOSReport calls io.ReadAll, which eventually calls http.maxBytesReader.Read + #30: internal/pvegate/pvegate.go:76:10: pvegate.Step calls sync.Once.Do, which eventually calls http.onceCloseListener.Close + #31: internal/hub/client.go:446:22: hub.Client.PostOSReport calls io.ReadAll, which eventually calls http.persistConn.Read + #32: internal/selfupdate/executor.go:218:22: selfupdate.Executor.download calls io.Copy, which eventually calls http.persistConnWriter.ReadFrom + #33: internal/lanresolver/lanresolver.go:48:13: lanresolver.RenderBase calls fmt.Fprintf, which eventually calls http.persistConnWriter.Write + #34: internal/hub/client.go:445:2: hub.Client.PostOSReport calls http.http2transportResponseBody.Close, which eventually calls http.readTrackingBody.Close + #35: internal/hub/client.go:446:22: hub.Client.PostOSReport calls io.ReadAll, which eventually calls http.readTrackingBody.Read + #36: internal/hub/client.go:446:22: hub.Client.PostOSReport calls io.ReadAll, which calls http.readWriteCloserBody.Read + #37: cmd/felhom-agent/main.go:220:16: felhom.main calls fmt.Fprintln, which calls http.response.Write + #38: internal/localapi/debuglogs.go:50:31: localapi.statusRecorder.WriteHeader calls http.response.WriteHeader + #39: internal/localapi/stalelock.go:284:35: localapi.runnerError.Error calls http.transportReadFromServerError.Error + +Vulnerability #3: GO-2026-6612 + Double flow control refund on HTTP/2 server streams in net/http + More info: https://pkg.go.dev/vuln/GO-2026-6612 + Standard library + Found in: net/http@go1.26 + Fixed in: net/http@go1.26.9 + Example traces found: + #1: internal/hub/client.go:441:22: hub.Client.PostOSReport calls http.Client.Do + #2: internal/hub/client.go:441:22: hub.Client.PostOSReport calls http.Client.Do + #3: internal/hub/client.go:439:16: hub.Client.PostOSReport calls http.Header.Set + #4: internal/hub/client.go:439:16: hub.Client.PostOSReport calls http.Header.Set + #5: cmd/felhom-opsign/main.go:217:29: felhom.upload calls http.NewRequest + #6: cmd/felhom-opsign/main.go:217:29: felhom.upload calls http.NewRequest + #7: internal/hub/client.go:435:40: hub.Client.PostOSReport calls http.NewRequestWithContext + #8: internal/hub/client.go:435:40: hub.Client.PostOSReport calls http.NewRequestWithContext + #9: internal/selfupdate/executor.go:203:19: selfupdate.Executor.download calls http.Request.SetBasicAuth + #10: internal/selfupdate/executor.go:203:19: selfupdate.Executor.download calls http.Request.SetBasicAuth + #11: internal/localapi/server.go:526:16: localapi.Server.Handler calls http.ServeMux.HandleFunc + #12: internal/localapi/server.go:526:16: localapi.Server.Handler calls http.ServeMux.HandleFunc + #13: internal/localapi/server.go:624:34: localapi.Run calls http.Server.ServeTLS + #14: internal/localapi/server.go:624:34: localapi.Run calls http.Server.ServeTLS + #15: internal/localapi/server.go:630:19: localapi.Server.Run calls http.Server.Shutdown + #16: internal/localapi/server.go:630:19: localapi.Server.Run calls http.Server.Shutdown + #17: internal/hub/client.go:445:2: hub.Client.PostOSReport calls http.body.Close + #18: internal/hub/client.go:445:2: hub.Client.PostOSReport calls http.body.Close + #19: internal/hub/client.go:446:22: hub.Client.PostOSReport calls io.ReadAll, which calls http.body.Read + #20: internal/hub/client.go:446:22: hub.Client.PostOSReport calls io.ReadAll, which calls http.body.Read + #21: internal/hub/client.go:445:2: hub.Client.PostOSReport calls http.bodyEOFSignal.Close + #22: internal/hub/client.go:445:2: hub.Client.PostOSReport calls http.bodyEOFSignal.Close + #23: internal/hub/client.go:446:22: hub.Client.PostOSReport calls io.ReadAll, which calls http.bodyEOFSignal.Read + #24: internal/hub/client.go:446:22: hub.Client.PostOSReport calls io.ReadAll, which calls http.bodyEOFSignal.Read + #25: internal/hub/client.go:446:22: hub.Client.PostOSReport calls io.ReadAll, which eventually calls http.bodyLocked.Read + #26: internal/hub/client.go:446:22: hub.Client.PostOSReport calls io.ReadAll, which eventually calls http.bodyLocked.Read + #27: internal/selfupdate/executor.go:218:22: selfupdate.Executor.download calls io.Copy, which eventually calls http.bufioFlushWriter.Write + #28: internal/selfupdate/executor.go:218:22: selfupdate.Executor.download calls io.Copy, which eventually calls http.bufioFlushWriter.Write + #29: internal/hub/client.go:445:2: hub.Client.PostOSReport calls http.cancelTimerBody.Close + #30: internal/hub/client.go:445:2: hub.Client.PostOSReport calls http.cancelTimerBody.Close + #31: internal/hub/client.go:446:22: hub.Client.PostOSReport calls io.ReadAll, which calls http.cancelTimerBody.Read + #32: internal/hub/client.go:446:22: hub.Client.PostOSReport calls io.ReadAll, which calls http.cancelTimerBody.Read + #33: internal/lanresolver/lanresolver.go:48:13: lanresolver.RenderBase calls fmt.Fprintf, which eventually calls http.checkConnErrorWriter.Write + #34: internal/lanresolver/lanresolver.go:48:13: lanresolver.RenderBase calls fmt.Fprintf, which eventually calls http.checkConnErrorWriter.Write + #35: internal/lanresolver/lanresolver.go:48:13: lanresolver.RenderBase calls fmt.Fprintf, which eventually calls http.chunkWriter.Write + #36: internal/lanresolver/lanresolver.go:48:13: lanresolver.RenderBase calls fmt.Fprintf, which eventually calls http.chunkWriter.Write + #37: internal/hub/client.go:446:22: hub.Client.PostOSReport calls io.ReadAll, which eventually calls http.connReader.Read + #38: internal/hub/client.go:446:22: hub.Client.PostOSReport calls io.ReadAll, which eventually calls http.connReader.Read + #39: internal/hub/client.go:446:22: hub.Client.PostOSReport calls io.ReadAll, which eventually calls http.expectContinueReader.Read + #40: internal/hub/client.go:446:22: hub.Client.PostOSReport calls io.ReadAll, which eventually calls http.expectContinueReader.Read + #41: internal/hub/client.go:445:2: hub.Client.PostOSReport calls http.gzipReader.Close + #42: internal/hub/client.go:445:2: hub.Client.PostOSReport calls http.gzipReader.Close + #43: internal/hub/client.go:446:22: hub.Client.PostOSReport calls io.ReadAll, which calls http.gzipReader.Read + #44: internal/hub/client.go:446:22: hub.Client.PostOSReport calls io.ReadAll, which calls http.gzipReader.Read + #45: internal/localapi/stalelock.go:284:35: localapi.runnerError.Error calls http.http2ConnectionError.Error + #46: internal/localapi/stalelock.go:284:35: localapi.runnerError.Error calls http.http2ConnectionError.Error + #47: cmd/felhom-agent/main.go:220:16: felhom.main calls fmt.Fprintln, which eventually calls http.http2ErrCode.String + #48: cmd/felhom-agent/main.go:220:16: felhom.main calls fmt.Fprintln, which eventually calls http.http2ErrCode.String + #49: cmd/felhom-agent/main.go:220:16: felhom.main calls fmt.Fprintln, which eventually calls http.http2FrameHeader.String + #50: cmd/felhom-agent/main.go:220:16: felhom.main calls fmt.Fprintln, which eventually calls http.http2FrameHeader.String + #51: cmd/felhom-agent/main.go:220:16: felhom.main calls fmt.Fprintln, which eventually calls http.http2FrameType.String + #52: cmd/felhom-agent/main.go:220:16: felhom.main calls fmt.Fprintln, which eventually calls http.http2FrameType.String + #53: cmd/felhom-agent/main.go:220:16: felhom.main calls fmt.Fprintln, which eventually calls http.http2FrameWriteRequest.String + #54: cmd/felhom-agent/main.go:220:16: felhom.main calls fmt.Fprintln, which eventually calls http.http2FrameWriteRequest.String + #55: internal/localapi/stalelock.go:284:35: localapi.runnerError.Error calls http.http2GoAwayError.Error + #56: internal/localapi/stalelock.go:284:35: localapi.runnerError.Error calls http.http2GoAwayError.Error + #57: cmd/felhom-agent/main.go:220:16: felhom.main calls fmt.Fprintln, which eventually calls http.http2Setting.String + #58: cmd/felhom-agent/main.go:220:16: felhom.main calls fmt.Fprintln, which eventually calls http.http2Setting.String + #59: cmd/felhom-agent/main.go:220:16: felhom.main calls fmt.Fprintln, which eventually calls http.http2SettingID.String + #60: cmd/felhom-agent/main.go:220:16: felhom.main calls fmt.Fprintln, which eventually calls http.http2SettingID.String + #61: internal/localapi/stalelock.go:284:35: localapi.runnerError.Error calls http.http2StreamError.Error + #62: internal/localapi/stalelock.go:284:35: localapi.runnerError.Error calls http.http2StreamError.Error + #63: internal/lanresolver/lanresolver.go:48:13: lanresolver.RenderBase calls fmt.Fprintf, which eventually calls http.http2bufferedWriterTimeoutWriter.Write + #64: internal/lanresolver/lanresolver.go:48:13: lanresolver.RenderBase calls fmt.Fprintf, which eventually calls http.http2bufferedWriterTimeoutWriter.Write + #65: internal/lanresolver/lanresolver.go:48:13: lanresolver.RenderBase calls fmt.Fprintf, which eventually calls http.http2chunkWriter.Write + #66: internal/lanresolver/lanresolver.go:48:13: lanresolver.RenderBase calls fmt.Fprintf, which eventually calls http.http2chunkWriter.Write + #67: internal/localapi/stalelock.go:284:35: localapi.runnerError.Error calls http.http2connError.Error + #68: internal/localapi/stalelock.go:284:35: localapi.runnerError.Error calls http.http2connError.Error + #69: internal/localapi/stalelock.go:284:35: localapi.runnerError.Error calls http.http2duplicatePseudoHeaderError.Error + #70: internal/localapi/stalelock.go:284:35: localapi.runnerError.Error calls http.http2duplicatePseudoHeaderError.Error + #71: internal/hub/client.go:445:2: hub.Client.PostOSReport calls http.http2gzipReader.Close + #72: internal/hub/client.go:445:2: hub.Client.PostOSReport calls http.http2gzipReader.Close + #73: internal/hub/client.go:446:22: hub.Client.PostOSReport calls io.ReadAll, which calls http.http2gzipReader.Read + #74: internal/hub/client.go:446:22: hub.Client.PostOSReport calls io.ReadAll, which calls http.http2gzipReader.Read + #75: internal/localapi/stalelock.go:284:35: localapi.runnerError.Error calls http.http2headerFieldNameError.Error + #76: internal/localapi/stalelock.go:284:35: localapi.runnerError.Error calls http.http2headerFieldNameError.Error + #77: internal/localapi/stalelock.go:284:35: localapi.runnerError.Error calls http.http2headerFieldValueError.Error + #78: internal/localapi/stalelock.go:284:35: localapi.runnerError.Error calls http.http2headerFieldValueError.Error + #79: internal/localapi/stalelock.go:284:35: localapi.runnerError.Error calls http.http2pseudoHeaderError.Error + #80: internal/localapi/stalelock.go:284:35: localapi.runnerError.Error calls http.http2pseudoHeaderError.Error + #81: internal/hub/client.go:446:22: hub.Client.PostOSReport calls io.ReadAll, which eventually calls http.http2requestBody.Read + #82: internal/hub/client.go:446:22: hub.Client.PostOSReport calls io.ReadAll, which eventually calls http.http2requestBody.Read + #83: cmd/felhom-agent/main.go:220:16: felhom.main calls fmt.Fprintln, which calls http.http2responseWriter.Write + #84: cmd/felhom-agent/main.go:220:16: felhom.main calls fmt.Fprintln, which calls http.http2responseWriter.Write + #85: internal/localapi/debuglogs.go:50:31: localapi.statusRecorder.WriteHeader calls http.http2responseWriter.WriteHeader + #86: internal/localapi/debuglogs.go:50:31: localapi.statusRecorder.WriteHeader calls http.http2responseWriter.WriteHeader + #87: internal/selfupdate/executor.go:218:22: selfupdate.Executor.download calls io.Copy, which eventually calls http.http2responseWriter.WriteString + #88: internal/selfupdate/executor.go:218:22: selfupdate.Executor.download calls io.Copy, which eventually calls http.http2responseWriter.WriteString + #89: internal/lanresolver/lanresolver.go:48:13: lanresolver.RenderBase calls fmt.Fprintf, which eventually calls http.http2stickyErrWriter.Write + #90: internal/lanresolver/lanresolver.go:48:13: lanresolver.RenderBase calls fmt.Fprintf, which eventually calls http.http2stickyErrWriter.Write + #91: internal/hub/client.go:445:2: hub.Client.PostOSReport calls http.http2transportResponseBody.Close + #92: internal/hub/client.go:445:2: hub.Client.PostOSReport calls http.http2transportResponseBody.Close + #93: internal/hub/client.go:446:22: hub.Client.PostOSReport calls io.ReadAll, which calls http.http2transportResponseBody.Read + #94: internal/hub/client.go:446:22: hub.Client.PostOSReport calls io.ReadAll, which calls http.http2transportResponseBody.Read + #95: cmd/felhom-agent/main.go:220:16: felhom.main calls fmt.Fprintln, which eventually calls http.http2writeData.String + #96: cmd/felhom-agent/main.go:220:16: felhom.main calls fmt.Fprintln, which eventually calls http.http2writeData.String + #97: internal/hub/client.go:446:22: hub.Client.PostOSReport calls io.ReadAll, which eventually calls http.loggingConn.Read + #98: internal/hub/client.go:446:22: hub.Client.PostOSReport calls io.ReadAll, which eventually calls http.loggingConn.Read + #99: internal/lanresolver/lanresolver.go:48:13: lanresolver.RenderBase calls fmt.Fprintf, which calls http.loggingConn.Write + #100: internal/lanresolver/lanresolver.go:48:13: lanresolver.RenderBase calls fmt.Fprintf, which calls http.loggingConn.Write + #101: internal/hub/client.go:446:22: hub.Client.PostOSReport calls io.ReadAll, which eventually calls http.maxBytesReader.Read + #102: internal/hub/client.go:446:22: hub.Client.PostOSReport calls io.ReadAll, which eventually calls http.maxBytesReader.Read + #103: internal/pvegate/pvegate.go:76:10: pvegate.Step calls sync.Once.Do, which eventually calls http.onceCloseListener.Close + #104: internal/pvegate/pvegate.go:76:10: pvegate.Step calls sync.Once.Do, which eventually calls http.onceCloseListener.Close + #105: internal/hub/client.go:446:22: hub.Client.PostOSReport calls io.ReadAll, which eventually calls http.persistConn.Read + #106: internal/hub/client.go:446:22: hub.Client.PostOSReport calls io.ReadAll, which eventually calls http.persistConn.Read + #107: internal/selfupdate/executor.go:218:22: selfupdate.Executor.download calls io.Copy, which eventually calls http.persistConnWriter.ReadFrom + #108: internal/selfupdate/executor.go:218:22: selfupdate.Executor.download calls io.Copy, which eventually calls http.persistConnWriter.ReadFrom + #109: internal/lanresolver/lanresolver.go:48:13: lanresolver.RenderBase calls fmt.Fprintf, which eventually calls http.persistConnWriter.Write + #110: internal/lanresolver/lanresolver.go:48:13: lanresolver.RenderBase calls fmt.Fprintf, which eventually calls http.persistConnWriter.Write + #111: internal/hub/client.go:446:22: hub.Client.PostOSReport calls io.ReadAll, which eventually calls http.readTrackingBody.Read + #112: internal/hub/client.go:446:22: hub.Client.PostOSReport calls io.ReadAll, which eventually calls http.readTrackingBody.Read + #113: internal/hub/client.go:446:22: hub.Client.PostOSReport calls io.ReadAll, which calls http.readWriteCloserBody.Read + #114: internal/hub/client.go:446:22: hub.Client.PostOSReport calls io.ReadAll, which calls http.readWriteCloserBody.Read + #115: cmd/felhom-agent/main.go:220:16: felhom.main calls fmt.Fprintln, which calls http.response.Write + #116: cmd/felhom-agent/main.go:220:16: felhom.main calls fmt.Fprintln, which calls http.response.Write + #117: internal/localapi/debuglogs.go:50:31: localapi.statusRecorder.WriteHeader calls http.response.WriteHeader + #118: internal/localapi/debuglogs.go:50:31: localapi.statusRecorder.WriteHeader calls http.response.WriteHeader + #119: internal/localapi/stalelock.go:284:35: localapi.runnerError.Error calls http.transportReadFromServerError.Error + #120: internal/localapi/stalelock.go:284:35: localapi.runnerError.Error calls http.transportReadFromServerError.Error + +Vulnerability #4: GO-2026-6611 + Excessive CPU consumption from repeated initial window changes in net/http + More info: https://pkg.go.dev/vuln/GO-2026-6611 + Standard library + Found in: net/http@go1.26 + Fixed in: net/http@go1.26.9 + Example traces found: + #1: internal/hub/client.go:441:22: hub.Client.PostOSReport calls http.Client.Do + #2: internal/hub/client.go:441:22: hub.Client.PostOSReport calls http.Client.Do + #3: internal/hub/client.go:439:16: hub.Client.PostOSReport calls http.Header.Set + #4: internal/hub/client.go:439:16: hub.Client.PostOSReport calls http.Header.Set + #5: cmd/felhom-opsign/main.go:217:29: felhom.upload calls http.NewRequest + #6: cmd/felhom-opsign/main.go:217:29: felhom.upload calls http.NewRequest + #7: internal/hub/client.go:435:40: hub.Client.PostOSReport calls http.NewRequestWithContext + #8: internal/hub/client.go:435:40: hub.Client.PostOSReport calls http.NewRequestWithContext + #9: internal/selfupdate/executor.go:203:19: selfupdate.Executor.download calls http.Request.SetBasicAuth + #10: internal/selfupdate/executor.go:203:19: selfupdate.Executor.download calls http.Request.SetBasicAuth + #11: internal/localapi/server.go:526:16: localapi.Server.Handler calls http.ServeMux.HandleFunc + #12: internal/localapi/server.go:526:16: localapi.Server.Handler calls http.ServeMux.HandleFunc + #13: internal/localapi/server.go:624:34: localapi.Run calls http.Server.ServeTLS + #14: internal/localapi/server.go:624:34: localapi.Run calls http.Server.ServeTLS + #15: internal/localapi/server.go:630:19: localapi.Server.Run calls http.Server.Shutdown + #16: internal/localapi/server.go:630:19: localapi.Server.Run calls http.Server.Shutdown + #17: internal/hub/client.go:445:2: hub.Client.PostOSReport calls http.body.Close + #18: internal/hub/client.go:445:2: hub.Client.PostOSReport calls http.body.Close + #19: internal/hub/client.go:446:22: hub.Client.PostOSReport calls io.ReadAll, which calls http.body.Read + #20: internal/hub/client.go:446:22: hub.Client.PostOSReport calls io.ReadAll, which calls http.body.Read + #21: internal/hub/client.go:445:2: hub.Client.PostOSReport calls http.bodyEOFSignal.Close + #22: internal/hub/client.go:445:2: hub.Client.PostOSReport calls http.bodyEOFSignal.Close + #23: internal/hub/client.go:446:22: hub.Client.PostOSReport calls io.ReadAll, which calls http.bodyEOFSignal.Read + #24: internal/hub/client.go:446:22: hub.Client.PostOSReport calls io.ReadAll, which calls http.bodyEOFSignal.Read + #25: internal/hub/client.go:446:22: hub.Client.PostOSReport calls io.ReadAll, which eventually calls http.bodyLocked.Read + #26: internal/hub/client.go:446:22: hub.Client.PostOSReport calls io.ReadAll, which eventually calls http.bodyLocked.Read + #27: internal/selfupdate/executor.go:218:22: selfupdate.Executor.download calls io.Copy, which eventually calls http.bufioFlushWriter.Write + #28: internal/selfupdate/executor.go:218:22: selfupdate.Executor.download calls io.Copy, which eventually calls http.bufioFlushWriter.Write + #29: internal/hub/client.go:445:2: hub.Client.PostOSReport calls http.cancelTimerBody.Close + #30: internal/hub/client.go:445:2: hub.Client.PostOSReport calls http.cancelTimerBody.Close + #31: internal/hub/client.go:446:22: hub.Client.PostOSReport calls io.ReadAll, which calls http.cancelTimerBody.Read + #32: internal/hub/client.go:446:22: hub.Client.PostOSReport calls io.ReadAll, which calls http.cancelTimerBody.Read + #33: internal/lanresolver/lanresolver.go:48:13: lanresolver.RenderBase calls fmt.Fprintf, which eventually calls http.checkConnErrorWriter.Write + #34: internal/lanresolver/lanresolver.go:48:13: lanresolver.RenderBase calls fmt.Fprintf, which eventually calls http.checkConnErrorWriter.Write + #35: internal/lanresolver/lanresolver.go:48:13: lanresolver.RenderBase calls fmt.Fprintf, which eventually calls http.chunkWriter.Write + #36: internal/lanresolver/lanresolver.go:48:13: lanresolver.RenderBase calls fmt.Fprintf, which eventually calls http.chunkWriter.Write + #37: internal/hub/client.go:446:22: hub.Client.PostOSReport calls io.ReadAll, which eventually calls http.connReader.Read + #38: internal/hub/client.go:446:22: hub.Client.PostOSReport calls io.ReadAll, which eventually calls http.connReader.Read + #39: internal/hub/client.go:446:22: hub.Client.PostOSReport calls io.ReadAll, which eventually calls http.expectContinueReader.Read + #40: internal/hub/client.go:446:22: hub.Client.PostOSReport calls io.ReadAll, which eventually calls http.expectContinueReader.Read + #41: internal/hub/client.go:445:2: hub.Client.PostOSReport calls http.gzipReader.Close + #42: internal/hub/client.go:445:2: hub.Client.PostOSReport calls http.gzipReader.Close + #43: internal/hub/client.go:446:22: hub.Client.PostOSReport calls io.ReadAll, which calls http.gzipReader.Read + #44: internal/hub/client.go:446:22: hub.Client.PostOSReport calls io.ReadAll, which calls http.gzipReader.Read + #45: internal/localapi/stalelock.go:284:35: localapi.runnerError.Error calls http.http2ConnectionError.Error + #46: internal/localapi/stalelock.go:284:35: localapi.runnerError.Error calls http.http2ConnectionError.Error + #47: cmd/felhom-agent/main.go:220:16: felhom.main calls fmt.Fprintln, which eventually calls http.http2ErrCode.String + #48: cmd/felhom-agent/main.go:220:16: felhom.main calls fmt.Fprintln, which eventually calls http.http2ErrCode.String + #49: cmd/felhom-agent/main.go:220:16: felhom.main calls fmt.Fprintln, which eventually calls http.http2FrameHeader.String + #50: cmd/felhom-agent/main.go:220:16: felhom.main calls fmt.Fprintln, which eventually calls http.http2FrameHeader.String + #51: cmd/felhom-agent/main.go:220:16: felhom.main calls fmt.Fprintln, which eventually calls http.http2FrameType.String + #52: cmd/felhom-agent/main.go:220:16: felhom.main calls fmt.Fprintln, which eventually calls http.http2FrameType.String + #53: cmd/felhom-agent/main.go:220:16: felhom.main calls fmt.Fprintln, which eventually calls http.http2FrameWriteRequest.String + #54: cmd/felhom-agent/main.go:220:16: felhom.main calls fmt.Fprintln, which eventually calls http.http2FrameWriteRequest.String + #55: internal/localapi/stalelock.go:284:35: localapi.runnerError.Error calls http.http2GoAwayError.Error + #56: internal/localapi/stalelock.go:284:35: localapi.runnerError.Error calls http.http2GoAwayError.Error + #57: cmd/felhom-agent/main.go:220:16: felhom.main calls fmt.Fprintln, which eventually calls http.http2Setting.String + #58: cmd/felhom-agent/main.go:220:16: felhom.main calls fmt.Fprintln, which eventually calls http.http2Setting.String + #59: cmd/felhom-agent/main.go:220:16: felhom.main calls fmt.Fprintln, which eventually calls http.http2SettingID.String + #60: cmd/felhom-agent/main.go:220:16: felhom.main calls fmt.Fprintln, which eventually calls http.http2SettingID.String + #61: internal/localapi/stalelock.go:284:35: localapi.runnerError.Error calls http.http2StreamError.Error + #62: internal/localapi/stalelock.go:284:35: localapi.runnerError.Error calls http.http2StreamError.Error + #63: internal/lanresolver/lanresolver.go:48:13: lanresolver.RenderBase calls fmt.Fprintf, which eventually calls http.http2bufferedWriterTimeoutWriter.Write + #64: internal/lanresolver/lanresolver.go:48:13: lanresolver.RenderBase calls fmt.Fprintf, which eventually calls http.http2bufferedWriterTimeoutWriter.Write + #65: internal/lanresolver/lanresolver.go:48:13: lanresolver.RenderBase calls fmt.Fprintf, which eventually calls http.http2chunkWriter.Write + #66: internal/lanresolver/lanresolver.go:48:13: lanresolver.RenderBase calls fmt.Fprintf, which eventually calls http.http2chunkWriter.Write + #67: internal/localapi/stalelock.go:284:35: localapi.runnerError.Error calls http.http2connError.Error + #68: internal/localapi/stalelock.go:284:35: localapi.runnerError.Error calls http.http2connError.Error + #69: internal/localapi/stalelock.go:284:35: localapi.runnerError.Error calls http.http2duplicatePseudoHeaderError.Error + #70: internal/localapi/stalelock.go:284:35: localapi.runnerError.Error calls http.http2duplicatePseudoHeaderError.Error + #71: internal/hub/client.go:445:2: hub.Client.PostOSReport calls http.http2gzipReader.Close + #72: internal/hub/client.go:445:2: hub.Client.PostOSReport calls http.http2gzipReader.Close + #73: internal/hub/client.go:446:22: hub.Client.PostOSReport calls io.ReadAll, which calls http.http2gzipReader.Read + #74: internal/hub/client.go:446:22: hub.Client.PostOSReport calls io.ReadAll, which calls http.http2gzipReader.Read + #75: internal/localapi/stalelock.go:284:35: localapi.runnerError.Error calls http.http2headerFieldNameError.Error + #76: internal/localapi/stalelock.go:284:35: localapi.runnerError.Error calls http.http2headerFieldNameError.Error + #77: internal/localapi/stalelock.go:284:35: localapi.runnerError.Error calls http.http2headerFieldValueError.Error + #78: internal/localapi/stalelock.go:284:35: localapi.runnerError.Error calls http.http2headerFieldValueError.Error + #79: internal/localapi/stalelock.go:284:35: localapi.runnerError.Error calls http.http2pseudoHeaderError.Error + #80: internal/localapi/stalelock.go:284:35: localapi.runnerError.Error calls http.http2pseudoHeaderError.Error + #81: internal/hub/client.go:446:22: hub.Client.PostOSReport calls io.ReadAll, which eventually calls http.http2requestBody.Read + #82: internal/hub/client.go:446:22: hub.Client.PostOSReport calls io.ReadAll, which eventually calls http.http2requestBody.Read + #83: cmd/felhom-agent/main.go:220:16: felhom.main calls fmt.Fprintln, which calls http.http2responseWriter.Write + #84: cmd/felhom-agent/main.go:220:16: felhom.main calls fmt.Fprintln, which calls http.http2responseWriter.Write + #85: internal/localapi/debuglogs.go:50:31: localapi.statusRecorder.WriteHeader calls http.http2responseWriter.WriteHeader + #86: internal/localapi/debuglogs.go:50:31: localapi.statusRecorder.WriteHeader calls http.http2responseWriter.WriteHeader + #87: internal/selfupdate/executor.go:218:22: selfupdate.Executor.download calls io.Copy, which eventually calls http.http2responseWriter.WriteString + #88: internal/selfupdate/executor.go:218:22: selfupdate.Executor.download calls io.Copy, which eventually calls http.http2responseWriter.WriteString + #89: internal/lanresolver/lanresolver.go:48:13: lanresolver.RenderBase calls fmt.Fprintf, which eventually calls http.http2stickyErrWriter.Write + #90: internal/lanresolver/lanresolver.go:48:13: lanresolver.RenderBase calls fmt.Fprintf, which eventually calls http.http2stickyErrWriter.Write + #91: internal/hub/client.go:445:2: hub.Client.PostOSReport calls http.http2transportResponseBody.Close + #92: internal/hub/client.go:445:2: hub.Client.PostOSReport calls http.http2transportResponseBody.Close + #93: internal/hub/client.go:446:22: hub.Client.PostOSReport calls io.ReadAll, which calls http.http2transportResponseBody.Read + #94: internal/hub/client.go:446:22: hub.Client.PostOSReport calls io.ReadAll, which calls http.http2transportResponseBody.Read + #95: cmd/felhom-agent/main.go:220:16: felhom.main calls fmt.Fprintln, which eventually calls http.http2writeData.String + #96: cmd/felhom-agent/main.go:220:16: felhom.main calls fmt.Fprintln, which eventually calls http.http2writeData.String + #97: internal/hub/client.go:446:22: hub.Client.PostOSReport calls io.ReadAll, which eventually calls http.loggingConn.Read + #98: internal/hub/client.go:446:22: hub.Client.PostOSReport calls io.ReadAll, which eventually calls http.loggingConn.Read + #99: internal/lanresolver/lanresolver.go:48:13: lanresolver.RenderBase calls fmt.Fprintf, which calls http.loggingConn.Write + #100: internal/lanresolver/lanresolver.go:48:13: lanresolver.RenderBase calls fmt.Fprintf, which calls http.loggingConn.Write + #101: internal/hub/client.go:446:22: hub.Client.PostOSReport calls io.ReadAll, which eventually calls http.maxBytesReader.Read + #102: internal/hub/client.go:446:22: hub.Client.PostOSReport calls io.ReadAll, which eventually calls http.maxBytesReader.Read + #103: internal/pvegate/pvegate.go:76:10: pvegate.Step calls sync.Once.Do, which eventually calls http.onceCloseListener.Close + #104: internal/pvegate/pvegate.go:76:10: pvegate.Step calls sync.Once.Do, which eventually calls http.onceCloseListener.Close + #105: internal/hub/client.go:446:22: hub.Client.PostOSReport calls io.ReadAll, which eventually calls http.persistConn.Read + #106: internal/hub/client.go:446:22: hub.Client.PostOSReport calls io.ReadAll, which eventually calls http.persistConn.Read + #107: internal/selfupdate/executor.go:218:22: selfupdate.Executor.download calls io.Copy, which eventually calls http.persistConnWriter.ReadFrom + #108: internal/selfupdate/executor.go:218:22: selfupdate.Executor.download calls io.Copy, which eventually calls http.persistConnWriter.ReadFrom + #109: internal/lanresolver/lanresolver.go:48:13: lanresolver.RenderBase calls fmt.Fprintf, which eventually calls http.persistConnWriter.Write + #110: internal/lanresolver/lanresolver.go:48:13: lanresolver.RenderBase calls fmt.Fprintf, which eventually calls http.persistConnWriter.Write + #111: internal/hub/client.go:446:22: hub.Client.PostOSReport calls io.ReadAll, which eventually calls http.readTrackingBody.Read + #112: internal/hub/client.go:446:22: hub.Client.PostOSReport calls io.ReadAll, which eventually calls http.readTrackingBody.Read + #113: internal/hub/client.go:446:22: hub.Client.PostOSReport calls io.ReadAll, which calls http.readWriteCloserBody.Read + #114: internal/hub/client.go:446:22: hub.Client.PostOSReport calls io.ReadAll, which calls http.readWriteCloserBody.Read + #115: cmd/felhom-agent/main.go:220:16: felhom.main calls fmt.Fprintln, which calls http.response.Write + #116: cmd/felhom-agent/main.go:220:16: felhom.main calls fmt.Fprintln, which calls http.response.Write + #117: internal/localapi/debuglogs.go:50:31: localapi.statusRecorder.WriteHeader calls http.response.WriteHeader + #118: internal/localapi/debuglogs.go:50:31: localapi.statusRecorder.WriteHeader calls http.response.WriteHeader + #119: internal/localapi/stalelock.go:284:35: localapi.runnerError.Error calls http.transportReadFromServerError.Error + #120: internal/localapi/stalelock.go:284:35: localapi.runnerError.Error calls http.transportReadFromServerError.Error + +Vulnerability #5: GO-2026-6610 + HTTP/2 transport accepts malformed framing-related headers in net/http + More info: https://pkg.go.dev/vuln/GO-2026-6610 + Standard library + Found in: net/http@go1.26 + Fixed in: net/http@go1.26.9 + Example traces found: + #1: internal/hub/client.go:441:22: hub.Client.PostOSReport calls http.Client.Do + #2: internal/hub/client.go:441:22: hub.Client.PostOSReport calls http.Client.Do + +Vulnerability #6: GO-2026-6608 + Memory limit bypass when parsing MIME headers in net/textproto, + mime/multipart + More info: https://pkg.go.dev/vuln/GO-2026-6608 + Standard library + Found in: net/textproto@go1.26 + Fixed in: net/textproto@go1.26.9 + Example traces found: + #1: internal/hub/client.go:446:22: hub.Client.PostOSReport calls io.ReadAll, which eventually calls textproto.Reader.ReadMIMEHeader + +Vulnerability #7: GO-2026-6607 + Reject malformed ECH outer extension references in crypto/tls + More info: https://pkg.go.dev/vuln/GO-2026-6607 + Standard library + Found in: crypto/tls@go1.26 + Fixed in: crypto/tls@go1.26.9 + Example traces found: + #1: internal/pbs/probe.go:42:33: pbs.ProbeFingerprint calls tls.Conn.HandshakeContext + #2: internal/hub/client.go:446:22: hub.Client.PostOSReport calls io.ReadAll, which eventually calls tls.Conn.Read + #3: internal/lanresolver/lanresolver.go:48:13: lanresolver.RenderBase calls fmt.Fprintf, which calls tls.Conn.Write + #4: internal/hub/client.go:441:22: hub.Client.PostOSReport calls http.Client.Do, which eventually calls tls.Dialer.DialContext + +Vulnerability #8: GO-2026-6605 + HTTP/1 client connection desynchronization after CONNECT rejection in + net/http + More info: https://pkg.go.dev/vuln/GO-2026-6605 + Standard library + Found in: net/http@go1.26 + Fixed in: net/http@go1.26.9 + Example traces found: + #1: internal/hub/client.go:441:22: hub.Client.PostOSReport calls http.Client.Do + +Vulnerability #9: GO-2026-6603 + HTTP/2 server memory exhaustion due to Trailer headers in net/http + More info: https://pkg.go.dev/vuln/GO-2026-6603 + Standard library + Found in: net/http@go1.26 + Fixed in: net/http@go1.26.9 + Example traces found: + #1: internal/hub/client.go:441:22: hub.Client.PostOSReport calls http.Client.Do + #2: internal/hub/client.go:441:22: hub.Client.PostOSReport calls http.Client.Do + #3: internal/hub/client.go:439:16: hub.Client.PostOSReport calls http.Header.Set + #4: internal/hub/client.go:439:16: hub.Client.PostOSReport calls http.Header.Set + #5: cmd/felhom-opsign/main.go:217:29: felhom.upload calls http.NewRequest + #6: cmd/felhom-opsign/main.go:217:29: felhom.upload calls http.NewRequest + #7: internal/hub/client.go:435:40: hub.Client.PostOSReport calls http.NewRequestWithContext + #8: internal/hub/client.go:435:40: hub.Client.PostOSReport calls http.NewRequestWithContext + #9: internal/selfupdate/executor.go:203:19: selfupdate.Executor.download calls http.Request.SetBasicAuth + #10: internal/selfupdate/executor.go:203:19: selfupdate.Executor.download calls http.Request.SetBasicAuth + #11: internal/localapi/server.go:526:16: localapi.Server.Handler calls http.ServeMux.HandleFunc + #12: internal/localapi/server.go:526:16: localapi.Server.Handler calls http.ServeMux.HandleFunc + #13: internal/localapi/server.go:624:34: localapi.Run calls http.Server.ServeTLS + #14: internal/localapi/server.go:624:34: localapi.Run calls http.Server.ServeTLS + #15: internal/localapi/server.go:630:19: localapi.Server.Run calls http.Server.Shutdown + #16: internal/localapi/server.go:630:19: localapi.Server.Run calls http.Server.Shutdown + #17: internal/hub/client.go:445:2: hub.Client.PostOSReport calls http.body.Close + #18: internal/hub/client.go:445:2: hub.Client.PostOSReport calls http.body.Close + #19: internal/hub/client.go:446:22: hub.Client.PostOSReport calls io.ReadAll, which calls http.body.Read + #20: internal/hub/client.go:446:22: hub.Client.PostOSReport calls io.ReadAll, which calls http.body.Read + #21: internal/hub/client.go:445:2: hub.Client.PostOSReport calls http.bodyEOFSignal.Close + #22: internal/hub/client.go:445:2: hub.Client.PostOSReport calls http.bodyEOFSignal.Close + #23: internal/hub/client.go:446:22: hub.Client.PostOSReport calls io.ReadAll, which calls http.bodyEOFSignal.Read + #24: internal/hub/client.go:446:22: hub.Client.PostOSReport calls io.ReadAll, which calls http.bodyEOFSignal.Read + #25: internal/hub/client.go:446:22: hub.Client.PostOSReport calls io.ReadAll, which eventually calls http.bodyLocked.Read + #26: internal/hub/client.go:446:22: hub.Client.PostOSReport calls io.ReadAll, which eventually calls http.bodyLocked.Read + #27: internal/selfupdate/executor.go:218:22: selfupdate.Executor.download calls io.Copy, which eventually calls http.bufioFlushWriter.Write + #28: internal/selfupdate/executor.go:218:22: selfupdate.Executor.download calls io.Copy, which eventually calls http.bufioFlushWriter.Write + #29: internal/hub/client.go:445:2: hub.Client.PostOSReport calls http.cancelTimerBody.Close + #30: internal/hub/client.go:445:2: hub.Client.PostOSReport calls http.cancelTimerBody.Close + #31: internal/hub/client.go:446:22: hub.Client.PostOSReport calls io.ReadAll, which calls http.cancelTimerBody.Read + #32: internal/hub/client.go:446:22: hub.Client.PostOSReport calls io.ReadAll, which calls http.cancelTimerBody.Read + #33: internal/lanresolver/lanresolver.go:48:13: lanresolver.RenderBase calls fmt.Fprintf, which eventually calls http.checkConnErrorWriter.Write + #34: internal/lanresolver/lanresolver.go:48:13: lanresolver.RenderBase calls fmt.Fprintf, which eventually calls http.checkConnErrorWriter.Write + #35: internal/lanresolver/lanresolver.go:48:13: lanresolver.RenderBase calls fmt.Fprintf, which eventually calls http.chunkWriter.Write + #36: internal/lanresolver/lanresolver.go:48:13: lanresolver.RenderBase calls fmt.Fprintf, which eventually calls http.chunkWriter.Write + #37: internal/hub/client.go:446:22: hub.Client.PostOSReport calls io.ReadAll, which eventually calls http.connReader.Read + #38: internal/hub/client.go:446:22: hub.Client.PostOSReport calls io.ReadAll, which eventually calls http.connReader.Read + #39: internal/hub/client.go:446:22: hub.Client.PostOSReport calls io.ReadAll, which eventually calls http.expectContinueReader.Read + #40: internal/hub/client.go:446:22: hub.Client.PostOSReport calls io.ReadAll, which eventually calls http.expectContinueReader.Read + #41: internal/hub/client.go:445:2: hub.Client.PostOSReport calls http.gzipReader.Close + #42: internal/hub/client.go:445:2: hub.Client.PostOSReport calls http.gzipReader.Close + #43: internal/hub/client.go:446:22: hub.Client.PostOSReport calls io.ReadAll, which calls http.gzipReader.Read + #44: internal/hub/client.go:446:22: hub.Client.PostOSReport calls io.ReadAll, which calls http.gzipReader.Read + #45: internal/localapi/stalelock.go:284:35: localapi.runnerError.Error calls http.http2ConnectionError.Error + #46: internal/localapi/stalelock.go:284:35: localapi.runnerError.Error calls http.http2ConnectionError.Error + #47: cmd/felhom-agent/main.go:220:16: felhom.main calls fmt.Fprintln, which eventually calls http.http2ErrCode.String + #48: cmd/felhom-agent/main.go:220:16: felhom.main calls fmt.Fprintln, which eventually calls http.http2ErrCode.String + #49: cmd/felhom-agent/main.go:220:16: felhom.main calls fmt.Fprintln, which eventually calls http.http2FrameHeader.String + #50: cmd/felhom-agent/main.go:220:16: felhom.main calls fmt.Fprintln, which eventually calls http.http2FrameHeader.String + #51: cmd/felhom-agent/main.go:220:16: felhom.main calls fmt.Fprintln, which eventually calls http.http2FrameType.String + #52: cmd/felhom-agent/main.go:220:16: felhom.main calls fmt.Fprintln, which eventually calls http.http2FrameType.String + #53: cmd/felhom-agent/main.go:220:16: felhom.main calls fmt.Fprintln, which eventually calls http.http2FrameWriteRequest.String + #54: cmd/felhom-agent/main.go:220:16: felhom.main calls fmt.Fprintln, which eventually calls http.http2FrameWriteRequest.String + #55: internal/localapi/stalelock.go:284:35: localapi.runnerError.Error calls http.http2GoAwayError.Error + #56: internal/localapi/stalelock.go:284:35: localapi.runnerError.Error calls http.http2GoAwayError.Error + #57: cmd/felhom-agent/main.go:220:16: felhom.main calls fmt.Fprintln, which eventually calls http.http2Setting.String + #58: cmd/felhom-agent/main.go:220:16: felhom.main calls fmt.Fprintln, which eventually calls http.http2Setting.String + #59: cmd/felhom-agent/main.go:220:16: felhom.main calls fmt.Fprintln, which eventually calls http.http2SettingID.String + #60: cmd/felhom-agent/main.go:220:16: felhom.main calls fmt.Fprintln, which eventually calls http.http2SettingID.String + #61: internal/localapi/stalelock.go:284:35: localapi.runnerError.Error calls http.http2StreamError.Error + #62: internal/localapi/stalelock.go:284:35: localapi.runnerError.Error calls http.http2StreamError.Error + #63: internal/lanresolver/lanresolver.go:48:13: lanresolver.RenderBase calls fmt.Fprintf, which eventually calls http.http2bufferedWriterTimeoutWriter.Write + #64: internal/lanresolver/lanresolver.go:48:13: lanresolver.RenderBase calls fmt.Fprintf, which eventually calls http.http2bufferedWriterTimeoutWriter.Write + #65: internal/lanresolver/lanresolver.go:48:13: lanresolver.RenderBase calls fmt.Fprintf, which eventually calls http.http2chunkWriter.Write + #66: internal/lanresolver/lanresolver.go:48:13: lanresolver.RenderBase calls fmt.Fprintf, which eventually calls http.http2chunkWriter.Write + #67: internal/localapi/stalelock.go:284:35: localapi.runnerError.Error calls http.http2connError.Error + #68: internal/localapi/stalelock.go:284:35: localapi.runnerError.Error calls http.http2connError.Error + #69: internal/localapi/stalelock.go:284:35: localapi.runnerError.Error calls http.http2duplicatePseudoHeaderError.Error + #70: internal/localapi/stalelock.go:284:35: localapi.runnerError.Error calls http.http2duplicatePseudoHeaderError.Error + #71: internal/hub/client.go:445:2: hub.Client.PostOSReport calls http.http2gzipReader.Close + #72: internal/hub/client.go:445:2: hub.Client.PostOSReport calls http.http2gzipReader.Close + #73: internal/hub/client.go:446:22: hub.Client.PostOSReport calls io.ReadAll, which calls http.http2gzipReader.Read + #74: internal/hub/client.go:446:22: hub.Client.PostOSReport calls io.ReadAll, which calls http.http2gzipReader.Read + #75: internal/localapi/stalelock.go:284:35: localapi.runnerError.Error calls http.http2headerFieldNameError.Error + #76: internal/localapi/stalelock.go:284:35: localapi.runnerError.Error calls http.http2headerFieldNameError.Error + #77: internal/localapi/stalelock.go:284:35: localapi.runnerError.Error calls http.http2headerFieldValueError.Error + #78: internal/localapi/stalelock.go:284:35: localapi.runnerError.Error calls http.http2headerFieldValueError.Error + #79: internal/localapi/stalelock.go:284:35: localapi.runnerError.Error calls http.http2pseudoHeaderError.Error + #80: internal/localapi/stalelock.go:284:35: localapi.runnerError.Error calls http.http2pseudoHeaderError.Error + #81: internal/hub/client.go:446:22: hub.Client.PostOSReport calls io.ReadAll, which eventually calls http.http2requestBody.Read + #82: internal/hub/client.go:446:22: hub.Client.PostOSReport calls io.ReadAll, which eventually calls http.http2requestBody.Read + #83: cmd/felhom-agent/main.go:220:16: felhom.main calls fmt.Fprintln, which calls http.http2responseWriter.Write + #84: cmd/felhom-agent/main.go:220:16: felhom.main calls fmt.Fprintln, which calls http.http2responseWriter.Write + #85: internal/localapi/debuglogs.go:50:31: localapi.statusRecorder.WriteHeader calls http.http2responseWriter.WriteHeader + #86: internal/localapi/debuglogs.go:50:31: localapi.statusRecorder.WriteHeader calls http.http2responseWriter.WriteHeader + #87: internal/selfupdate/executor.go:218:22: selfupdate.Executor.download calls io.Copy, which eventually calls http.http2responseWriter.WriteString + #88: internal/selfupdate/executor.go:218:22: selfupdate.Executor.download calls io.Copy, which eventually calls http.http2responseWriter.WriteString + #89: internal/lanresolver/lanresolver.go:48:13: lanresolver.RenderBase calls fmt.Fprintf, which eventually calls http.http2stickyErrWriter.Write + #90: internal/lanresolver/lanresolver.go:48:13: lanresolver.RenderBase calls fmt.Fprintf, which eventually calls http.http2stickyErrWriter.Write + #91: internal/hub/client.go:445:2: hub.Client.PostOSReport calls http.http2transportResponseBody.Close + #92: internal/hub/client.go:445:2: hub.Client.PostOSReport calls http.http2transportResponseBody.Close + #93: internal/hub/client.go:446:22: hub.Client.PostOSReport calls io.ReadAll, which calls http.http2transportResponseBody.Read + #94: internal/hub/client.go:446:22: hub.Client.PostOSReport calls io.ReadAll, which calls http.http2transportResponseBody.Read + #95: cmd/felhom-agent/main.go:220:16: felhom.main calls fmt.Fprintln, which eventually calls http.http2writeData.String + #96: cmd/felhom-agent/main.go:220:16: felhom.main calls fmt.Fprintln, which eventually calls http.http2writeData.String + #97: internal/hub/client.go:446:22: hub.Client.PostOSReport calls io.ReadAll, which eventually calls http.loggingConn.Read + #98: internal/hub/client.go:446:22: hub.Client.PostOSReport calls io.ReadAll, which eventually calls http.loggingConn.Read + #99: internal/lanresolver/lanresolver.go:48:13: lanresolver.RenderBase calls fmt.Fprintf, which calls http.loggingConn.Write + #100: internal/lanresolver/lanresolver.go:48:13: lanresolver.RenderBase calls fmt.Fprintf, which calls http.loggingConn.Write + #101: internal/hub/client.go:446:22: hub.Client.PostOSReport calls io.ReadAll, which eventually calls http.maxBytesReader.Read + #102: internal/hub/client.go:446:22: hub.Client.PostOSReport calls io.ReadAll, which eventually calls http.maxBytesReader.Read + #103: internal/pvegate/pvegate.go:76:10: pvegate.Step calls sync.Once.Do, which eventually calls http.onceCloseListener.Close + #104: internal/pvegate/pvegate.go:76:10: pvegate.Step calls sync.Once.Do, which eventually calls http.onceCloseListener.Close + #105: internal/hub/client.go:446:22: hub.Client.PostOSReport calls io.ReadAll, which eventually calls http.persistConn.Read + #106: internal/hub/client.go:446:22: hub.Client.PostOSReport calls io.ReadAll, which eventually calls http.persistConn.Read + #107: internal/selfupdate/executor.go:218:22: selfupdate.Executor.download calls io.Copy, which eventually calls http.persistConnWriter.ReadFrom + #108: internal/selfupdate/executor.go:218:22: selfupdate.Executor.download calls io.Copy, which eventually calls http.persistConnWriter.ReadFrom + #109: internal/lanresolver/lanresolver.go:48:13: lanresolver.RenderBase calls fmt.Fprintf, which eventually calls http.persistConnWriter.Write + #110: internal/lanresolver/lanresolver.go:48:13: lanresolver.RenderBase calls fmt.Fprintf, which eventually calls http.persistConnWriter.Write + #111: internal/hub/client.go:446:22: hub.Client.PostOSReport calls io.ReadAll, which eventually calls http.readTrackingBody.Read + #112: internal/hub/client.go:446:22: hub.Client.PostOSReport calls io.ReadAll, which eventually calls http.readTrackingBody.Read + #113: internal/hub/client.go:446:22: hub.Client.PostOSReport calls io.ReadAll, which calls http.readWriteCloserBody.Read + #114: internal/hub/client.go:446:22: hub.Client.PostOSReport calls io.ReadAll, which calls http.readWriteCloserBody.Read + #115: cmd/felhom-agent/main.go:220:16: felhom.main calls fmt.Fprintln, which calls http.response.Write + #116: cmd/felhom-agent/main.go:220:16: felhom.main calls fmt.Fprintln, which calls http.response.Write + #117: internal/localapi/debuglogs.go:50:31: localapi.statusRecorder.WriteHeader calls http.response.WriteHeader + #118: internal/localapi/debuglogs.go:50:31: localapi.statusRecorder.WriteHeader calls http.response.WriteHeader + #119: internal/localapi/stalelock.go:284:35: localapi.runnerError.Error calls http.transportReadFromServerError.Error + #120: internal/localapi/stalelock.go:284:35: localapi.runnerError.Error calls http.transportReadFromServerError.Error + +Vulnerability #10: GO-2026-6218 + Avoid quadratic complexity in resolvePath in net/url + More info: https://pkg.go.dev/vuln/GO-2026-6218 + Standard library + Found in: net/url@go1.26 + Fixed in: net/url@go1.26.6 + Example traces found: + #1: internal/hub/client.go:441:22: hub.Client.PostOSReport calls http.Client.Do, which eventually calls url.URL.Parse + +Vulnerability #11: GO-2026-6090 + Limit handshake messages we are willing to accept post-handshake in + crypto/tls + More info: https://pkg.go.dev/vuln/GO-2026-6090 + Standard library + Found in: crypto/tls@go1.26 + Fixed in: crypto/tls@go1.26.6 + Example traces found: + #1: internal/pbs/probe.go:42:33: pbs.ProbeFingerprint calls tls.Conn.HandshakeContext + #2: internal/hub/client.go:446:22: hub.Client.PostOSReport calls io.ReadAll, which eventually calls tls.Conn.Read + #3: internal/lanresolver/lanresolver.go:48:13: lanresolver.RenderBase calls fmt.Fprintf, which calls tls.Conn.Write + #4: internal/hub/client.go:441:22: hub.Client.PostOSReport calls http.Client.Do, which eventually calls tls.Dialer.DialContext + +Vulnerability #12: GO-2026-6089 + Apply ReadHeaderTimeout when doing unencrypted HTTP/2 check in net/http + More info: https://pkg.go.dev/vuln/GO-2026-6089 + Standard library + Found in: net/http@go1.26 + Fixed in: net/http@go1.26.6 + Example traces found: + #1: internal/localapi/server.go:624:34: localapi.Run calls http.Server.ServeTLS + +Vulnerability #13: GO-2026-5972 + Enforce maximum recursion depth in encoding/asn1 + More info: https://pkg.go.dev/vuln/GO-2026-5972 + Standard library + Found in: encoding/asn1@go1.26 + Fixed in: encoding/asn1@go1.26.6 + Example traces found: + #1: internal/hub/client.go:48:30: hub.NewClient calls x509.CertPool.AppendCertsFromPEM, which eventually calls asn1.Unmarshal + +Vulnerability #14: GO-2026-5856 + Invoking Encrypted Client Hello privacy leak in crypto/tls + More info: https://pkg.go.dev/vuln/GO-2026-5856 + Standard library + Found in: crypto/tls@go1.26 + Fixed in: crypto/tls@go1.26.5 + Example traces found: + #1: internal/pbs/probe.go:42:33: pbs.ProbeFingerprint calls tls.Conn.HandshakeContext + #2: internal/hub/client.go:446:22: hub.Client.PostOSReport calls io.ReadAll, which eventually calls tls.Conn.Read + #3: internal/lanresolver/lanresolver.go:48:13: lanresolver.RenderBase calls fmt.Fprintf, which calls tls.Conn.Write + #4: internal/hub/client.go:441:22: hub.Client.PostOSReport calls http.Client.Do, which eventually calls tls.Dialer.DialContext + +Vulnerability #15: GO-2026-5039 + Arbitrary inputs are included in errors without any escaping in + net/textproto + More info: https://pkg.go.dev/vuln/GO-2026-5039 + Standard library + Found in: net/textproto@go1.26 + Fixed in: net/textproto@go1.26.4 + Example traces found: + #1: internal/hub/client.go:446:22: hub.Client.PostOSReport calls io.ReadAll, which eventually calls textproto.Reader.ReadMIMEHeader + +Vulnerability #16: GO-2026-5037 + Inefficient candidate hostname parsing in crypto/x509 + More info: https://pkg.go.dev/vuln/GO-2026-5037 + Standard library + Found in: crypto/x509@go1.26 + Fixed in: crypto/x509@go1.26.4 + Example traces found: + #1: internal/pbs/probe.go:42:33: pbs.ProbeFingerprint calls tls.Conn.HandshakeContext, which eventually calls x509.Certificate.Verify + #2: internal/pbs/probe.go:42:33: pbs.ProbeFingerprint calls tls.Conn.HandshakeContext, which eventually calls x509.Certificate.VerifyHostname + #3: cmd/felhom-agent/main.go:220:16: felhom.main calls fmt.Fprintln, which eventually calls x509.HostnameError.Error + +Vulnerability #17: GO-2026-5026 + Invoking failure to reject ASCII-only Punycode-encoded labels in + golang.org/x/net/idna + More info: https://pkg.go.dev/vuln/GO-2026-5026 + Standard library + Found in: net/http@go1.26 + Fixed in: net/http@go1.26.6 + Example traces found: + #1: internal/hub/client.go:441:22: hub.Client.PostOSReport calls http.Client.Do + +Vulnerability #18: GO-2026-4971 + Panic in Dial and LookupPort when handling NUL byte on Windows in net + More info: https://pkg.go.dev/vuln/GO-2026-4971 + Standard library + Found in: net@go1.26 + Fixed in: net@go1.26.3 + Example traces found: + #1: internal/storage/watchdog.go:404:22: storage.HostLiveness.Present calls net.DialTimeout + #2: internal/pbs/probe.go:31:27: pbs.ProbeFingerprint calls net.Dialer.DialContext + #3: internal/localapi/server.go:617:23: localapi.Server.Run calls net.Listen + #4: internal/poke/poke.go:133:28: poke.Listener.serve calls net.ListenConfig.ListenPacket + #5: internal/wgtunnel/manager.go:62:40: wgtunnel.netResolver.LookupIPv4 calls net.Resolver.LookupNetIP + +Vulnerability #19: GO-2026-4947 + Unexpected work during chain building in crypto/x509 + More info: https://pkg.go.dev/vuln/GO-2026-4947 + Standard library + Found in: crypto/x509@go1.26 + Fixed in: crypto/x509@go1.26.2 + Example traces found: + #1: internal/pbs/probe.go:42:33: pbs.ProbeFingerprint calls tls.Conn.HandshakeContext, which eventually calls x509.Certificate.Verify + +Vulnerability #20: GO-2026-4946 + Inefficient policy validation in crypto/x509 + More info: https://pkg.go.dev/vuln/GO-2026-4946 + Standard library + Found in: crypto/x509@go1.26 + Fixed in: crypto/x509@go1.26.2 + Example traces found: + #1: internal/pbs/probe.go:42:33: pbs.ProbeFingerprint calls tls.Conn.HandshakeContext, which eventually calls x509.Certificate.Verify + +Vulnerability #21: GO-2026-4918 + Infinite loop in HTTP/2 transport when given bad SETTINGS_MAX_FRAME_SIZE in + net/http/internal/http2 in golang.org/x/net + More info: https://pkg.go.dev/vuln/GO-2026-4918 + Standard library + Found in: net/http@go1.26 + Fixed in: net/http@go1.26.3 + Example traces found: + #1: internal/hub/client.go:441:22: hub.Client.PostOSReport calls http.Client.Do + +Vulnerability #22: GO-2026-4870 + Unauthenticated TLS 1.3 KeyUpdate record can cause persistent connection + retention and DoS in crypto/tls + More info: https://pkg.go.dev/vuln/GO-2026-4870 + Standard library + Found in: crypto/tls@go1.26 + Fixed in: crypto/tls@go1.26.2 + Example traces found: + #1: internal/pbs/probe.go:42:33: pbs.ProbeFingerprint calls tls.Conn.HandshakeContext + #2: internal/hub/client.go:446:22: hub.Client.PostOSReport calls io.ReadAll, which eventually calls tls.Conn.Read + #3: internal/lanresolver/lanresolver.go:48:13: lanresolver.RenderBase calls fmt.Fprintf, which calls tls.Conn.Write + #4: internal/hub/client.go:441:22: hub.Client.PostOSReport calls http.Client.Do, which eventually calls tls.Dialer.DialContext + +Vulnerability #23: GO-2026-4866 + Case-sensitive excludedSubtrees name constraints cause Auth Bypass in + crypto/x509 + More info: https://pkg.go.dev/vuln/GO-2026-4866 + Standard library + Found in: crypto/x509@go1.26 + Fixed in: crypto/x509@go1.26.2 + Example traces found: + #1: internal/pbs/probe.go:42:33: pbs.ProbeFingerprint calls tls.Conn.HandshakeContext, which eventually calls x509.Certificate.Verify + +Vulnerability #24: GO-2026-4602 + FileInfo can escape from a Root in os + More info: https://pkg.go.dev/vuln/GO-2026-4602 + Standard library + Found in: os@go1.26 + Fixed in: os@go1.26.1 + Example traces found: + #1: internal/storage/netmount.go:512:28: storage.SudoHostOps.MigrateNetworkUnits calls os.ReadDir + +Vulnerability #25: GO-2026-4601 + Incorrect parsing of IPv6 host literals in net/url + More info: https://pkg.go.dev/vuln/GO-2026-4601 + Standard library + Found in: net/url@go1.26 + Fixed in: net/url@go1.26.1 + Example traces found: + #1: internal/config/config.go:999:21: config.HubConfig.Validate calls url.Parse + #2: internal/localapi/server.go:624:34: localapi.Run calls http.Server.ServeTLS, which eventually calls url.ParseRequestURI + #3: internal/hub/client.go:441:22: hub.Client.PostOSReport calls http.Client.Do, which eventually calls url.URL.Parse + +Vulnerability #26: GO-2026-4600 + Panic in name constraint checking for malformed certificates in crypto/x509 + More info: https://pkg.go.dev/vuln/GO-2026-4600 + Standard library + Found in: crypto/x509@go1.26 + Fixed in: crypto/x509@go1.26.1 + Example traces found: + #1: internal/pbs/probe.go:42:33: pbs.ProbeFingerprint calls tls.Conn.HandshakeContext, which eventually calls x509.Certificate.Verify + +Vulnerability #27: GO-2026-4599 + Incorrect enforcement of email constraints in crypto/x509 + More info: https://pkg.go.dev/vuln/GO-2026-4599 + Standard library + Found in: crypto/x509@go1.26 + Fixed in: crypto/x509@go1.26.1 + Example traces found: + #1: internal/pbs/probe.go:42:33: pbs.ProbeFingerprint calls tls.Conn.HandshakeContext, which eventually calls x509.Certificate.Verify + +Your code is affected by 27 vulnerabilities from the Go standard library. +This scan also found 10 vulnerabilities in packages you import and 13 +vulnerabilities in modules you require, but your code doesn't appear to call +these vulnerabilities. +Use '-show verbose' for more details. diff --git a/documentation/audits/security-review-2026-10-12/scanners/govulncheck-source-controller.txt b/documentation/audits/security-review-2026-10-12/scanners/govulncheck-source-controller.txt new file mode 100644 index 00000000..ece15620 --- /dev/null +++ b/documentation/audits/security-review-2026-10-12/scanners/govulncheck-source-controller.txt @@ -0,0 +1,1170 @@ +=== Symbol Results === + +Vulnerability #1: GO-2026-6617 + HTTP/2 server crash due to HPACK encoder race in net/http + More info: https://pkg.go.dev/vuln/GO-2026-6617 + Standard library + Found in: net/http@go1.26 + Fixed in: net/http@go1.26.9 + Example traces found: + #1: internal/agentapi/client.go:153:53: agentapi.Client.Close calls http.Client.CloseIdleConnections + #2: internal/agentapi/client.go:153:53: agentapi.Client.Close calls http.Client.CloseIdleConnections + #3: internal/notify/notifier.go:1159:30: notify.Notifier.PushTestEventSync calls http.Client.Do + #4: internal/notify/notifier.go:1159:30: notify.Notifier.PushTestEventSync calls http.Client.Do + #5: internal/stacks/setup_gate.go:374:20: stacks.init calls http.Client.Get + #6: internal/stacks/setup_gate.go:374:20: stacks.init calls http.Client.Get + #7: cmd/controller/main.go:2113:29: controller.main calls http.Client.Head + #8: cmd/controller/main.go:2113:29: controller.main calls http.Client.Head + #9: internal/web/setup_gate.go:279:13: web.Server.ServeGateStart calls http.Error + #10: internal/web/setup_gate.go:279:13: web.Server.ServeGateStart calls http.Error + #11: internal/web/setup_gate.go:364:35: web.Server.ServeSignupClosed calls http.Header.Get + #12: internal/web/setup_gate.go:364:35: web.Server.ServeSignupClosed calls http.Header.Get + #13: internal/notify/notifier.go:1156:16: notify.Notifier.PushTestEventSync calls http.Header.Set + #14: internal/notify/notifier.go:1156:16: notify.Notifier.PushTestEventSync calls http.Header.Set + #15: internal/web/clientaddr.go:99:35: web.clientIP calls http.Header.Values + #16: internal/web/clientaddr.go:99:35: web.clientIP calls http.Header.Values + #17: internal/notify/notifier.go:1152:29: notify.Notifier.PushTestEventSync calls http.NewRequest + #18: internal/notify/notifier.go:1152:29: notify.Notifier.PushTestEventSync calls http.NewRequest + #19: internal/agentapi/client.go:667:40: agentapi.Client.WipeStagedEscrowSecret calls http.NewRequestWithContext + #20: internal/agentapi/client.go:667:40: agentapi.Client.WipeStagedEscrowSecret calls http.NewRequestWithContext + #21: internal/web/server.go:865:16: web.Server.ServeHTTP calls http.NotFound + #22: internal/web/server.go:865:16: web.Server.ServeHTTP calls http.NotFound + #23: internal/web/server.go:583:16: web.Server.ServeHTTP calls http.Redirect + #24: internal/web/server.go:583:16: web.Server.ServeHTTP calls http.Redirect + #25: internal/web/family_gate.go:390:23: web.Server.ServeFamilyLogout calls http.Request.Cookie + #26: internal/web/family_gate.go:390:23: web.Server.ServeFamilyLogout calls http.Request.Cookie + #27: internal/web/family_gate.go:352:19: web.Server.ServeFamilyLogin calls http.Request.FormValue + #28: internal/web/family_gate.go:352:19: web.Server.ServeFamilyLogin calls http.Request.FormValue + #29: internal/web/family_gate.go:351:17: web.Server.ServeFamilyLogin calls http.Request.ParseForm + #30: internal/web/family_gate.go:351:17: web.Server.ServeFamilyLogin calls http.Request.ParseForm + #31: internal/web/recovery_handlers.go:347:25: web.Server.recoveryUnlockHandler calls http.Request.PostFormValue + #32: internal/web/recovery_handlers.go:347:25: web.Server.recoveryUnlockHandler calls http.Request.PostFormValue + #33: internal/selfupdate/updater.go:255:18: selfupdate.Updater.queryRegistry calls http.Request.SetBasicAuth + #34: internal/selfupdate/updater.go:255:18: selfupdate.Updater.queryRegistry calls http.Request.SetBasicAuth + #35: internal/web/server.go:1163:16: web.Server.serveAsset calls http.ServeFile + #36: internal/web/server.go:1163:16: web.Server.serveAsset calls http.ServeFile + #37: cmd/controller/main.go:2138:12: controller.main calls http.ServeMux.Handle + #38: cmd/controller/main.go:2138:12: controller.main calls http.ServeMux.Handle + #39: internal/setup/handlers.go:90:16: setup.Server.Handler calls http.ServeMux.HandleFunc + #40: internal/setup/handlers.go:90:16: setup.Server.Handler calls http.ServeMux.HandleFunc + #41: cmd/controller/main.go:2214:33: controller.main calls http.Server.ListenAndServe + #42: cmd/controller/main.go:2214:33: controller.main calls http.Server.ListenAndServe + #43: cmd/controller/main.go:3759:21: controller.runSetupMode calls http.Server.Shutdown + #44: cmd/controller/main.go:3759:21: controller.runSetupMode calls http.Server.Shutdown + #45: internal/web/family_gate.go:395:16: web.Server.ServeFamilyLogout calls http.SetCookie + #46: internal/web/family_gate.go:395:16: web.Server.ServeFamilyLogout calls http.SetCookie + #47: internal/notify/notifier.go:1165:17: notify.Notifier.PushTestEventSync calls http.body.Close + #48: internal/notify/notifier.go:1165:17: notify.Notifier.PushTestEventSync calls http.body.Close + #49: internal/notify/notifier.go:1078:24: notify.Notifier.SyncPreferences calls io.ReadAll, which calls http.body.Read + #50: internal/notify/notifier.go:1078:24: notify.Notifier.SyncPreferences calls io.ReadAll, which calls http.body.Read + #51: internal/notify/notifier.go:1165:17: notify.Notifier.PushTestEventSync calls http.bodyEOFSignal.Close + #52: internal/notify/notifier.go:1165:17: notify.Notifier.PushTestEventSync calls http.bodyEOFSignal.Close + #53: internal/notify/notifier.go:1078:24: notify.Notifier.SyncPreferences calls io.ReadAll, which calls http.bodyEOFSignal.Read + #54: internal/notify/notifier.go:1078:24: notify.Notifier.SyncPreferences calls io.ReadAll, which calls http.bodyEOFSignal.Read + #55: internal/notify/notifier.go:1164:9: notify.Notifier.PushTestEventSync calls io.Copy, which eventually calls http.bodyLocked.Read + #56: internal/notify/notifier.go:1164:9: notify.Notifier.PushTestEventSync calls io.Copy, which eventually calls http.bodyLocked.Read + #57: internal/sockheal/sockheal.go:78:29: sockheal.PingSocket calls io.WriteString, which calls http.bufioFlushWriter.Write + #58: internal/sockheal/sockheal.go:78:29: sockheal.PingSocket calls io.WriteString, which calls http.bufioFlushWriter.Write + #59: internal/notify/notifier.go:1165:17: notify.Notifier.PushTestEventSync calls http.cancelTimerBody.Close + #60: internal/notify/notifier.go:1165:17: notify.Notifier.PushTestEventSync calls http.cancelTimerBody.Close + #61: internal/notify/notifier.go:1078:24: notify.Notifier.SyncPreferences calls io.ReadAll, which calls http.cancelTimerBody.Read + #62: internal/notify/notifier.go:1078:24: notify.Notifier.SyncPreferences calls io.ReadAll, which calls http.cancelTimerBody.Read + #63: internal/web/logbuffer.go:199:19: web.LogBuffer.SpillTo calls bufio.Writer.Flush, which calls http.checkConnErrorWriter.Write + #64: internal/web/logbuffer.go:199:19: web.LogBuffer.SpillTo calls bufio.Writer.Flush, which calls http.checkConnErrorWriter.Write + #65: internal/web/logbuffer.go:199:19: web.LogBuffer.SpillTo calls bufio.Writer.Flush, which calls http.chunkWriter.Write + #66: internal/web/logbuffer.go:199:19: web.LogBuffer.SpillTo calls bufio.Writer.Flush, which calls http.chunkWriter.Write + #67: internal/notify/notifier.go:1164:9: notify.Notifier.PushTestEventSync calls io.Copy, which eventually calls http.connReader.Read + #68: internal/notify/notifier.go:1164:9: notify.Notifier.PushTestEventSync calls io.Copy, which eventually calls http.connReader.Read + #69: internal/notify/notifier.go:1078:24: notify.Notifier.SyncPreferences calls io.ReadAll, which calls http.expectContinueReader.Read + #70: internal/notify/notifier.go:1078:24: notify.Notifier.SyncPreferences calls io.ReadAll, which calls http.expectContinueReader.Read + #71: internal/notify/notifier.go:1165:17: notify.Notifier.PushTestEventSync calls http.gzipReader.Close + #72: internal/notify/notifier.go:1165:17: notify.Notifier.PushTestEventSync calls http.gzipReader.Close + #73: internal/notify/notifier.go:1078:24: notify.Notifier.SyncPreferences calls io.ReadAll, which calls http.gzipReader.Read + #74: internal/notify/notifier.go:1078:24: notify.Notifier.SyncPreferences calls io.ReadAll, which calls http.gzipReader.Read + #75: internal/util/msgerr.go:150:18: util.ErrText calls http.http2ConnectionError.Error + #76: internal/util/msgerr.go:150:18: util.ErrText calls http.http2ConnectionError.Error + #77: internal/backup/offbox_recovery_cli.go:235:15: backup.RecoverAndInstall calls fmt.Fprintln, which eventually calls http.http2ErrCode.String + #78: internal/backup/offbox_recovery_cli.go:235:15: backup.RecoverAndInstall calls fmt.Fprintln, which eventually calls http.http2ErrCode.String + #79: internal/backup/offbox_recovery_cli.go:235:15: backup.RecoverAndInstall calls fmt.Fprintln, which eventually calls http.http2FrameHeader.String + #80: internal/backup/offbox_recovery_cli.go:235:15: backup.RecoverAndInstall calls fmt.Fprintln, which eventually calls http.http2FrameHeader.String + #81: internal/backup/offbox_recovery_cli.go:235:15: backup.RecoverAndInstall calls fmt.Fprintln, which eventually calls http.http2FrameType.String + #82: internal/backup/offbox_recovery_cli.go:235:15: backup.RecoverAndInstall calls fmt.Fprintln, which eventually calls http.http2FrameType.String + #83: internal/backup/offbox_recovery_cli.go:235:15: backup.RecoverAndInstall calls fmt.Fprintln, which eventually calls http.http2FrameWriteRequest.String + #84: internal/backup/offbox_recovery_cli.go:235:15: backup.RecoverAndInstall calls fmt.Fprintln, which eventually calls http.http2FrameWriteRequest.String + #85: internal/util/msgerr.go:150:18: util.ErrText calls http.http2GoAwayError.Error + #86: internal/util/msgerr.go:150:18: util.ErrText calls http.http2GoAwayError.Error + #87: internal/backup/offbox_recovery_cli.go:235:15: backup.RecoverAndInstall calls fmt.Fprintln, which eventually calls http.http2Setting.String + #88: internal/backup/offbox_recovery_cli.go:235:15: backup.RecoverAndInstall calls fmt.Fprintln, which eventually calls http.http2Setting.String + #89: internal/backup/offbox_recovery_cli.go:235:15: backup.RecoverAndInstall calls fmt.Fprintln, which eventually calls http.http2SettingID.String + #90: internal/backup/offbox_recovery_cli.go:235:15: backup.RecoverAndInstall calls fmt.Fprintln, which eventually calls http.http2SettingID.String + #91: internal/util/msgerr.go:150:18: util.ErrText calls http.http2StreamError.Error + #92: internal/util/msgerr.go:150:18: util.ErrText calls http.http2StreamError.Error + #93: internal/web/logbuffer.go:199:19: web.LogBuffer.SpillTo calls bufio.Writer.Flush, which calls http.http2bufferedWriterTimeoutWriter.Write + #94: internal/web/logbuffer.go:199:19: web.LogBuffer.SpillTo calls bufio.Writer.Flush, which calls http.http2bufferedWriterTimeoutWriter.Write + #95: internal/web/logbuffer.go:199:19: web.LogBuffer.SpillTo calls bufio.Writer.Flush, which calls http.http2chunkWriter.Write + #96: internal/web/logbuffer.go:199:19: web.LogBuffer.SpillTo calls bufio.Writer.Flush, which calls http.http2chunkWriter.Write + #97: internal/util/msgerr.go:150:18: util.ErrText calls http.http2connError.Error + #98: internal/util/msgerr.go:150:18: util.ErrText calls http.http2connError.Error + #99: internal/util/msgerr.go:150:18: util.ErrText calls http.http2duplicatePseudoHeaderError.Error + #100: internal/util/msgerr.go:150:18: util.ErrText calls http.http2duplicatePseudoHeaderError.Error + #101: internal/notify/notifier.go:1165:17: notify.Notifier.PushTestEventSync calls http.http2gzipReader.Close + #102: internal/notify/notifier.go:1165:17: notify.Notifier.PushTestEventSync calls http.http2gzipReader.Close + #103: internal/notify/notifier.go:1078:24: notify.Notifier.SyncPreferences calls io.ReadAll, which calls http.http2gzipReader.Read + #104: internal/notify/notifier.go:1078:24: notify.Notifier.SyncPreferences calls io.ReadAll, which calls http.http2gzipReader.Read + #105: internal/util/msgerr.go:150:18: util.ErrText calls http.http2headerFieldNameError.Error + #106: internal/util/msgerr.go:150:18: util.ErrText calls http.http2headerFieldNameError.Error + #107: internal/util/msgerr.go:150:18: util.ErrText calls http.http2headerFieldValueError.Error + #108: internal/util/msgerr.go:150:18: util.ErrText calls http.http2headerFieldValueError.Error + #109: internal/util/msgerr.go:150:18: util.ErrText calls http.http2pseudoHeaderError.Error + #110: internal/util/msgerr.go:150:18: util.ErrText calls http.http2pseudoHeaderError.Error + #111: internal/notify/notifier.go:1078:24: notify.Notifier.SyncPreferences calls io.ReadAll, which calls http.http2requestBody.Read + #112: internal/notify/notifier.go:1078:24: notify.Notifier.SyncPreferences calls io.ReadAll, which calls http.http2requestBody.Read + #113: internal/api/selfrestart.go:39:10: api.flushResponse calls http.http2responseWriter.Flush + #114: internal/api/selfrestart.go:39:10: api.flushResponse calls http.http2responseWriter.Flush + #115: internal/web/setup_gate.go:367:17: web.Server.ServeSignupClosed calls http.http2responseWriter.Write + #116: internal/web/setup_gate.go:367:17: web.Server.ServeSignupClosed calls http.http2responseWriter.Write + #117: internal/web/setup_gate.go:366:16: web.Server.ServeSignupClosed calls http.http2responseWriter.WriteHeader + #118: internal/web/setup_gate.go:366:16: web.Server.ServeSignupClosed calls http.http2responseWriter.WriteHeader + #119: internal/sockheal/sockheal.go:78:29: sockheal.PingSocket calls io.WriteString, which calls http.http2responseWriter.WriteString + #120: internal/sockheal/sockheal.go:78:29: sockheal.PingSocket calls io.WriteString, which calls http.http2responseWriter.WriteString + #121: internal/web/logbuffer.go:199:19: web.LogBuffer.SpillTo calls bufio.Writer.Flush, which calls http.http2stickyErrWriter.Write + #122: internal/web/logbuffer.go:199:19: web.LogBuffer.SpillTo calls bufio.Writer.Flush, which calls http.http2stickyErrWriter.Write + #123: internal/notify/notifier.go:1165:17: notify.Notifier.PushTestEventSync calls http.http2transportResponseBody.Close + #124: internal/notify/notifier.go:1165:17: notify.Notifier.PushTestEventSync calls http.http2transportResponseBody.Close + #125: internal/notify/notifier.go:1078:24: notify.Notifier.SyncPreferences calls io.ReadAll, which calls http.http2transportResponseBody.Read + #126: internal/notify/notifier.go:1078:24: notify.Notifier.SyncPreferences calls io.ReadAll, which calls http.http2transportResponseBody.Read + #127: internal/backup/offbox_recovery_cli.go:235:15: backup.RecoverAndInstall calls fmt.Fprintln, which eventually calls http.http2writeData.String + #128: internal/backup/offbox_recovery_cli.go:235:15: backup.RecoverAndInstall calls fmt.Fprintln, which eventually calls http.http2writeData.String + #129: internal/notify/notifier.go:1164:9: notify.Notifier.PushTestEventSync calls io.Copy, which eventually calls http.loggingConn.Read + #130: internal/notify/notifier.go:1164:9: notify.Notifier.PushTestEventSync calls io.Copy, which eventually calls http.loggingConn.Read + #131: internal/web/claim.go:486:14: web.PrintLocalResetCode calls fmt.Fprintf, which calls http.loggingConn.Write + #132: internal/web/claim.go:486:14: web.PrintLocalResetCode calls fmt.Fprintf, which calls http.loggingConn.Write + #133: internal/notify/notifier.go:1078:24: notify.Notifier.SyncPreferences calls io.ReadAll, which calls http.maxBytesReader.Read + #134: internal/notify/notifier.go:1078:24: notify.Notifier.SyncPreferences calls io.ReadAll, which calls http.maxBytesReader.Read + #135: internal/web/auth.go:341:16: web.Server.Close calls sync.Once.Do, which eventually calls http.onceCloseListener.Close + #136: internal/web/auth.go:341:16: web.Server.Close calls sync.Once.Do, which eventually calls http.onceCloseListener.Close + #137: internal/notify/notifier.go:1164:9: notify.Notifier.PushTestEventSync calls io.Copy, which eventually calls http.persistConn.Read + #138: internal/notify/notifier.go:1164:9: notify.Notifier.PushTestEventSync calls io.Copy, which eventually calls http.persistConn.Read + #139: internal/notify/notifier.go:1164:9: notify.Notifier.PushTestEventSync calls io.Copy, which eventually calls http.persistConnWriter.ReadFrom + #140: internal/notify/notifier.go:1164:9: notify.Notifier.PushTestEventSync calls io.Copy, which eventually calls http.persistConnWriter.ReadFrom + #141: internal/web/logbuffer.go:199:19: web.LogBuffer.SpillTo calls bufio.Writer.Flush, which calls http.persistConnWriter.Write + #142: internal/web/logbuffer.go:199:19: web.LogBuffer.SpillTo calls bufio.Writer.Flush, which calls http.persistConnWriter.Write + #143: internal/notify/notifier.go:1078:24: notify.Notifier.SyncPreferences calls io.ReadAll, which calls http.readTrackingBody.Read + #144: internal/notify/notifier.go:1078:24: notify.Notifier.SyncPreferences calls io.ReadAll, which calls http.readTrackingBody.Read + #145: internal/notify/notifier.go:1078:24: notify.Notifier.SyncPreferences calls io.ReadAll, which calls http.readWriteCloserBody.Read + #146: internal/notify/notifier.go:1078:24: notify.Notifier.SyncPreferences calls io.ReadAll, which calls http.readWriteCloserBody.Read + #147: internal/api/selfrestart.go:39:10: api.flushResponse calls http.response.Flush + #148: internal/api/selfrestart.go:39:10: api.flushResponse calls http.response.Flush + #149: internal/notify/notifier.go:1164:9: notify.Notifier.PushTestEventSync calls io.Copy, which eventually calls http.response.ReadFrom + #150: internal/notify/notifier.go:1164:9: notify.Notifier.PushTestEventSync calls io.Copy, which eventually calls http.response.ReadFrom + #151: internal/web/setup_gate.go:367:17: web.Server.ServeSignupClosed calls http.response.Write + #152: internal/web/setup_gate.go:367:17: web.Server.ServeSignupClosed calls http.response.Write + #153: internal/web/setup_gate.go:366:16: web.Server.ServeSignupClosed calls http.response.WriteHeader + #154: internal/web/setup_gate.go:366:16: web.Server.ServeSignupClosed calls http.response.WriteHeader + #155: internal/sockheal/sockheal.go:78:29: sockheal.PingSocket calls io.WriteString, which calls http.response.WriteString + #156: internal/sockheal/sockheal.go:78:29: sockheal.PingSocket calls io.WriteString, which calls http.response.WriteString + #157: internal/util/msgerr.go:150:18: util.ErrText calls http.transportReadFromServerError.Error + #158: internal/util/msgerr.go:150:18: util.ErrText calls http.transportReadFromServerError.Error + +Vulnerability #2: GO-2026-6613 + HTTP/1 server connection desynchronization after 2xx CONNECT response in + net/http + More info: https://pkg.go.dev/vuln/GO-2026-6613 + Standard library + Found in: net/http@go1.26 + Fixed in: net/http@go1.26.9 + Example traces found: + #1: internal/web/logbuffer.go:199:19: web.LogBuffer.SpillTo calls bufio.Writer.Flush, which eventually calls http.CanonicalHeaderKey + #2: internal/agentapi/client.go:153:53: agentapi.Client.Close calls http.Client.CloseIdleConnections + #3: internal/notify/notifier.go:1159:30: notify.Notifier.PushTestEventSync calls http.Client.Do + #4: internal/stacks/setup_gate.go:374:20: stacks.init calls http.Client.Get + #5: cmd/controller/main.go:2113:29: controller.main calls http.Client.Head + #6: internal/web/setup_gate.go:279:13: web.Server.ServeGateStart calls http.Error + #7: internal/web/setup_gate.go:366:16: web.Server.ServeSignupClosed calls http.http2responseWriter.WriteHeader, which eventually calls http.Header.Del + #8: internal/web/setup_gate.go:364:35: web.Server.ServeSignupClosed calls http.Header.Get + #9: internal/notify/notifier.go:1156:16: notify.Notifier.PushTestEventSync calls http.Header.Set + #10: internal/web/clientaddr.go:99:35: web.clientIP calls http.Header.Values + #11: internal/notify/notifier.go:1152:29: notify.Notifier.PushTestEventSync calls http.NewRequest + #12: internal/agentapi/client.go:667:40: agentapi.Client.WipeStagedEscrowSecret calls http.NewRequestWithContext + #13: internal/web/server.go:865:16: web.Server.ServeHTTP calls http.NotFound + #14: internal/web/server.go:583:16: web.Server.ServeHTTP calls http.Redirect + #15: internal/web/family_gate.go:390:23: web.Server.ServeFamilyLogout calls http.Request.Cookie + #16: internal/web/family_gate.go:352:19: web.Server.ServeFamilyLogin calls http.Request.FormValue + #17: internal/web/family_gate.go:351:17: web.Server.ServeFamilyLogin calls http.Request.ParseForm + #18: internal/web/recovery_handlers.go:347:25: web.Server.recoveryUnlockHandler calls http.Request.PostFormValue + #19: internal/selfupdate/updater.go:255:18: selfupdate.Updater.queryRegistry calls http.Request.SetBasicAuth + #20: internal/web/server.go:1163:16: web.Server.serveAsset calls http.ServeFile + #21: cmd/controller/main.go:2138:12: controller.main calls http.ServeMux.Handle + #22: internal/setup/handlers.go:90:16: setup.Server.Handler calls http.ServeMux.HandleFunc + #23: cmd/controller/main.go:2214:33: controller.main calls http.Server.ListenAndServe + #24: cmd/controller/main.go:3759:21: controller.runSetupMode calls http.Server.Shutdown + #25: internal/web/family_gate.go:395:16: web.Server.ServeFamilyLogout calls http.SetCookie + #26: internal/notify/notifier.go:1165:17: notify.Notifier.PushTestEventSync calls http.body.Close + #27: internal/notify/notifier.go:1078:24: notify.Notifier.SyncPreferences calls io.ReadAll, which calls http.body.Read + #28: internal/notify/notifier.go:1165:17: notify.Notifier.PushTestEventSync calls http.bodyEOFSignal.Close + #29: internal/notify/notifier.go:1078:24: notify.Notifier.SyncPreferences calls io.ReadAll, which calls http.bodyEOFSignal.Read + #30: internal/notify/notifier.go:1164:9: notify.Notifier.PushTestEventSync calls io.Copy, which eventually calls http.bodyLocked.Read + #31: internal/sockheal/sockheal.go:78:29: sockheal.PingSocket calls io.WriteString, which calls http.bufioFlushWriter.Write + #32: internal/notify/notifier.go:1165:17: notify.Notifier.PushTestEventSync calls http.cancelTimerBody.Close + #33: internal/notify/notifier.go:1078:24: notify.Notifier.SyncPreferences calls io.ReadAll, which calls http.cancelTimerBody.Read + #34: internal/web/logbuffer.go:199:19: web.LogBuffer.SpillTo calls bufio.Writer.Flush, which calls http.checkConnErrorWriter.Write + #35: internal/web/logbuffer.go:199:19: web.LogBuffer.SpillTo calls bufio.Writer.Flush, which calls http.chunkWriter.Write + #36: internal/notify/notifier.go:1164:9: notify.Notifier.PushTestEventSync calls io.Copy, which eventually calls http.connReader.Read + #37: internal/notify/notifier.go:1165:17: notify.Notifier.PushTestEventSync calls http.http2transportResponseBody.Close, which eventually calls http.expectContinueReader.Close + #38: internal/notify/notifier.go:1078:24: notify.Notifier.SyncPreferences calls io.ReadAll, which calls http.expectContinueReader.Read + #39: internal/notify/notifier.go:1165:17: notify.Notifier.PushTestEventSync calls http.gzipReader.Close + #40: internal/notify/notifier.go:1078:24: notify.Notifier.SyncPreferences calls io.ReadAll, which calls http.gzipReader.Read + #41: internal/notify/notifier.go:1164:9: notify.Notifier.PushTestEventSync calls io.Copy, which eventually calls http.loggingConn.Read + #42: internal/web/claim.go:486:14: web.PrintLocalResetCode calls fmt.Fprintf, which calls http.loggingConn.Write + #43: internal/notify/notifier.go:1165:17: notify.Notifier.PushTestEventSync calls http.http2transportResponseBody.Close, which eventually calls http.maxBytesReader.Close + #44: internal/notify/notifier.go:1078:24: notify.Notifier.SyncPreferences calls io.ReadAll, which calls http.maxBytesReader.Read + #45: internal/web/auth.go:341:16: web.Server.Close calls sync.Once.Do, which eventually calls http.onceCloseListener.Close + #46: internal/notify/notifier.go:1164:9: notify.Notifier.PushTestEventSync calls io.Copy, which eventually calls http.persistConn.Read + #47: internal/notify/notifier.go:1164:9: notify.Notifier.PushTestEventSync calls io.Copy, which eventually calls http.persistConnWriter.ReadFrom + #48: internal/web/logbuffer.go:199:19: web.LogBuffer.SpillTo calls bufio.Writer.Flush, which calls http.persistConnWriter.Write + #49: internal/notify/notifier.go:1165:17: notify.Notifier.PushTestEventSync calls http.http2transportResponseBody.Close, which eventually calls http.readTrackingBody.Close + #50: internal/notify/notifier.go:1078:24: notify.Notifier.SyncPreferences calls io.ReadAll, which calls http.readTrackingBody.Read + #51: internal/notify/notifier.go:1078:24: notify.Notifier.SyncPreferences calls io.ReadAll, which calls http.readWriteCloserBody.Read + #52: internal/api/selfrestart.go:39:10: api.flushResponse calls http.response.Flush + #53: internal/notify/notifier.go:1164:9: notify.Notifier.PushTestEventSync calls io.Copy, which eventually calls http.response.ReadFrom + #54: internal/web/setup_gate.go:367:17: web.Server.ServeSignupClosed calls http.response.Write + #55: internal/web/setup_gate.go:366:16: web.Server.ServeSignupClosed calls http.response.WriteHeader + #56: internal/sockheal/sockheal.go:78:29: sockheal.PingSocket calls io.WriteString, which calls http.response.WriteString + #57: internal/util/msgerr.go:150:18: util.ErrText calls http.transportReadFromServerError.Error + +Vulnerability #3: GO-2026-6612 + Double flow control refund on HTTP/2 server streams in net/http + More info: https://pkg.go.dev/vuln/GO-2026-6612 + Standard library + Found in: net/http@go1.26 + Fixed in: net/http@go1.26.9 + Example traces found: + #1: internal/agentapi/client.go:153:53: agentapi.Client.Close calls http.Client.CloseIdleConnections + #2: internal/agentapi/client.go:153:53: agentapi.Client.Close calls http.Client.CloseIdleConnections + #3: internal/notify/notifier.go:1159:30: notify.Notifier.PushTestEventSync calls http.Client.Do + #4: internal/notify/notifier.go:1159:30: notify.Notifier.PushTestEventSync calls http.Client.Do + #5: internal/stacks/setup_gate.go:374:20: stacks.init calls http.Client.Get + #6: internal/stacks/setup_gate.go:374:20: stacks.init calls http.Client.Get + #7: cmd/controller/main.go:2113:29: controller.main calls http.Client.Head + #8: cmd/controller/main.go:2113:29: controller.main calls http.Client.Head + #9: internal/web/setup_gate.go:279:13: web.Server.ServeGateStart calls http.Error + #10: internal/web/setup_gate.go:279:13: web.Server.ServeGateStart calls http.Error + #11: internal/web/setup_gate.go:364:35: web.Server.ServeSignupClosed calls http.Header.Get + #12: internal/web/setup_gate.go:364:35: web.Server.ServeSignupClosed calls http.Header.Get + #13: internal/notify/notifier.go:1156:16: notify.Notifier.PushTestEventSync calls http.Header.Set + #14: internal/notify/notifier.go:1156:16: notify.Notifier.PushTestEventSync calls http.Header.Set + #15: internal/web/clientaddr.go:99:35: web.clientIP calls http.Header.Values + #16: internal/web/clientaddr.go:99:35: web.clientIP calls http.Header.Values + #17: internal/notify/notifier.go:1152:29: notify.Notifier.PushTestEventSync calls http.NewRequest + #18: internal/notify/notifier.go:1152:29: notify.Notifier.PushTestEventSync calls http.NewRequest + #19: internal/agentapi/client.go:667:40: agentapi.Client.WipeStagedEscrowSecret calls http.NewRequestWithContext + #20: internal/agentapi/client.go:667:40: agentapi.Client.WipeStagedEscrowSecret calls http.NewRequestWithContext + #21: internal/web/server.go:865:16: web.Server.ServeHTTP calls http.NotFound + #22: internal/web/server.go:865:16: web.Server.ServeHTTP calls http.NotFound + #23: internal/web/server.go:583:16: web.Server.ServeHTTP calls http.Redirect + #24: internal/web/server.go:583:16: web.Server.ServeHTTP calls http.Redirect + #25: internal/web/family_gate.go:390:23: web.Server.ServeFamilyLogout calls http.Request.Cookie + #26: internal/web/family_gate.go:390:23: web.Server.ServeFamilyLogout calls http.Request.Cookie + #27: internal/web/family_gate.go:352:19: web.Server.ServeFamilyLogin calls http.Request.FormValue + #28: internal/web/family_gate.go:352:19: web.Server.ServeFamilyLogin calls http.Request.FormValue + #29: internal/web/family_gate.go:351:17: web.Server.ServeFamilyLogin calls http.Request.ParseForm + #30: internal/web/family_gate.go:351:17: web.Server.ServeFamilyLogin calls http.Request.ParseForm + #31: internal/web/recovery_handlers.go:347:25: web.Server.recoveryUnlockHandler calls http.Request.PostFormValue + #32: internal/web/recovery_handlers.go:347:25: web.Server.recoveryUnlockHandler calls http.Request.PostFormValue + #33: internal/selfupdate/updater.go:255:18: selfupdate.Updater.queryRegistry calls http.Request.SetBasicAuth + #34: internal/selfupdate/updater.go:255:18: selfupdate.Updater.queryRegistry calls http.Request.SetBasicAuth + #35: internal/web/server.go:1163:16: web.Server.serveAsset calls http.ServeFile + #36: internal/web/server.go:1163:16: web.Server.serveAsset calls http.ServeFile + #37: cmd/controller/main.go:2138:12: controller.main calls http.ServeMux.Handle + #38: cmd/controller/main.go:2138:12: controller.main calls http.ServeMux.Handle + #39: internal/setup/handlers.go:90:16: setup.Server.Handler calls http.ServeMux.HandleFunc + #40: internal/setup/handlers.go:90:16: setup.Server.Handler calls http.ServeMux.HandleFunc + #41: cmd/controller/main.go:2214:33: controller.main calls http.Server.ListenAndServe + #42: cmd/controller/main.go:2214:33: controller.main calls http.Server.ListenAndServe + #43: cmd/controller/main.go:3759:21: controller.runSetupMode calls http.Server.Shutdown + #44: cmd/controller/main.go:3759:21: controller.runSetupMode calls http.Server.Shutdown + #45: internal/web/family_gate.go:395:16: web.Server.ServeFamilyLogout calls http.SetCookie + #46: internal/web/family_gate.go:395:16: web.Server.ServeFamilyLogout calls http.SetCookie + #47: internal/notify/notifier.go:1165:17: notify.Notifier.PushTestEventSync calls http.body.Close + #48: internal/notify/notifier.go:1165:17: notify.Notifier.PushTestEventSync calls http.body.Close + #49: internal/notify/notifier.go:1078:24: notify.Notifier.SyncPreferences calls io.ReadAll, which calls http.body.Read + #50: internal/notify/notifier.go:1078:24: notify.Notifier.SyncPreferences calls io.ReadAll, which calls http.body.Read + #51: internal/notify/notifier.go:1165:17: notify.Notifier.PushTestEventSync calls http.bodyEOFSignal.Close + #52: internal/notify/notifier.go:1165:17: notify.Notifier.PushTestEventSync calls http.bodyEOFSignal.Close + #53: internal/notify/notifier.go:1078:24: notify.Notifier.SyncPreferences calls io.ReadAll, which calls http.bodyEOFSignal.Read + #54: internal/notify/notifier.go:1078:24: notify.Notifier.SyncPreferences calls io.ReadAll, which calls http.bodyEOFSignal.Read + #55: internal/notify/notifier.go:1164:9: notify.Notifier.PushTestEventSync calls io.Copy, which eventually calls http.bodyLocked.Read + #56: internal/notify/notifier.go:1164:9: notify.Notifier.PushTestEventSync calls io.Copy, which eventually calls http.bodyLocked.Read + #57: internal/sockheal/sockheal.go:78:29: sockheal.PingSocket calls io.WriteString, which calls http.bufioFlushWriter.Write + #58: internal/sockheal/sockheal.go:78:29: sockheal.PingSocket calls io.WriteString, which calls http.bufioFlushWriter.Write + #59: internal/notify/notifier.go:1165:17: notify.Notifier.PushTestEventSync calls http.cancelTimerBody.Close + #60: internal/notify/notifier.go:1165:17: notify.Notifier.PushTestEventSync calls http.cancelTimerBody.Close + #61: internal/notify/notifier.go:1078:24: notify.Notifier.SyncPreferences calls io.ReadAll, which calls http.cancelTimerBody.Read + #62: internal/notify/notifier.go:1078:24: notify.Notifier.SyncPreferences calls io.ReadAll, which calls http.cancelTimerBody.Read + #63: internal/web/logbuffer.go:199:19: web.LogBuffer.SpillTo calls bufio.Writer.Flush, which calls http.checkConnErrorWriter.Write + #64: internal/web/logbuffer.go:199:19: web.LogBuffer.SpillTo calls bufio.Writer.Flush, which calls http.checkConnErrorWriter.Write + #65: internal/web/logbuffer.go:199:19: web.LogBuffer.SpillTo calls bufio.Writer.Flush, which calls http.chunkWriter.Write + #66: internal/web/logbuffer.go:199:19: web.LogBuffer.SpillTo calls bufio.Writer.Flush, which calls http.chunkWriter.Write + #67: internal/notify/notifier.go:1164:9: notify.Notifier.PushTestEventSync calls io.Copy, which eventually calls http.connReader.Read + #68: internal/notify/notifier.go:1164:9: notify.Notifier.PushTestEventSync calls io.Copy, which eventually calls http.connReader.Read + #69: internal/notify/notifier.go:1078:24: notify.Notifier.SyncPreferences calls io.ReadAll, which calls http.expectContinueReader.Read + #70: internal/notify/notifier.go:1078:24: notify.Notifier.SyncPreferences calls io.ReadAll, which calls http.expectContinueReader.Read + #71: internal/notify/notifier.go:1165:17: notify.Notifier.PushTestEventSync calls http.gzipReader.Close + #72: internal/notify/notifier.go:1165:17: notify.Notifier.PushTestEventSync calls http.gzipReader.Close + #73: internal/notify/notifier.go:1078:24: notify.Notifier.SyncPreferences calls io.ReadAll, which calls http.gzipReader.Read + #74: internal/notify/notifier.go:1078:24: notify.Notifier.SyncPreferences calls io.ReadAll, which calls http.gzipReader.Read + #75: internal/util/msgerr.go:150:18: util.ErrText calls http.http2ConnectionError.Error + #76: internal/util/msgerr.go:150:18: util.ErrText calls http.http2ConnectionError.Error + #77: internal/backup/offbox_recovery_cli.go:235:15: backup.RecoverAndInstall calls fmt.Fprintln, which eventually calls http.http2ErrCode.String + #78: internal/backup/offbox_recovery_cli.go:235:15: backup.RecoverAndInstall calls fmt.Fprintln, which eventually calls http.http2ErrCode.String + #79: internal/backup/offbox_recovery_cli.go:235:15: backup.RecoverAndInstall calls fmt.Fprintln, which eventually calls http.http2FrameHeader.String + #80: internal/backup/offbox_recovery_cli.go:235:15: backup.RecoverAndInstall calls fmt.Fprintln, which eventually calls http.http2FrameHeader.String + #81: internal/backup/offbox_recovery_cli.go:235:15: backup.RecoverAndInstall calls fmt.Fprintln, which eventually calls http.http2FrameType.String + #82: internal/backup/offbox_recovery_cli.go:235:15: backup.RecoverAndInstall calls fmt.Fprintln, which eventually calls http.http2FrameType.String + #83: internal/backup/offbox_recovery_cli.go:235:15: backup.RecoverAndInstall calls fmt.Fprintln, which eventually calls http.http2FrameWriteRequest.String + #84: internal/backup/offbox_recovery_cli.go:235:15: backup.RecoverAndInstall calls fmt.Fprintln, which eventually calls http.http2FrameWriteRequest.String + #85: internal/util/msgerr.go:150:18: util.ErrText calls http.http2GoAwayError.Error + #86: internal/util/msgerr.go:150:18: util.ErrText calls http.http2GoAwayError.Error + #87: internal/backup/offbox_recovery_cli.go:235:15: backup.RecoverAndInstall calls fmt.Fprintln, which eventually calls http.http2Setting.String + #88: internal/backup/offbox_recovery_cli.go:235:15: backup.RecoverAndInstall calls fmt.Fprintln, which eventually calls http.http2Setting.String + #89: internal/backup/offbox_recovery_cli.go:235:15: backup.RecoverAndInstall calls fmt.Fprintln, which eventually calls http.http2SettingID.String + #90: internal/backup/offbox_recovery_cli.go:235:15: backup.RecoverAndInstall calls fmt.Fprintln, which eventually calls http.http2SettingID.String + #91: internal/util/msgerr.go:150:18: util.ErrText calls http.http2StreamError.Error + #92: internal/util/msgerr.go:150:18: util.ErrText calls http.http2StreamError.Error + #93: internal/web/logbuffer.go:199:19: web.LogBuffer.SpillTo calls bufio.Writer.Flush, which calls http.http2bufferedWriterTimeoutWriter.Write + #94: internal/web/logbuffer.go:199:19: web.LogBuffer.SpillTo calls bufio.Writer.Flush, which calls http.http2bufferedWriterTimeoutWriter.Write + #95: internal/web/logbuffer.go:199:19: web.LogBuffer.SpillTo calls bufio.Writer.Flush, which calls http.http2chunkWriter.Write + #96: internal/web/logbuffer.go:199:19: web.LogBuffer.SpillTo calls bufio.Writer.Flush, which calls http.http2chunkWriter.Write + #97: internal/util/msgerr.go:150:18: util.ErrText calls http.http2connError.Error + #98: internal/util/msgerr.go:150:18: util.ErrText calls http.http2connError.Error + #99: internal/util/msgerr.go:150:18: util.ErrText calls http.http2duplicatePseudoHeaderError.Error + #100: internal/util/msgerr.go:150:18: util.ErrText calls http.http2duplicatePseudoHeaderError.Error + #101: internal/notify/notifier.go:1165:17: notify.Notifier.PushTestEventSync calls http.http2gzipReader.Close + #102: internal/notify/notifier.go:1165:17: notify.Notifier.PushTestEventSync calls http.http2gzipReader.Close + #103: internal/notify/notifier.go:1078:24: notify.Notifier.SyncPreferences calls io.ReadAll, which calls http.http2gzipReader.Read + #104: internal/notify/notifier.go:1078:24: notify.Notifier.SyncPreferences calls io.ReadAll, which calls http.http2gzipReader.Read + #105: internal/util/msgerr.go:150:18: util.ErrText calls http.http2headerFieldNameError.Error + #106: internal/util/msgerr.go:150:18: util.ErrText calls http.http2headerFieldNameError.Error + #107: internal/util/msgerr.go:150:18: util.ErrText calls http.http2headerFieldValueError.Error + #108: internal/util/msgerr.go:150:18: util.ErrText calls http.http2headerFieldValueError.Error + #109: internal/util/msgerr.go:150:18: util.ErrText calls http.http2pseudoHeaderError.Error + #110: internal/util/msgerr.go:150:18: util.ErrText calls http.http2pseudoHeaderError.Error + #111: internal/notify/notifier.go:1078:24: notify.Notifier.SyncPreferences calls io.ReadAll, which calls http.http2requestBody.Read + #112: internal/notify/notifier.go:1078:24: notify.Notifier.SyncPreferences calls io.ReadAll, which calls http.http2requestBody.Read + #113: internal/api/selfrestart.go:39:10: api.flushResponse calls http.http2responseWriter.Flush + #114: internal/api/selfrestart.go:39:10: api.flushResponse calls http.http2responseWriter.Flush + #115: internal/web/setup_gate.go:367:17: web.Server.ServeSignupClosed calls http.http2responseWriter.Write + #116: internal/web/setup_gate.go:367:17: web.Server.ServeSignupClosed calls http.http2responseWriter.Write + #117: internal/web/setup_gate.go:366:16: web.Server.ServeSignupClosed calls http.http2responseWriter.WriteHeader + #118: internal/web/setup_gate.go:366:16: web.Server.ServeSignupClosed calls http.http2responseWriter.WriteHeader + #119: internal/sockheal/sockheal.go:78:29: sockheal.PingSocket calls io.WriteString, which calls http.http2responseWriter.WriteString + #120: internal/sockheal/sockheal.go:78:29: sockheal.PingSocket calls io.WriteString, which calls http.http2responseWriter.WriteString + #121: internal/web/logbuffer.go:199:19: web.LogBuffer.SpillTo calls bufio.Writer.Flush, which calls http.http2stickyErrWriter.Write + #122: internal/web/logbuffer.go:199:19: web.LogBuffer.SpillTo calls bufio.Writer.Flush, which calls http.http2stickyErrWriter.Write + #123: internal/notify/notifier.go:1165:17: notify.Notifier.PushTestEventSync calls http.http2transportResponseBody.Close + #124: internal/notify/notifier.go:1165:17: notify.Notifier.PushTestEventSync calls http.http2transportResponseBody.Close + #125: internal/notify/notifier.go:1078:24: notify.Notifier.SyncPreferences calls io.ReadAll, which calls http.http2transportResponseBody.Read + #126: internal/notify/notifier.go:1078:24: notify.Notifier.SyncPreferences calls io.ReadAll, which calls http.http2transportResponseBody.Read + #127: internal/backup/offbox_recovery_cli.go:235:15: backup.RecoverAndInstall calls fmt.Fprintln, which eventually calls http.http2writeData.String + #128: internal/backup/offbox_recovery_cli.go:235:15: backup.RecoverAndInstall calls fmt.Fprintln, which eventually calls http.http2writeData.String + #129: internal/notify/notifier.go:1164:9: notify.Notifier.PushTestEventSync calls io.Copy, which eventually calls http.loggingConn.Read + #130: internal/notify/notifier.go:1164:9: notify.Notifier.PushTestEventSync calls io.Copy, which eventually calls http.loggingConn.Read + #131: internal/web/claim.go:486:14: web.PrintLocalResetCode calls fmt.Fprintf, which calls http.loggingConn.Write + #132: internal/web/claim.go:486:14: web.PrintLocalResetCode calls fmt.Fprintf, which calls http.loggingConn.Write + #133: internal/notify/notifier.go:1078:24: notify.Notifier.SyncPreferences calls io.ReadAll, which calls http.maxBytesReader.Read + #134: internal/notify/notifier.go:1078:24: notify.Notifier.SyncPreferences calls io.ReadAll, which calls http.maxBytesReader.Read + #135: internal/web/auth.go:341:16: web.Server.Close calls sync.Once.Do, which eventually calls http.onceCloseListener.Close + #136: internal/web/auth.go:341:16: web.Server.Close calls sync.Once.Do, which eventually calls http.onceCloseListener.Close + #137: internal/notify/notifier.go:1164:9: notify.Notifier.PushTestEventSync calls io.Copy, which eventually calls http.persistConn.Read + #138: internal/notify/notifier.go:1164:9: notify.Notifier.PushTestEventSync calls io.Copy, which eventually calls http.persistConn.Read + #139: internal/notify/notifier.go:1164:9: notify.Notifier.PushTestEventSync calls io.Copy, which eventually calls http.persistConnWriter.ReadFrom + #140: internal/notify/notifier.go:1164:9: notify.Notifier.PushTestEventSync calls io.Copy, which eventually calls http.persistConnWriter.ReadFrom + #141: internal/web/logbuffer.go:199:19: web.LogBuffer.SpillTo calls bufio.Writer.Flush, which calls http.persistConnWriter.Write + #142: internal/web/logbuffer.go:199:19: web.LogBuffer.SpillTo calls bufio.Writer.Flush, which calls http.persistConnWriter.Write + #143: internal/notify/notifier.go:1078:24: notify.Notifier.SyncPreferences calls io.ReadAll, which calls http.readTrackingBody.Read + #144: internal/notify/notifier.go:1078:24: notify.Notifier.SyncPreferences calls io.ReadAll, which calls http.readTrackingBody.Read + #145: internal/notify/notifier.go:1078:24: notify.Notifier.SyncPreferences calls io.ReadAll, which calls http.readWriteCloserBody.Read + #146: internal/notify/notifier.go:1078:24: notify.Notifier.SyncPreferences calls io.ReadAll, which calls http.readWriteCloserBody.Read + #147: internal/api/selfrestart.go:39:10: api.flushResponse calls http.response.Flush + #148: internal/api/selfrestart.go:39:10: api.flushResponse calls http.response.Flush + #149: internal/notify/notifier.go:1164:9: notify.Notifier.PushTestEventSync calls io.Copy, which eventually calls http.response.ReadFrom + #150: internal/notify/notifier.go:1164:9: notify.Notifier.PushTestEventSync calls io.Copy, which eventually calls http.response.ReadFrom + #151: internal/web/setup_gate.go:367:17: web.Server.ServeSignupClosed calls http.response.Write + #152: internal/web/setup_gate.go:367:17: web.Server.ServeSignupClosed calls http.response.Write + #153: internal/web/setup_gate.go:366:16: web.Server.ServeSignupClosed calls http.response.WriteHeader + #154: internal/web/setup_gate.go:366:16: web.Server.ServeSignupClosed calls http.response.WriteHeader + #155: internal/sockheal/sockheal.go:78:29: sockheal.PingSocket calls io.WriteString, which calls http.response.WriteString + #156: internal/sockheal/sockheal.go:78:29: sockheal.PingSocket calls io.WriteString, which calls http.response.WriteString + #157: internal/util/msgerr.go:150:18: util.ErrText calls http.transportReadFromServerError.Error + #158: internal/util/msgerr.go:150:18: util.ErrText calls http.transportReadFromServerError.Error + +Vulnerability #4: GO-2026-6611 + Excessive CPU consumption from repeated initial window changes in net/http + More info: https://pkg.go.dev/vuln/GO-2026-6611 + Standard library + Found in: net/http@go1.26 + Fixed in: net/http@go1.26.9 + Example traces found: + #1: internal/agentapi/client.go:153:53: agentapi.Client.Close calls http.Client.CloseIdleConnections + #2: internal/agentapi/client.go:153:53: agentapi.Client.Close calls http.Client.CloseIdleConnections + #3: internal/notify/notifier.go:1159:30: notify.Notifier.PushTestEventSync calls http.Client.Do + #4: internal/notify/notifier.go:1159:30: notify.Notifier.PushTestEventSync calls http.Client.Do + #5: internal/stacks/setup_gate.go:374:20: stacks.init calls http.Client.Get + #6: internal/stacks/setup_gate.go:374:20: stacks.init calls http.Client.Get + #7: cmd/controller/main.go:2113:29: controller.main calls http.Client.Head + #8: cmd/controller/main.go:2113:29: controller.main calls http.Client.Head + #9: internal/web/setup_gate.go:279:13: web.Server.ServeGateStart calls http.Error + #10: internal/web/setup_gate.go:279:13: web.Server.ServeGateStart calls http.Error + #11: internal/web/setup_gate.go:364:35: web.Server.ServeSignupClosed calls http.Header.Get + #12: internal/web/setup_gate.go:364:35: web.Server.ServeSignupClosed calls http.Header.Get + #13: internal/notify/notifier.go:1156:16: notify.Notifier.PushTestEventSync calls http.Header.Set + #14: internal/notify/notifier.go:1156:16: notify.Notifier.PushTestEventSync calls http.Header.Set + #15: internal/web/clientaddr.go:99:35: web.clientIP calls http.Header.Values + #16: internal/web/clientaddr.go:99:35: web.clientIP calls http.Header.Values + #17: internal/notify/notifier.go:1152:29: notify.Notifier.PushTestEventSync calls http.NewRequest + #18: internal/notify/notifier.go:1152:29: notify.Notifier.PushTestEventSync calls http.NewRequest + #19: internal/agentapi/client.go:667:40: agentapi.Client.WipeStagedEscrowSecret calls http.NewRequestWithContext + #20: internal/agentapi/client.go:667:40: agentapi.Client.WipeStagedEscrowSecret calls http.NewRequestWithContext + #21: internal/web/server.go:865:16: web.Server.ServeHTTP calls http.NotFound + #22: internal/web/server.go:865:16: web.Server.ServeHTTP calls http.NotFound + #23: internal/web/server.go:583:16: web.Server.ServeHTTP calls http.Redirect + #24: internal/web/server.go:583:16: web.Server.ServeHTTP calls http.Redirect + #25: internal/web/family_gate.go:390:23: web.Server.ServeFamilyLogout calls http.Request.Cookie + #26: internal/web/family_gate.go:390:23: web.Server.ServeFamilyLogout calls http.Request.Cookie + #27: internal/web/family_gate.go:352:19: web.Server.ServeFamilyLogin calls http.Request.FormValue + #28: internal/web/family_gate.go:352:19: web.Server.ServeFamilyLogin calls http.Request.FormValue + #29: internal/web/family_gate.go:351:17: web.Server.ServeFamilyLogin calls http.Request.ParseForm + #30: internal/web/family_gate.go:351:17: web.Server.ServeFamilyLogin calls http.Request.ParseForm + #31: internal/web/recovery_handlers.go:347:25: web.Server.recoveryUnlockHandler calls http.Request.PostFormValue + #32: internal/web/recovery_handlers.go:347:25: web.Server.recoveryUnlockHandler calls http.Request.PostFormValue + #33: internal/selfupdate/updater.go:255:18: selfupdate.Updater.queryRegistry calls http.Request.SetBasicAuth + #34: internal/selfupdate/updater.go:255:18: selfupdate.Updater.queryRegistry calls http.Request.SetBasicAuth + #35: internal/web/server.go:1163:16: web.Server.serveAsset calls http.ServeFile + #36: internal/web/server.go:1163:16: web.Server.serveAsset calls http.ServeFile + #37: cmd/controller/main.go:2138:12: controller.main calls http.ServeMux.Handle + #38: cmd/controller/main.go:2138:12: controller.main calls http.ServeMux.Handle + #39: internal/setup/handlers.go:90:16: setup.Server.Handler calls http.ServeMux.HandleFunc + #40: internal/setup/handlers.go:90:16: setup.Server.Handler calls http.ServeMux.HandleFunc + #41: cmd/controller/main.go:2214:33: controller.main calls http.Server.ListenAndServe + #42: cmd/controller/main.go:2214:33: controller.main calls http.Server.ListenAndServe + #43: cmd/controller/main.go:3759:21: controller.runSetupMode calls http.Server.Shutdown + #44: cmd/controller/main.go:3759:21: controller.runSetupMode calls http.Server.Shutdown + #45: internal/web/family_gate.go:395:16: web.Server.ServeFamilyLogout calls http.SetCookie + #46: internal/web/family_gate.go:395:16: web.Server.ServeFamilyLogout calls http.SetCookie + #47: internal/notify/notifier.go:1165:17: notify.Notifier.PushTestEventSync calls http.body.Close + #48: internal/notify/notifier.go:1165:17: notify.Notifier.PushTestEventSync calls http.body.Close + #49: internal/notify/notifier.go:1078:24: notify.Notifier.SyncPreferences calls io.ReadAll, which calls http.body.Read + #50: internal/notify/notifier.go:1078:24: notify.Notifier.SyncPreferences calls io.ReadAll, which calls http.body.Read + #51: internal/notify/notifier.go:1165:17: notify.Notifier.PushTestEventSync calls http.bodyEOFSignal.Close + #52: internal/notify/notifier.go:1165:17: notify.Notifier.PushTestEventSync calls http.bodyEOFSignal.Close + #53: internal/notify/notifier.go:1078:24: notify.Notifier.SyncPreferences calls io.ReadAll, which calls http.bodyEOFSignal.Read + #54: internal/notify/notifier.go:1078:24: notify.Notifier.SyncPreferences calls io.ReadAll, which calls http.bodyEOFSignal.Read + #55: internal/notify/notifier.go:1164:9: notify.Notifier.PushTestEventSync calls io.Copy, which eventually calls http.bodyLocked.Read + #56: internal/notify/notifier.go:1164:9: notify.Notifier.PushTestEventSync calls io.Copy, which eventually calls http.bodyLocked.Read + #57: internal/sockheal/sockheal.go:78:29: sockheal.PingSocket calls io.WriteString, which calls http.bufioFlushWriter.Write + #58: internal/sockheal/sockheal.go:78:29: sockheal.PingSocket calls io.WriteString, which calls http.bufioFlushWriter.Write + #59: internal/notify/notifier.go:1165:17: notify.Notifier.PushTestEventSync calls http.cancelTimerBody.Close + #60: internal/notify/notifier.go:1165:17: notify.Notifier.PushTestEventSync calls http.cancelTimerBody.Close + #61: internal/notify/notifier.go:1078:24: notify.Notifier.SyncPreferences calls io.ReadAll, which calls http.cancelTimerBody.Read + #62: internal/notify/notifier.go:1078:24: notify.Notifier.SyncPreferences calls io.ReadAll, which calls http.cancelTimerBody.Read + #63: internal/web/logbuffer.go:199:19: web.LogBuffer.SpillTo calls bufio.Writer.Flush, which calls http.checkConnErrorWriter.Write + #64: internal/web/logbuffer.go:199:19: web.LogBuffer.SpillTo calls bufio.Writer.Flush, which calls http.checkConnErrorWriter.Write + #65: internal/web/logbuffer.go:199:19: web.LogBuffer.SpillTo calls bufio.Writer.Flush, which calls http.chunkWriter.Write + #66: internal/web/logbuffer.go:199:19: web.LogBuffer.SpillTo calls bufio.Writer.Flush, which calls http.chunkWriter.Write + #67: internal/notify/notifier.go:1164:9: notify.Notifier.PushTestEventSync calls io.Copy, which eventually calls http.connReader.Read + #68: internal/notify/notifier.go:1164:9: notify.Notifier.PushTestEventSync calls io.Copy, which eventually calls http.connReader.Read + #69: internal/notify/notifier.go:1078:24: notify.Notifier.SyncPreferences calls io.ReadAll, which calls http.expectContinueReader.Read + #70: internal/notify/notifier.go:1078:24: notify.Notifier.SyncPreferences calls io.ReadAll, which calls http.expectContinueReader.Read + #71: internal/notify/notifier.go:1165:17: notify.Notifier.PushTestEventSync calls http.gzipReader.Close + #72: internal/notify/notifier.go:1165:17: notify.Notifier.PushTestEventSync calls http.gzipReader.Close + #73: internal/notify/notifier.go:1078:24: notify.Notifier.SyncPreferences calls io.ReadAll, which calls http.gzipReader.Read + #74: internal/notify/notifier.go:1078:24: notify.Notifier.SyncPreferences calls io.ReadAll, which calls http.gzipReader.Read + #75: internal/util/msgerr.go:150:18: util.ErrText calls http.http2ConnectionError.Error + #76: internal/util/msgerr.go:150:18: util.ErrText calls http.http2ConnectionError.Error + #77: internal/backup/offbox_recovery_cli.go:235:15: backup.RecoverAndInstall calls fmt.Fprintln, which eventually calls http.http2ErrCode.String + #78: internal/backup/offbox_recovery_cli.go:235:15: backup.RecoverAndInstall calls fmt.Fprintln, which eventually calls http.http2ErrCode.String + #79: internal/backup/offbox_recovery_cli.go:235:15: backup.RecoverAndInstall calls fmt.Fprintln, which eventually calls http.http2FrameHeader.String + #80: internal/backup/offbox_recovery_cli.go:235:15: backup.RecoverAndInstall calls fmt.Fprintln, which eventually calls http.http2FrameHeader.String + #81: internal/backup/offbox_recovery_cli.go:235:15: backup.RecoverAndInstall calls fmt.Fprintln, which eventually calls http.http2FrameType.String + #82: internal/backup/offbox_recovery_cli.go:235:15: backup.RecoverAndInstall calls fmt.Fprintln, which eventually calls http.http2FrameType.String + #83: internal/backup/offbox_recovery_cli.go:235:15: backup.RecoverAndInstall calls fmt.Fprintln, which eventually calls http.http2FrameWriteRequest.String + #84: internal/backup/offbox_recovery_cli.go:235:15: backup.RecoverAndInstall calls fmt.Fprintln, which eventually calls http.http2FrameWriteRequest.String + #85: internal/util/msgerr.go:150:18: util.ErrText calls http.http2GoAwayError.Error + #86: internal/util/msgerr.go:150:18: util.ErrText calls http.http2GoAwayError.Error + #87: internal/backup/offbox_recovery_cli.go:235:15: backup.RecoverAndInstall calls fmt.Fprintln, which eventually calls http.http2Setting.String + #88: internal/backup/offbox_recovery_cli.go:235:15: backup.RecoverAndInstall calls fmt.Fprintln, which eventually calls http.http2Setting.String + #89: internal/backup/offbox_recovery_cli.go:235:15: backup.RecoverAndInstall calls fmt.Fprintln, which eventually calls http.http2SettingID.String + #90: internal/backup/offbox_recovery_cli.go:235:15: backup.RecoverAndInstall calls fmt.Fprintln, which eventually calls http.http2SettingID.String + #91: internal/util/msgerr.go:150:18: util.ErrText calls http.http2StreamError.Error + #92: internal/util/msgerr.go:150:18: util.ErrText calls http.http2StreamError.Error + #93: internal/web/logbuffer.go:199:19: web.LogBuffer.SpillTo calls bufio.Writer.Flush, which calls http.http2bufferedWriterTimeoutWriter.Write + #94: internal/web/logbuffer.go:199:19: web.LogBuffer.SpillTo calls bufio.Writer.Flush, which calls http.http2bufferedWriterTimeoutWriter.Write + #95: internal/web/logbuffer.go:199:19: web.LogBuffer.SpillTo calls bufio.Writer.Flush, which calls http.http2chunkWriter.Write + #96: internal/web/logbuffer.go:199:19: web.LogBuffer.SpillTo calls bufio.Writer.Flush, which calls http.http2chunkWriter.Write + #97: internal/util/msgerr.go:150:18: util.ErrText calls http.http2connError.Error + #98: internal/util/msgerr.go:150:18: util.ErrText calls http.http2connError.Error + #99: internal/util/msgerr.go:150:18: util.ErrText calls http.http2duplicatePseudoHeaderError.Error + #100: internal/util/msgerr.go:150:18: util.ErrText calls http.http2duplicatePseudoHeaderError.Error + #101: internal/notify/notifier.go:1165:17: notify.Notifier.PushTestEventSync calls http.http2gzipReader.Close + #102: internal/notify/notifier.go:1165:17: notify.Notifier.PushTestEventSync calls http.http2gzipReader.Close + #103: internal/notify/notifier.go:1078:24: notify.Notifier.SyncPreferences calls io.ReadAll, which calls http.http2gzipReader.Read + #104: internal/notify/notifier.go:1078:24: notify.Notifier.SyncPreferences calls io.ReadAll, which calls http.http2gzipReader.Read + #105: internal/util/msgerr.go:150:18: util.ErrText calls http.http2headerFieldNameError.Error + #106: internal/util/msgerr.go:150:18: util.ErrText calls http.http2headerFieldNameError.Error + #107: internal/util/msgerr.go:150:18: util.ErrText calls http.http2headerFieldValueError.Error + #108: internal/util/msgerr.go:150:18: util.ErrText calls http.http2headerFieldValueError.Error + #109: internal/util/msgerr.go:150:18: util.ErrText calls http.http2pseudoHeaderError.Error + #110: internal/util/msgerr.go:150:18: util.ErrText calls http.http2pseudoHeaderError.Error + #111: internal/notify/notifier.go:1078:24: notify.Notifier.SyncPreferences calls io.ReadAll, which calls http.http2requestBody.Read + #112: internal/notify/notifier.go:1078:24: notify.Notifier.SyncPreferences calls io.ReadAll, which calls http.http2requestBody.Read + #113: internal/api/selfrestart.go:39:10: api.flushResponse calls http.http2responseWriter.Flush + #114: internal/api/selfrestart.go:39:10: api.flushResponse calls http.http2responseWriter.Flush + #115: internal/web/setup_gate.go:367:17: web.Server.ServeSignupClosed calls http.http2responseWriter.Write + #116: internal/web/setup_gate.go:367:17: web.Server.ServeSignupClosed calls http.http2responseWriter.Write + #117: internal/web/setup_gate.go:366:16: web.Server.ServeSignupClosed calls http.http2responseWriter.WriteHeader + #118: internal/web/setup_gate.go:366:16: web.Server.ServeSignupClosed calls http.http2responseWriter.WriteHeader + #119: internal/sockheal/sockheal.go:78:29: sockheal.PingSocket calls io.WriteString, which calls http.http2responseWriter.WriteString + #120: internal/sockheal/sockheal.go:78:29: sockheal.PingSocket calls io.WriteString, which calls http.http2responseWriter.WriteString + #121: internal/web/logbuffer.go:199:19: web.LogBuffer.SpillTo calls bufio.Writer.Flush, which calls http.http2stickyErrWriter.Write + #122: internal/web/logbuffer.go:199:19: web.LogBuffer.SpillTo calls bufio.Writer.Flush, which calls http.http2stickyErrWriter.Write + #123: internal/notify/notifier.go:1165:17: notify.Notifier.PushTestEventSync calls http.http2transportResponseBody.Close + #124: internal/notify/notifier.go:1165:17: notify.Notifier.PushTestEventSync calls http.http2transportResponseBody.Close + #125: internal/notify/notifier.go:1078:24: notify.Notifier.SyncPreferences calls io.ReadAll, which calls http.http2transportResponseBody.Read + #126: internal/notify/notifier.go:1078:24: notify.Notifier.SyncPreferences calls io.ReadAll, which calls http.http2transportResponseBody.Read + #127: internal/backup/offbox_recovery_cli.go:235:15: backup.RecoverAndInstall calls fmt.Fprintln, which eventually calls http.http2writeData.String + #128: internal/backup/offbox_recovery_cli.go:235:15: backup.RecoverAndInstall calls fmt.Fprintln, which eventually calls http.http2writeData.String + #129: internal/notify/notifier.go:1164:9: notify.Notifier.PushTestEventSync calls io.Copy, which eventually calls http.loggingConn.Read + #130: internal/notify/notifier.go:1164:9: notify.Notifier.PushTestEventSync calls io.Copy, which eventually calls http.loggingConn.Read + #131: internal/web/claim.go:486:14: web.PrintLocalResetCode calls fmt.Fprintf, which calls http.loggingConn.Write + #132: internal/web/claim.go:486:14: web.PrintLocalResetCode calls fmt.Fprintf, which calls http.loggingConn.Write + #133: internal/notify/notifier.go:1078:24: notify.Notifier.SyncPreferences calls io.ReadAll, which calls http.maxBytesReader.Read + #134: internal/notify/notifier.go:1078:24: notify.Notifier.SyncPreferences calls io.ReadAll, which calls http.maxBytesReader.Read + #135: internal/web/auth.go:341:16: web.Server.Close calls sync.Once.Do, which eventually calls http.onceCloseListener.Close + #136: internal/web/auth.go:341:16: web.Server.Close calls sync.Once.Do, which eventually calls http.onceCloseListener.Close + #137: internal/notify/notifier.go:1164:9: notify.Notifier.PushTestEventSync calls io.Copy, which eventually calls http.persistConn.Read + #138: internal/notify/notifier.go:1164:9: notify.Notifier.PushTestEventSync calls io.Copy, which eventually calls http.persistConn.Read + #139: internal/notify/notifier.go:1164:9: notify.Notifier.PushTestEventSync calls io.Copy, which eventually calls http.persistConnWriter.ReadFrom + #140: internal/notify/notifier.go:1164:9: notify.Notifier.PushTestEventSync calls io.Copy, which eventually calls http.persistConnWriter.ReadFrom + #141: internal/web/logbuffer.go:199:19: web.LogBuffer.SpillTo calls bufio.Writer.Flush, which calls http.persistConnWriter.Write + #142: internal/web/logbuffer.go:199:19: web.LogBuffer.SpillTo calls bufio.Writer.Flush, which calls http.persistConnWriter.Write + #143: internal/notify/notifier.go:1078:24: notify.Notifier.SyncPreferences calls io.ReadAll, which calls http.readTrackingBody.Read + #144: internal/notify/notifier.go:1078:24: notify.Notifier.SyncPreferences calls io.ReadAll, which calls http.readTrackingBody.Read + #145: internal/notify/notifier.go:1078:24: notify.Notifier.SyncPreferences calls io.ReadAll, which calls http.readWriteCloserBody.Read + #146: internal/notify/notifier.go:1078:24: notify.Notifier.SyncPreferences calls io.ReadAll, which calls http.readWriteCloserBody.Read + #147: internal/api/selfrestart.go:39:10: api.flushResponse calls http.response.Flush + #148: internal/api/selfrestart.go:39:10: api.flushResponse calls http.response.Flush + #149: internal/notify/notifier.go:1164:9: notify.Notifier.PushTestEventSync calls io.Copy, which eventually calls http.response.ReadFrom + #150: internal/notify/notifier.go:1164:9: notify.Notifier.PushTestEventSync calls io.Copy, which eventually calls http.response.ReadFrom + #151: internal/web/setup_gate.go:367:17: web.Server.ServeSignupClosed calls http.response.Write + #152: internal/web/setup_gate.go:367:17: web.Server.ServeSignupClosed calls http.response.Write + #153: internal/web/setup_gate.go:366:16: web.Server.ServeSignupClosed calls http.response.WriteHeader + #154: internal/web/setup_gate.go:366:16: web.Server.ServeSignupClosed calls http.response.WriteHeader + #155: internal/sockheal/sockheal.go:78:29: sockheal.PingSocket calls io.WriteString, which calls http.response.WriteString + #156: internal/sockheal/sockheal.go:78:29: sockheal.PingSocket calls io.WriteString, which calls http.response.WriteString + #157: internal/util/msgerr.go:150:18: util.ErrText calls http.transportReadFromServerError.Error + #158: internal/util/msgerr.go:150:18: util.ErrText calls http.transportReadFromServerError.Error + +Vulnerability #5: GO-2026-6610 + HTTP/2 transport accepts malformed framing-related headers in net/http + More info: https://pkg.go.dev/vuln/GO-2026-6610 + Standard library + Found in: net/http@go1.26 + Fixed in: net/http@go1.26.9 + Example traces found: + #1: internal/agentapi/client.go:153:53: agentapi.Client.Close calls http.Client.CloseIdleConnections + #2: internal/agentapi/client.go:153:53: agentapi.Client.Close calls http.Client.CloseIdleConnections + #3: internal/notify/notifier.go:1159:30: notify.Notifier.PushTestEventSync calls http.Client.Do + #4: internal/notify/notifier.go:1159:30: notify.Notifier.PushTestEventSync calls http.Client.Do + #5: internal/stacks/setup_gate.go:374:20: stacks.init calls http.Client.Get + #6: internal/stacks/setup_gate.go:374:20: stacks.init calls http.Client.Get + #7: cmd/controller/main.go:2113:29: controller.main calls http.Client.Head + #8: cmd/controller/main.go:2113:29: controller.main calls http.Client.Head + +Vulnerability #6: GO-2026-6609 + Lack of limit on size of parsed Range headers in net/http + More info: https://pkg.go.dev/vuln/GO-2026-6609 + Standard library + Found in: net/http@go1.26 + Fixed in: net/http@go1.26.9 + Example traces found: + #1: internal/web/server.go:1163:16: web.Server.serveAsset calls http.ServeFile + +Vulnerability #7: GO-2026-6608 + Memory limit bypass when parsing MIME headers in net/textproto, + mime/multipart + More info: https://pkg.go.dev/vuln/GO-2026-6608 + Standard library + Found in: net/textproto@go1.26 + Fixed in: net/textproto@go1.26.9 + Example traces found: + #1: internal/web/family_gate.go:352:19: web.Server.ServeFamilyLogin calls http.Request.FormValue, which eventually calls multipart.Reader.ReadForm + #2: internal/mailrelay/policy.go:41:30: mailrelay.FromDomain calls mail.ReadMessage, which eventually calls textproto.Reader.ReadContinuedLine + #3: internal/notify/notifier.go:1078:24: notify.Notifier.SyncPreferences calls io.ReadAll, which eventually calls textproto.Reader.ReadMIMEHeader + +Vulnerability #8: GO-2026-6607 + Reject malformed ECH outer extension references in crypto/tls + More info: https://pkg.go.dev/vuln/GO-2026-6607 + Standard library + Found in: crypto/tls@go1.26 + Fixed in: crypto/tls@go1.26.9 + Example traces found: + #1: internal/mailrelay/server.go:168:34: mailrelay.Start calls smtp.Server.Serve, which eventually calls tls.Conn.Handshake + #2: cmd/controller/main.go:2214:33: controller.main calls http.Server.ListenAndServe, which eventually calls tls.Conn.HandshakeContext + #3: internal/notify/notifier.go:1164:9: notify.Notifier.PushTestEventSync calls io.Copy, which eventually calls tls.Conn.Read + #4: internal/web/logbuffer.go:199:19: web.LogBuffer.SpillTo calls bufio.Writer.Flush, which calls tls.Conn.Write + #5: internal/notify/notifier.go:1159:30: notify.Notifier.PushTestEventSync calls http.Client.Do, which eventually calls tls.Dialer.DialContext + +Vulnerability #9: GO-2026-6605 + HTTP/1 client connection desynchronization after CONNECT rejection in + net/http + More info: https://pkg.go.dev/vuln/GO-2026-6605 + Standard library + Found in: net/http@go1.26 + Fixed in: net/http@go1.26.9 + Example traces found: + #1: internal/agentapi/client.go:153:53: agentapi.Client.Close calls http.Client.CloseIdleConnections + #2: internal/notify/notifier.go:1159:30: notify.Notifier.PushTestEventSync calls http.Client.Do + #3: internal/stacks/setup_gate.go:374:20: stacks.init calls http.Client.Get + #4: cmd/controller/main.go:2113:29: controller.main calls http.Client.Head + +Vulnerability #10: GO-2026-6603 + HTTP/2 server memory exhaustion due to Trailer headers in net/http + More info: https://pkg.go.dev/vuln/GO-2026-6603 + Standard library + Found in: net/http@go1.26 + Fixed in: net/http@go1.26.9 + Example traces found: + #1: internal/agentapi/client.go:153:53: agentapi.Client.Close calls http.Client.CloseIdleConnections + #2: internal/agentapi/client.go:153:53: agentapi.Client.Close calls http.Client.CloseIdleConnections + #3: internal/notify/notifier.go:1159:30: notify.Notifier.PushTestEventSync calls http.Client.Do + #4: internal/notify/notifier.go:1159:30: notify.Notifier.PushTestEventSync calls http.Client.Do + #5: internal/stacks/setup_gate.go:374:20: stacks.init calls http.Client.Get + #6: internal/stacks/setup_gate.go:374:20: stacks.init calls http.Client.Get + #7: cmd/controller/main.go:2113:29: controller.main calls http.Client.Head + #8: cmd/controller/main.go:2113:29: controller.main calls http.Client.Head + #9: internal/web/setup_gate.go:279:13: web.Server.ServeGateStart calls http.Error + #10: internal/web/setup_gate.go:279:13: web.Server.ServeGateStart calls http.Error + #11: internal/web/setup_gate.go:364:35: web.Server.ServeSignupClosed calls http.Header.Get + #12: internal/web/setup_gate.go:364:35: web.Server.ServeSignupClosed calls http.Header.Get + #13: internal/notify/notifier.go:1156:16: notify.Notifier.PushTestEventSync calls http.Header.Set + #14: internal/notify/notifier.go:1156:16: notify.Notifier.PushTestEventSync calls http.Header.Set + #15: internal/web/clientaddr.go:99:35: web.clientIP calls http.Header.Values + #16: internal/web/clientaddr.go:99:35: web.clientIP calls http.Header.Values + #17: internal/notify/notifier.go:1152:29: notify.Notifier.PushTestEventSync calls http.NewRequest + #18: internal/notify/notifier.go:1152:29: notify.Notifier.PushTestEventSync calls http.NewRequest + #19: internal/agentapi/client.go:667:40: agentapi.Client.WipeStagedEscrowSecret calls http.NewRequestWithContext + #20: internal/agentapi/client.go:667:40: agentapi.Client.WipeStagedEscrowSecret calls http.NewRequestWithContext + #21: internal/web/server.go:865:16: web.Server.ServeHTTP calls http.NotFound + #22: internal/web/server.go:865:16: web.Server.ServeHTTP calls http.NotFound + #23: internal/web/server.go:583:16: web.Server.ServeHTTP calls http.Redirect + #24: internal/web/server.go:583:16: web.Server.ServeHTTP calls http.Redirect + #25: internal/web/family_gate.go:390:23: web.Server.ServeFamilyLogout calls http.Request.Cookie + #26: internal/web/family_gate.go:390:23: web.Server.ServeFamilyLogout calls http.Request.Cookie + #27: internal/web/family_gate.go:352:19: web.Server.ServeFamilyLogin calls http.Request.FormValue + #28: internal/web/family_gate.go:352:19: web.Server.ServeFamilyLogin calls http.Request.FormValue + #29: internal/web/family_gate.go:351:17: web.Server.ServeFamilyLogin calls http.Request.ParseForm + #30: internal/web/family_gate.go:351:17: web.Server.ServeFamilyLogin calls http.Request.ParseForm + #31: internal/web/recovery_handlers.go:347:25: web.Server.recoveryUnlockHandler calls http.Request.PostFormValue + #32: internal/web/recovery_handlers.go:347:25: web.Server.recoveryUnlockHandler calls http.Request.PostFormValue + #33: internal/selfupdate/updater.go:255:18: selfupdate.Updater.queryRegistry calls http.Request.SetBasicAuth + #34: internal/selfupdate/updater.go:255:18: selfupdate.Updater.queryRegistry calls http.Request.SetBasicAuth + #35: internal/web/server.go:1163:16: web.Server.serveAsset calls http.ServeFile + #36: internal/web/server.go:1163:16: web.Server.serveAsset calls http.ServeFile + #37: cmd/controller/main.go:2138:12: controller.main calls http.ServeMux.Handle + #38: cmd/controller/main.go:2138:12: controller.main calls http.ServeMux.Handle + #39: internal/setup/handlers.go:90:16: setup.Server.Handler calls http.ServeMux.HandleFunc + #40: internal/setup/handlers.go:90:16: setup.Server.Handler calls http.ServeMux.HandleFunc + #41: cmd/controller/main.go:2214:33: controller.main calls http.Server.ListenAndServe + #42: cmd/controller/main.go:2214:33: controller.main calls http.Server.ListenAndServe + #43: cmd/controller/main.go:3759:21: controller.runSetupMode calls http.Server.Shutdown + #44: cmd/controller/main.go:3759:21: controller.runSetupMode calls http.Server.Shutdown + #45: internal/web/family_gate.go:395:16: web.Server.ServeFamilyLogout calls http.SetCookie + #46: internal/web/family_gate.go:395:16: web.Server.ServeFamilyLogout calls http.SetCookie + #47: internal/notify/notifier.go:1165:17: notify.Notifier.PushTestEventSync calls http.body.Close + #48: internal/notify/notifier.go:1165:17: notify.Notifier.PushTestEventSync calls http.body.Close + #49: internal/notify/notifier.go:1078:24: notify.Notifier.SyncPreferences calls io.ReadAll, which calls http.body.Read + #50: internal/notify/notifier.go:1078:24: notify.Notifier.SyncPreferences calls io.ReadAll, which calls http.body.Read + #51: internal/notify/notifier.go:1165:17: notify.Notifier.PushTestEventSync calls http.bodyEOFSignal.Close + #52: internal/notify/notifier.go:1165:17: notify.Notifier.PushTestEventSync calls http.bodyEOFSignal.Close + #53: internal/notify/notifier.go:1078:24: notify.Notifier.SyncPreferences calls io.ReadAll, which calls http.bodyEOFSignal.Read + #54: internal/notify/notifier.go:1078:24: notify.Notifier.SyncPreferences calls io.ReadAll, which calls http.bodyEOFSignal.Read + #55: internal/notify/notifier.go:1164:9: notify.Notifier.PushTestEventSync calls io.Copy, which eventually calls http.bodyLocked.Read + #56: internal/notify/notifier.go:1164:9: notify.Notifier.PushTestEventSync calls io.Copy, which eventually calls http.bodyLocked.Read + #57: internal/sockheal/sockheal.go:78:29: sockheal.PingSocket calls io.WriteString, which calls http.bufioFlushWriter.Write + #58: internal/sockheal/sockheal.go:78:29: sockheal.PingSocket calls io.WriteString, which calls http.bufioFlushWriter.Write + #59: internal/notify/notifier.go:1165:17: notify.Notifier.PushTestEventSync calls http.cancelTimerBody.Close + #60: internal/notify/notifier.go:1165:17: notify.Notifier.PushTestEventSync calls http.cancelTimerBody.Close + #61: internal/notify/notifier.go:1078:24: notify.Notifier.SyncPreferences calls io.ReadAll, which calls http.cancelTimerBody.Read + #62: internal/notify/notifier.go:1078:24: notify.Notifier.SyncPreferences calls io.ReadAll, which calls http.cancelTimerBody.Read + #63: internal/web/logbuffer.go:199:19: web.LogBuffer.SpillTo calls bufio.Writer.Flush, which calls http.checkConnErrorWriter.Write + #64: internal/web/logbuffer.go:199:19: web.LogBuffer.SpillTo calls bufio.Writer.Flush, which calls http.checkConnErrorWriter.Write + #65: internal/web/logbuffer.go:199:19: web.LogBuffer.SpillTo calls bufio.Writer.Flush, which calls http.chunkWriter.Write + #66: internal/web/logbuffer.go:199:19: web.LogBuffer.SpillTo calls bufio.Writer.Flush, which calls http.chunkWriter.Write + #67: internal/notify/notifier.go:1164:9: notify.Notifier.PushTestEventSync calls io.Copy, which eventually calls http.connReader.Read + #68: internal/notify/notifier.go:1164:9: notify.Notifier.PushTestEventSync calls io.Copy, which eventually calls http.connReader.Read + #69: internal/notify/notifier.go:1078:24: notify.Notifier.SyncPreferences calls io.ReadAll, which calls http.expectContinueReader.Read + #70: internal/notify/notifier.go:1078:24: notify.Notifier.SyncPreferences calls io.ReadAll, which calls http.expectContinueReader.Read + #71: internal/notify/notifier.go:1165:17: notify.Notifier.PushTestEventSync calls http.gzipReader.Close + #72: internal/notify/notifier.go:1165:17: notify.Notifier.PushTestEventSync calls http.gzipReader.Close + #73: internal/notify/notifier.go:1078:24: notify.Notifier.SyncPreferences calls io.ReadAll, which calls http.gzipReader.Read + #74: internal/notify/notifier.go:1078:24: notify.Notifier.SyncPreferences calls io.ReadAll, which calls http.gzipReader.Read + #75: internal/util/msgerr.go:150:18: util.ErrText calls http.http2ConnectionError.Error + #76: internal/util/msgerr.go:150:18: util.ErrText calls http.http2ConnectionError.Error + #77: internal/backup/offbox_recovery_cli.go:235:15: backup.RecoverAndInstall calls fmt.Fprintln, which eventually calls http.http2ErrCode.String + #78: internal/backup/offbox_recovery_cli.go:235:15: backup.RecoverAndInstall calls fmt.Fprintln, which eventually calls http.http2ErrCode.String + #79: internal/backup/offbox_recovery_cli.go:235:15: backup.RecoverAndInstall calls fmt.Fprintln, which eventually calls http.http2FrameHeader.String + #80: internal/backup/offbox_recovery_cli.go:235:15: backup.RecoverAndInstall calls fmt.Fprintln, which eventually calls http.http2FrameHeader.String + #81: internal/backup/offbox_recovery_cli.go:235:15: backup.RecoverAndInstall calls fmt.Fprintln, which eventually calls http.http2FrameType.String + #82: internal/backup/offbox_recovery_cli.go:235:15: backup.RecoverAndInstall calls fmt.Fprintln, which eventually calls http.http2FrameType.String + #83: internal/backup/offbox_recovery_cli.go:235:15: backup.RecoverAndInstall calls fmt.Fprintln, which eventually calls http.http2FrameWriteRequest.String + #84: internal/backup/offbox_recovery_cli.go:235:15: backup.RecoverAndInstall calls fmt.Fprintln, which eventually calls http.http2FrameWriteRequest.String + #85: internal/util/msgerr.go:150:18: util.ErrText calls http.http2GoAwayError.Error + #86: internal/util/msgerr.go:150:18: util.ErrText calls http.http2GoAwayError.Error + #87: internal/backup/offbox_recovery_cli.go:235:15: backup.RecoverAndInstall calls fmt.Fprintln, which eventually calls http.http2Setting.String + #88: internal/backup/offbox_recovery_cli.go:235:15: backup.RecoverAndInstall calls fmt.Fprintln, which eventually calls http.http2Setting.String + #89: internal/backup/offbox_recovery_cli.go:235:15: backup.RecoverAndInstall calls fmt.Fprintln, which eventually calls http.http2SettingID.String + #90: internal/backup/offbox_recovery_cli.go:235:15: backup.RecoverAndInstall calls fmt.Fprintln, which eventually calls http.http2SettingID.String + #91: internal/util/msgerr.go:150:18: util.ErrText calls http.http2StreamError.Error + #92: internal/util/msgerr.go:150:18: util.ErrText calls http.http2StreamError.Error + #93: internal/web/logbuffer.go:199:19: web.LogBuffer.SpillTo calls bufio.Writer.Flush, which calls http.http2bufferedWriterTimeoutWriter.Write + #94: internal/web/logbuffer.go:199:19: web.LogBuffer.SpillTo calls bufio.Writer.Flush, which calls http.http2bufferedWriterTimeoutWriter.Write + #95: internal/web/logbuffer.go:199:19: web.LogBuffer.SpillTo calls bufio.Writer.Flush, which calls http.http2chunkWriter.Write + #96: internal/web/logbuffer.go:199:19: web.LogBuffer.SpillTo calls bufio.Writer.Flush, which calls http.http2chunkWriter.Write + #97: internal/util/msgerr.go:150:18: util.ErrText calls http.http2connError.Error + #98: internal/util/msgerr.go:150:18: util.ErrText calls http.http2connError.Error + #99: internal/util/msgerr.go:150:18: util.ErrText calls http.http2duplicatePseudoHeaderError.Error + #100: internal/util/msgerr.go:150:18: util.ErrText calls http.http2duplicatePseudoHeaderError.Error + #101: internal/notify/notifier.go:1165:17: notify.Notifier.PushTestEventSync calls http.http2gzipReader.Close + #102: internal/notify/notifier.go:1165:17: notify.Notifier.PushTestEventSync calls http.http2gzipReader.Close + #103: internal/notify/notifier.go:1078:24: notify.Notifier.SyncPreferences calls io.ReadAll, which calls http.http2gzipReader.Read + #104: internal/notify/notifier.go:1078:24: notify.Notifier.SyncPreferences calls io.ReadAll, which calls http.http2gzipReader.Read + #105: internal/util/msgerr.go:150:18: util.ErrText calls http.http2headerFieldNameError.Error + #106: internal/util/msgerr.go:150:18: util.ErrText calls http.http2headerFieldNameError.Error + #107: internal/util/msgerr.go:150:18: util.ErrText calls http.http2headerFieldValueError.Error + #108: internal/util/msgerr.go:150:18: util.ErrText calls http.http2headerFieldValueError.Error + #109: internal/util/msgerr.go:150:18: util.ErrText calls http.http2pseudoHeaderError.Error + #110: internal/util/msgerr.go:150:18: util.ErrText calls http.http2pseudoHeaderError.Error + #111: internal/notify/notifier.go:1078:24: notify.Notifier.SyncPreferences calls io.ReadAll, which calls http.http2requestBody.Read + #112: internal/notify/notifier.go:1078:24: notify.Notifier.SyncPreferences calls io.ReadAll, which calls http.http2requestBody.Read + #113: internal/api/selfrestart.go:39:10: api.flushResponse calls http.http2responseWriter.Flush + #114: internal/api/selfrestart.go:39:10: api.flushResponse calls http.http2responseWriter.Flush + #115: internal/web/setup_gate.go:367:17: web.Server.ServeSignupClosed calls http.http2responseWriter.Write + #116: internal/web/setup_gate.go:367:17: web.Server.ServeSignupClosed calls http.http2responseWriter.Write + #117: internal/web/setup_gate.go:366:16: web.Server.ServeSignupClosed calls http.http2responseWriter.WriteHeader + #118: internal/web/setup_gate.go:366:16: web.Server.ServeSignupClosed calls http.http2responseWriter.WriteHeader + #119: internal/sockheal/sockheal.go:78:29: sockheal.PingSocket calls io.WriteString, which calls http.http2responseWriter.WriteString + #120: internal/sockheal/sockheal.go:78:29: sockheal.PingSocket calls io.WriteString, which calls http.http2responseWriter.WriteString + #121: internal/web/logbuffer.go:199:19: web.LogBuffer.SpillTo calls bufio.Writer.Flush, which calls http.http2stickyErrWriter.Write + #122: internal/web/logbuffer.go:199:19: web.LogBuffer.SpillTo calls bufio.Writer.Flush, which calls http.http2stickyErrWriter.Write + #123: internal/notify/notifier.go:1165:17: notify.Notifier.PushTestEventSync calls http.http2transportResponseBody.Close + #124: internal/notify/notifier.go:1165:17: notify.Notifier.PushTestEventSync calls http.http2transportResponseBody.Close + #125: internal/notify/notifier.go:1078:24: notify.Notifier.SyncPreferences calls io.ReadAll, which calls http.http2transportResponseBody.Read + #126: internal/notify/notifier.go:1078:24: notify.Notifier.SyncPreferences calls io.ReadAll, which calls http.http2transportResponseBody.Read + #127: internal/backup/offbox_recovery_cli.go:235:15: backup.RecoverAndInstall calls fmt.Fprintln, which eventually calls http.http2writeData.String + #128: internal/backup/offbox_recovery_cli.go:235:15: backup.RecoverAndInstall calls fmt.Fprintln, which eventually calls http.http2writeData.String + #129: internal/notify/notifier.go:1164:9: notify.Notifier.PushTestEventSync calls io.Copy, which eventually calls http.loggingConn.Read + #130: internal/notify/notifier.go:1164:9: notify.Notifier.PushTestEventSync calls io.Copy, which eventually calls http.loggingConn.Read + #131: internal/web/claim.go:486:14: web.PrintLocalResetCode calls fmt.Fprintf, which calls http.loggingConn.Write + #132: internal/web/claim.go:486:14: web.PrintLocalResetCode calls fmt.Fprintf, which calls http.loggingConn.Write + #133: internal/notify/notifier.go:1078:24: notify.Notifier.SyncPreferences calls io.ReadAll, which calls http.maxBytesReader.Read + #134: internal/notify/notifier.go:1078:24: notify.Notifier.SyncPreferences calls io.ReadAll, which calls http.maxBytesReader.Read + #135: internal/web/auth.go:341:16: web.Server.Close calls sync.Once.Do, which eventually calls http.onceCloseListener.Close + #136: internal/web/auth.go:341:16: web.Server.Close calls sync.Once.Do, which eventually calls http.onceCloseListener.Close + #137: internal/notify/notifier.go:1164:9: notify.Notifier.PushTestEventSync calls io.Copy, which eventually calls http.persistConn.Read + #138: internal/notify/notifier.go:1164:9: notify.Notifier.PushTestEventSync calls io.Copy, which eventually calls http.persistConn.Read + #139: internal/notify/notifier.go:1164:9: notify.Notifier.PushTestEventSync calls io.Copy, which eventually calls http.persistConnWriter.ReadFrom + #140: internal/notify/notifier.go:1164:9: notify.Notifier.PushTestEventSync calls io.Copy, which eventually calls http.persistConnWriter.ReadFrom + #141: internal/web/logbuffer.go:199:19: web.LogBuffer.SpillTo calls bufio.Writer.Flush, which calls http.persistConnWriter.Write + #142: internal/web/logbuffer.go:199:19: web.LogBuffer.SpillTo calls bufio.Writer.Flush, which calls http.persistConnWriter.Write + #143: internal/notify/notifier.go:1078:24: notify.Notifier.SyncPreferences calls io.ReadAll, which calls http.readTrackingBody.Read + #144: internal/notify/notifier.go:1078:24: notify.Notifier.SyncPreferences calls io.ReadAll, which calls http.readTrackingBody.Read + #145: internal/notify/notifier.go:1078:24: notify.Notifier.SyncPreferences calls io.ReadAll, which calls http.readWriteCloserBody.Read + #146: internal/notify/notifier.go:1078:24: notify.Notifier.SyncPreferences calls io.ReadAll, which calls http.readWriteCloserBody.Read + #147: internal/api/selfrestart.go:39:10: api.flushResponse calls http.response.Flush + #148: internal/api/selfrestart.go:39:10: api.flushResponse calls http.response.Flush + #149: internal/notify/notifier.go:1164:9: notify.Notifier.PushTestEventSync calls io.Copy, which eventually calls http.response.ReadFrom + #150: internal/notify/notifier.go:1164:9: notify.Notifier.PushTestEventSync calls io.Copy, which eventually calls http.response.ReadFrom + #151: internal/web/setup_gate.go:367:17: web.Server.ServeSignupClosed calls http.response.Write + #152: internal/web/setup_gate.go:367:17: web.Server.ServeSignupClosed calls http.response.Write + #153: internal/web/setup_gate.go:366:16: web.Server.ServeSignupClosed calls http.response.WriteHeader + #154: internal/web/setup_gate.go:366:16: web.Server.ServeSignupClosed calls http.response.WriteHeader + #155: internal/sockheal/sockheal.go:78:29: sockheal.PingSocket calls io.WriteString, which calls http.response.WriteString + #156: internal/sockheal/sockheal.go:78:29: sockheal.PingSocket calls io.WriteString, which calls http.response.WriteString + #157: internal/util/msgerr.go:150:18: util.ErrText calls http.transportReadFromServerError.Error + #158: internal/util/msgerr.go:150:18: util.ErrText calls http.transportReadFromServerError.Error + +Vulnerability #11: GO-2026-6600 + Recognize yield as regexp preceder keyword in html/template + More info: https://pkg.go.dev/vuln/GO-2026-6600 + Standard library + Found in: html/template@go1.26 + Fixed in: html/template@go1.26.9 + Example traces found: + #1: internal/web/server.go:1076:45: web.Server.executeTemplateLang calls template.Template.ExecuteTemplate + +Vulnerability #12: GO-2026-6599 + Reset context tracking on consecutive template expressions in html/template + More info: https://pkg.go.dev/vuln/GO-2026-6599 + Standard library + Found in: html/template@go1.26 + Fixed in: html/template@go1.26.9 + Example traces found: + #1: internal/web/server.go:1076:45: web.Server.executeTemplateLang calls template.Template.ExecuteTemplate + +Vulnerability #13: GO-2026-6355 + Prevent DoS on deadlocked established channel in golang.org/x/crypto/ssh + More info: https://pkg.go.dev/vuln/GO-2026-6355 + Module: golang.org/x/crypto + Found in: golang.org/x/crypto@v0.31.0 + Fixed in: golang.org/x/crypto@v0.56.0 + Example traces found: + #1: internal/offsiteapply/seams.go:232:36: offsiteapply.KeyscanScanner.Scan calls ssh.NewClientConn + +Vulnerability #14: GO-2026-6354 + Prevent DoS on deadlocked undecided channel in golang.org/x/crypto/ssh + More info: https://pkg.go.dev/vuln/GO-2026-6354 + Module: golang.org/x/crypto + Found in: golang.org/x/crypto@v0.31.0 + Fixed in: golang.org/x/crypto@v0.56.0 + Example traces found: + #1: internal/offsiteapply/seams.go:232:36: offsiteapply.KeyscanScanner.Scan calls ssh.NewClientConn + +Vulnerability #15: GO-2026-6218 + Avoid quadratic complexity in resolvePath in net/url + More info: https://pkg.go.dev/vuln/GO-2026-6218 + Standard library + Found in: net/url@go1.26 + Fixed in: net/url@go1.26.6 + Example traces found: + #1: internal/notify/notifier.go:1159:30: notify.Notifier.PushTestEventSync calls http.Client.Do, which eventually calls url.URL.Parse + +Vulnerability #16: GO-2026-6091 + Fix Javascript regexp context tracking in html/template + More info: https://pkg.go.dev/vuln/GO-2026-6091 + Standard library + Found in: html/template@go1.26 + Fixed in: html/template@go1.26.6 + Example traces found: + #1: internal/web/server.go:1076:45: web.Server.executeTemplateLang calls template.Template.ExecuteTemplate + +Vulnerability #17: GO-2026-6090 + Limit handshake messages we are willing to accept post-handshake in + crypto/tls + More info: https://pkg.go.dev/vuln/GO-2026-6090 + Standard library + Found in: crypto/tls@go1.26 + Fixed in: crypto/tls@go1.26.6 + Example traces found: + #1: internal/mailrelay/server.go:168:34: mailrelay.Start calls smtp.Server.Serve, which eventually calls tls.Conn.Handshake + #2: cmd/controller/main.go:2214:33: controller.main calls http.Server.ListenAndServe, which eventually calls tls.Conn.HandshakeContext + #3: internal/notify/notifier.go:1164:9: notify.Notifier.PushTestEventSync calls io.Copy, which eventually calls tls.Conn.Read + #4: internal/web/logbuffer.go:199:19: web.LogBuffer.SpillTo calls bufio.Writer.Flush, which calls tls.Conn.Write + #5: internal/notify/notifier.go:1159:30: notify.Notifier.PushTestEventSync calls http.Client.Do, which eventually calls tls.Dialer.DialContext + +Vulnerability #18: GO-2026-6089 + Apply ReadHeaderTimeout when doing unencrypted HTTP/2 check in net/http + More info: https://pkg.go.dev/vuln/GO-2026-6089 + Standard library + Found in: net/http@go1.26 + Fixed in: net/http@go1.26.6 + Example traces found: + #1: cmd/controller/main.go:2214:33: controller.main calls http.Server.ListenAndServe + +Vulnerability #19: GO-2026-5972 + Enforce maximum recursion depth in encoding/asn1 + More info: https://pkg.go.dev/vuln/GO-2026-5972 + Standard library + Found in: encoding/asn1@go1.26 + Fixed in: encoding/asn1@go1.26.6 + Example traces found: + #1: internal/offsiteapply/seams.go:312:36: offsiteapply.PublicKeyOf calls ssh.ParsePrivateKey, which eventually calls asn1.Unmarshal + +Vulnerability #20: GO-2026-5856 + Invoking Encrypted Client Hello privacy leak in crypto/tls + More info: https://pkg.go.dev/vuln/GO-2026-5856 + Standard library + Found in: crypto/tls@go1.26 + Fixed in: crypto/tls@go1.26.5 + Example traces found: + #1: internal/mailrelay/server.go:168:34: mailrelay.Start calls smtp.Server.Serve, which eventually calls tls.Conn.Handshake + #2: cmd/controller/main.go:2214:33: controller.main calls http.Server.ListenAndServe, which eventually calls tls.Conn.HandshakeContext + #3: internal/notify/notifier.go:1164:9: notify.Notifier.PushTestEventSync calls io.Copy, which eventually calls tls.Conn.Read + #4: internal/web/logbuffer.go:199:19: web.LogBuffer.SpillTo calls bufio.Writer.Flush, which calls tls.Conn.Write + #5: internal/notify/notifier.go:1159:30: notify.Notifier.PushTestEventSync calls http.Client.Do, which eventually calls tls.Dialer.DialContext + +Vulnerability #21: GO-2026-5039 + Arbitrary inputs are included in errors without any escaping in + net/textproto + More info: https://pkg.go.dev/vuln/GO-2026-5039 + Standard library + Found in: net/textproto@go1.26 + Fixed in: net/textproto@go1.26.4 + Example traces found: + #1: internal/notify/notifier.go:1078:24: notify.Notifier.SyncPreferences calls io.ReadAll, which eventually calls textproto.Reader.ReadMIMEHeader + +Vulnerability #22: GO-2026-5037 + Inefficient candidate hostname parsing in crypto/x509 + More info: https://pkg.go.dev/vuln/GO-2026-5037 + Standard library + Found in: crypto/x509@go1.26 + Fixed in: crypto/x509@go1.26.4 + Example traces found: + #1: cmd/controller/main.go:2214:33: controller.main calls http.Server.ListenAndServe, which eventually calls x509.Certificate.Verify + #2: cmd/controller/main.go:2214:33: controller.main calls http.Server.ListenAndServe, which eventually calls x509.Certificate.VerifyHostname + #3: internal/util/msgerr.go:150:18: util.ErrText calls x509.HostnameError.Error + +Vulnerability #23: GO-2026-5026 + Invoking failure to reject ASCII-only Punycode-encoded labels in + golang.org/x/net/idna + More info: https://pkg.go.dev/vuln/GO-2026-5026 + Standard library + Found in: net/http@go1.26 + Fixed in: net/http@go1.26.6 + Example traces found: + #1: internal/agentapi/client.go:153:53: agentapi.Client.Close calls http.Client.CloseIdleConnections + #2: internal/notify/notifier.go:1159:30: notify.Notifier.PushTestEventSync calls http.Client.Do + #3: internal/stacks/setup_gate.go:374:20: stacks.init calls http.Client.Get + #4: cmd/controller/main.go:2113:29: controller.main calls http.Client.Head + +Vulnerability #24: GO-2026-5020 + Invoking infinite loop on large channel writes in golang.org/x/crypto/ssh + More info: https://pkg.go.dev/vuln/GO-2026-5020 + Module: golang.org/x/crypto + Found in: golang.org/x/crypto@v0.31.0 + Fixed in: golang.org/x/crypto@v0.52.0 + Example traces found: + #1: internal/offsiteapply/seams.go:232:36: offsiteapply.KeyscanScanner.Scan calls ssh.NewClientConn + +Vulnerability #25: GO-2026-5019 + Invoking bypass of FIDO/U2F security keys physical interaction in + golang.org/x/crypto/ssh + More info: https://pkg.go.dev/vuln/GO-2026-5019 + Module: golang.org/x/crypto + Found in: golang.org/x/crypto@v0.31.0 + Fixed in: golang.org/x/crypto@v0.52.0 + Example traces found: + #1: internal/offsiteapply/seams.go:232:36: offsiteapply.KeyscanScanner.Scan calls ssh.NewClientConn + +Vulnerability #26: GO-2026-5018 + Invoking pathological RSA/DSA parameters may cause DoS in + golang.org/x/crypto/ssh + More info: https://pkg.go.dev/vuln/GO-2026-5018 + Module: golang.org/x/crypto + Found in: golang.org/x/crypto@v0.31.0 + Fixed in: golang.org/x/crypto@v0.52.0 + Example traces found: + #1: internal/offsiteapply/seams.go:232:36: offsiteapply.KeyscanScanner.Scan calls ssh.NewClientConn + #2: internal/offsiteapply/seams.go:321:44: offsiteapply.FingerprintOf calls ssh.ParseAuthorizedKey + #3: internal/offsiteapply/seams.go:312:36: offsiteapply.PublicKeyOf calls ssh.ParsePrivateKey + +Vulnerability #27: GO-2026-5017 + Invoking client can cause server deadlock on unexpected responses in + golang.org/x/crypto/ssh + More info: https://pkg.go.dev/vuln/GO-2026-5017 + Module: golang.org/x/crypto + Found in: golang.org/x/crypto@v0.31.0 + Fixed in: golang.org/x/crypto@v0.52.0 + Example traces found: + #1: internal/offsiteapply/seams.go:232:36: offsiteapply.KeyscanScanner.Scan calls ssh.NewClientConn + +Vulnerability #28: GO-2026-5013 + Invoking byte arithmetic causes underflow and panic in + golang.org/x/crypto/ssh + More info: https://pkg.go.dev/vuln/GO-2026-5013 + Module: golang.org/x/crypto + Found in: golang.org/x/crypto@v0.31.0 + Fixed in: golang.org/x/crypto@v0.52.0 + Example traces found: + #1: internal/offsiteapply/seams.go:232:36: offsiteapply.KeyscanScanner.Scan calls ssh.NewClientConn + +Vulnerability #29: GO-2026-4986 + Quadratic string concatentation in consumeComment in net/mail + More info: https://pkg.go.dev/vuln/GO-2026-4986 + Standard library + Found in: net/mail@go1.26 + Fixed in: net/mail@go1.26.3 + Example traces found: + #1: internal/mailrelay/policy.go:49:32: mailrelay.FromDomain calls mail.ParseAddress + #2: internal/mailrelay/policy.go:52:38: mailrelay.FromDomain calls mail.ParseAddressList + +Vulnerability #30: GO-2026-4982 + Bypass of meta content URL escaping causes XSS in html/template + More info: https://pkg.go.dev/vuln/GO-2026-4982 + Standard library + Found in: html/template@go1.26 + Fixed in: html/template@go1.26.3 + Example traces found: + #1: internal/web/server.go:1076:45: web.Server.executeTemplateLang calls template.Template.ExecuteTemplate + +Vulnerability #31: GO-2026-4980 + Escaper bypass leads to XSS in html/template + More info: https://pkg.go.dev/vuln/GO-2026-4980 + Standard library + Found in: html/template@go1.26 + Fixed in: html/template@go1.26.3 + Example traces found: + #1: internal/web/server.go:1076:45: web.Server.executeTemplateLang calls template.Template.ExecuteTemplate + +Vulnerability #32: GO-2026-4977 + Quadratic string concatenation in consumePhrase in net/mail + More info: https://pkg.go.dev/vuln/GO-2026-4977 + Standard library + Found in: net/mail@go1.26 + Fixed in: net/mail@go1.26.3 + Example traces found: + #1: internal/mailrelay/policy.go:49:32: mailrelay.FromDomain calls mail.ParseAddress + #2: internal/mailrelay/policy.go:52:38: mailrelay.FromDomain calls mail.ParseAddressList + +Vulnerability #33: GO-2026-4971 + Panic in Dial and LookupPort when handling NUL byte on Windows in net + More info: https://pkg.go.dev/vuln/GO-2026-4971 + Standard library + Found in: net@go1.26 + Fixed in: net@go1.26.3 + Example traces found: + #1: internal/stacks/healthprobe.go:227:30: stacks.Manager.probeTCP calls net.DialTimeout + #2: internal/offsiteapply/seams.go:227:28: offsiteapply.KeyscanScanner.Scan calls net.Dialer.DialContext + #3: internal/mailrelay/server.go:136:23: mailrelay.Server.Start calls net.Listen + #4: internal/web/clientaddr.go:68:25: web.peerResolver.has calls net.Resolver.LookupHost + +Vulnerability #34: GO-2026-4947 + Unexpected work during chain building in crypto/x509 + More info: https://pkg.go.dev/vuln/GO-2026-4947 + Standard library + Found in: crypto/x509@go1.26 + Fixed in: crypto/x509@go1.26.2 + Example traces found: + #1: cmd/controller/main.go:2214:33: controller.main calls http.Server.ListenAndServe, which eventually calls x509.Certificate.Verify + +Vulnerability #35: GO-2026-4946 + Inefficient policy validation in crypto/x509 + More info: https://pkg.go.dev/vuln/GO-2026-4946 + Standard library + Found in: crypto/x509@go1.26 + Fixed in: crypto/x509@go1.26.2 + Example traces found: + #1: cmd/controller/main.go:2214:33: controller.main calls http.Server.ListenAndServe, which eventually calls x509.Certificate.Verify + +Vulnerability #36: GO-2026-4918 + Infinite loop in HTTP/2 transport when given bad SETTINGS_MAX_FRAME_SIZE in + net/http/internal/http2 in golang.org/x/net + More info: https://pkg.go.dev/vuln/GO-2026-4918 + Standard library + Found in: net/http@go1.26 + Fixed in: net/http@go1.26.3 + Example traces found: + #1: internal/agentapi/client.go:153:53: agentapi.Client.Close calls http.Client.CloseIdleConnections + #2: internal/notify/notifier.go:1159:30: notify.Notifier.PushTestEventSync calls http.Client.Do + #3: internal/stacks/setup_gate.go:374:20: stacks.init calls http.Client.Get + #4: cmd/controller/main.go:2113:29: controller.main calls http.Client.Head + +Vulnerability #37: GO-2026-4870 + Unauthenticated TLS 1.3 KeyUpdate record can cause persistent connection + retention and DoS in crypto/tls + More info: https://pkg.go.dev/vuln/GO-2026-4870 + Standard library + Found in: crypto/tls@go1.26 + Fixed in: crypto/tls@go1.26.2 + Example traces found: + #1: internal/mailrelay/server.go:168:34: mailrelay.Start calls smtp.Server.Serve, which eventually calls tls.Conn.Handshake + #2: cmd/controller/main.go:2214:33: controller.main calls http.Server.ListenAndServe, which eventually calls tls.Conn.HandshakeContext + #3: internal/notify/notifier.go:1164:9: notify.Notifier.PushTestEventSync calls io.Copy, which eventually calls tls.Conn.Read + #4: internal/web/logbuffer.go:199:19: web.LogBuffer.SpillTo calls bufio.Writer.Flush, which calls tls.Conn.Write + #5: internal/notify/notifier.go:1159:30: notify.Notifier.PushTestEventSync calls http.Client.Do, which eventually calls tls.Dialer.DialContext + +Vulnerability #38: GO-2026-4869 + Unbounded allocation for old GNU sparse in archive/tar + More info: https://pkg.go.dev/vuln/GO-2026-4869 + Standard library + Found in: archive/tar@go1.26 + Fixed in: archive/tar@go1.26.2 + Example traces found: + #1: internal/appexport/restore.go:145:22: appexport.ReadManifestFromFAB calls tar.Reader.Next + +Vulnerability #39: GO-2026-4866 + Case-sensitive excludedSubtrees name constraints cause Auth Bypass in + crypto/x509 + More info: https://pkg.go.dev/vuln/GO-2026-4866 + Standard library + Found in: crypto/x509@go1.26 + Fixed in: crypto/x509@go1.26.2 + Example traces found: + #1: cmd/controller/main.go:2214:33: controller.main calls http.Server.ListenAndServe, which eventually calls x509.Certificate.Verify + +Vulnerability #40: GO-2026-4865 + JsBraceDepth Context Tracking Bugs (XSS) in html/template + More info: https://pkg.go.dev/vuln/GO-2026-4865 + Standard library + Found in: html/template@go1.26 + Fixed in: html/template@go1.26.2 + Example traces found: + #1: internal/util/msgerr.go:150:18: util.ErrText calls template.Error.Error + #2: internal/web/server.go:1076:45: web.Server.executeTemplateLang calls template.Template.ExecuteTemplate + #3: internal/setup/handlers.go:78:25: setup.Server.loadTemplates calls template.Template.Funcs + #4: internal/web/server.go:392:26: web.parseTemplateSet calls template.Template.Parse + #5: internal/setup/handlers.go:80:13: setup.Server.loadTemplates calls template.Template.ParseFS + #6: internal/backup/offbox_recovery_cli.go:235:15: backup.RecoverAndInstall calls fmt.Fprintln, which eventually calls template.context.String + +Vulnerability #41: GO-2026-4603 + URLs in meta content attribute actions are not escaped in html/template + More info: https://pkg.go.dev/vuln/GO-2026-4603 + Standard library + Found in: html/template@go1.26 + Fixed in: html/template@go1.26.1 + Example traces found: + #1: internal/web/server.go:1076:45: web.Server.executeTemplateLang calls template.Template.ExecuteTemplate + +Vulnerability #42: GO-2026-4602 + FileInfo can escape from a Root in os + More info: https://pkg.go.dev/vuln/GO-2026-4602 + Standard library + Found in: os@go1.26 + Fixed in: os@go1.26.1 + Example traces found: + #1: internal/web/server.go:1163:16: web.Server.serveAsset calls http.ServeFile, which eventually calls os.File.ReadDir + #2: internal/web/server.go:1163:16: web.Server.serveAsset calls http.ServeFile, which eventually calls os.File.Readdir + #3: internal/backup/offbox_reconstitute.go:1110:32: backup.Manager.OffsiteScratchPair calls os.ReadDir + +Vulnerability #43: GO-2026-4601 + Incorrect parsing of IPv6 host literals in net/url + More info: https://pkg.go.dev/vuln/GO-2026-4601 + Standard library + Found in: net/url@go1.26 + Fixed in: net/url@go1.26.1 + Example traces found: + #1: internal/web/family_gate.go:258:24: web.Server.ServeFamilyGateAuth calls url.Parse + #2: cmd/controller/main.go:2214:33: controller.main calls http.Server.ListenAndServe, which eventually calls url.ParseRequestURI + #3: internal/notify/notifier.go:1159:30: notify.Notifier.PushTestEventSync calls http.Client.Do, which eventually calls url.URL.Parse + +Vulnerability #44: GO-2026-4600 + Panic in name constraint checking for malformed certificates in crypto/x509 + More info: https://pkg.go.dev/vuln/GO-2026-4600 + Standard library + Found in: crypto/x509@go1.26 + Fixed in: crypto/x509@go1.26.1 + Example traces found: + #1: cmd/controller/main.go:2214:33: controller.main calls http.Server.ListenAndServe, which eventually calls x509.Certificate.Verify + +Vulnerability #45: GO-2026-4599 + Incorrect enforcement of email constraints in crypto/x509 + More info: https://pkg.go.dev/vuln/GO-2026-4599 + Standard library + Found in: crypto/x509@go1.26 + Fixed in: crypto/x509@go1.26.1 + Example traces found: + #1: cmd/controller/main.go:2214:33: controller.main calls http.Server.ListenAndServe, which eventually calls x509.Certificate.Verify + +Vulnerability #46: GO-2025-3487 + Potential denial of service in golang.org/x/crypto + More info: https://pkg.go.dev/vuln/GO-2025-3487 + Module: golang.org/x/crypto + Found in: golang.org/x/crypto@v0.31.0 + Fixed in: golang.org/x/crypto@v0.35.0 + Example traces found: + #1: internal/offsiteapply/seams.go:232:36: offsiteapply.KeyscanScanner.Scan calls ssh.NewClientConn + +Your code is affected by 46 vulnerabilities from 1 module and the Go standard library. +This scan also found 13 vulnerabilities in packages you import and 9 +vulnerabilities in modules you require, but your code doesn't appear to call +these vulnerabilities. +Use '-show verbose' for more details. diff --git a/documentation/audits/security-review-2026-10-12/scanners/govulncheck-source-hub.txt b/documentation/audits/security-review-2026-10-12/scanners/govulncheck-source-hub.txt new file mode 100644 index 00000000..98bd56f2 --- /dev/null +++ b/documentation/audits/security-review-2026-10-12/scanners/govulncheck-source-hub.txt @@ -0,0 +1,1133 @@ +=== Symbol Results === + +Vulnerability #1: GO-2026-6617 + HTTP/2 server crash due to HPACK encoder race in net/http + More info: https://pkg.go.dev/vuln/GO-2026-6617 + Standard library + Found in: net/http@go1.26 + Fixed in: net/http@go1.26.9 + Example traces found: + #1: internal/cloudflare/reach.go:37:36: cloudflare.TokenZones calls http.Client.Do + #2: internal/cloudflare/reach.go:37:36: cloudflare.TokenZones calls http.Client.Do + #3: internal/web/server.go:458:15: web.Server.ServeHTTP calls http.Error + #4: internal/web/server.go:458:15: web.Server.ServeHTTP calls http.Error + #5: internal/api/handler.go:2867:26: api.Handler.handleArtifactManifest calls http.Header.Get + #6: internal/api/handler.go:2867:26: api.Handler.handleArtifactManifest calls http.Header.Get + #7: internal/web/server.go:470:17: web.Server.ServeHTTP calls http.Header.Set + #8: internal/web/server.go:470:17: web.Server.ServeHTTP calls http.Header.Set + #9: internal/web/templatefetcher.go:56:29: web.TemplateFetcher.fetch calls http.NewRequest + #10: internal/web/templatefetcher.go:56:29: web.TemplateFetcher.fetch calls http.NewRequest + #11: internal/cloudflare/reach.go:32:40: cloudflare.TokenZones calls http.NewRequestWithContext + #12: internal/cloudflare/reach.go:32:40: cloudflare.TokenZones calls http.NewRequestWithContext + #13: internal/web/server.go:478:17: web.Server.ServeHTTP calls http.NotFound + #14: internal/web/server.go:478:17: web.Server.ServeHTTP calls http.NotFound + #15: internal/web/server.go:855:16: web.Server.ServeHTTP calls http.Redirect + #16: internal/web/server.go:855:16: web.Server.ServeHTTP calls http.Redirect + #17: internal/web/server.go:981:29: web.Server.validateCSRF calls http.Request.BasicAuth + #18: internal/web/server.go:981:29: web.Server.validateCSRF calls http.Request.BasicAuth + #19: internal/web/server.go:979:25: web.Server.validateCSRF calls http.Request.Cookie + #20: internal/web/server.go:979:25: web.Server.validateCSRF calls http.Request.Cookie + #21: internal/web/server.go:762:43: web.Server.ServeHTTP calls http.Request.FormValue + #22: internal/web/server.go:762:43: web.Server.ServeHTTP calls http.Request.FormValue + #23: internal/web/configs.go:1592:23: web.Server.handleSetCustomerFloor calls http.Request.ParseForm + #24: internal/web/configs.go:1592:23: web.Server.handleSetCustomerFloor calls http.Request.ParseForm + #25: internal/gitea/gitea.go:234:19: gitea.Client.probe calls http.Request.SetBasicAuth + #26: internal/gitea/gitea.go:234:19: gitea.Client.probe calls http.Request.SetBasicAuth + #27: internal/api/wait.go:73:20: api.Handler.handleWait calls http.ResponseController.Flush + #28: internal/api/wait.go:73:20: api.Handler.handleWait calls http.ResponseController.Flush + #29: internal/api/wait.go:67:25: api.Handler.handleWait calls http.ResponseController.SetWriteDeadline + #30: internal/api/wait.go:67:25: api.Handler.handleWait calls http.ResponseController.SetWriteDeadline + #31: internal/assets/assets.go:215:16: assets.Manager.ServeFile calls http.ServeFile + #32: internal/assets/assets.go:215:16: assets.Manager.ServeFile calls http.ServeFile + #33: cmd/hub/main.go:640:12: hub.main calls http.ServeMux.Handle + #34: cmd/hub/main.go:640:12: hub.main calls http.ServeMux.Handle + #35: cmd/hub/main.go:629:16: hub.main calls http.ServeMux.HandleFunc + #36: cmd/hub/main.go:629:16: hub.main calls http.ServeMux.HandleFunc + #37: cmd/hub/main.go:932:33: hub.main calls http.Server.ListenAndServe + #38: cmd/hub/main.go:932:33: hub.main calls http.Server.ListenAndServe + #39: cmd/hub/main.go:926:28: hub.main calls http.Server.Shutdown + #40: cmd/hub/main.go:926:28: hub.main calls http.Server.Shutdown + #41: internal/web/server.go:939:18: web.Server.handleLogin calls http.SetCookie + #42: internal/web/server.go:939:18: web.Server.handleLogin calls http.SetCookie + #43: internal/gitea/gitea.go:42:53: gitea.New calls http.Transport.Clone + #44: internal/gitea/gitea.go:42:53: gitea.New calls http.Transport.Clone + #45: internal/cloudflare/reach.go:42:2: cloudflare.TokenZones calls http.body.Close + #46: internal/cloudflare/reach.go:42:2: cloudflare.TokenZones calls http.body.Close + #47: internal/store/logbundle.go:222:24: store.Store.GetLogBundleContent calls io.ReadAll, which calls http.body.Read + #48: internal/store/logbundle.go:222:24: store.Store.GetLogBundleContent calls io.ReadAll, which calls http.body.Read + #49: internal/cloudflare/reach.go:42:2: cloudflare.TokenZones calls http.bodyEOFSignal.Close + #50: internal/cloudflare/reach.go:42:2: cloudflare.TokenZones calls http.bodyEOFSignal.Close + #51: internal/store/logbundle.go:222:24: store.Store.GetLogBundleContent calls io.ReadAll, which eventually calls http.bodyEOFSignal.Read + #52: internal/store/logbundle.go:222:24: store.Store.GetLogBundleContent calls io.ReadAll, which eventually calls http.bodyEOFSignal.Read + #53: internal/store/logbundle.go:222:24: store.Store.GetLogBundleContent calls io.ReadAll, which eventually calls http.bodyLocked.Read + #54: internal/store/logbundle.go:222:24: store.Store.GetLogBundleContent calls io.ReadAll, which eventually calls http.bodyLocked.Read + #55: internal/gitea/gitea.go:241:16: gitea.Client.probe calls io.Copy, which eventually calls http.bufioFlushWriter.Write + #56: internal/gitea/gitea.go:241:16: gitea.Client.probe calls io.Copy, which eventually calls http.bufioFlushWriter.Write + #57: internal/cloudflare/reach.go:42:2: cloudflare.TokenZones calls http.cancelTimerBody.Close + #58: internal/cloudflare/reach.go:42:2: cloudflare.TokenZones calls http.cancelTimerBody.Close + #59: internal/store/logbundle.go:222:24: store.Store.GetLogBundleContent calls io.ReadAll, which eventually calls http.cancelTimerBody.Read + #60: internal/store/logbundle.go:222:24: store.Store.GetLogBundleContent calls io.ReadAll, which eventually calls http.cancelTimerBody.Read + #61: internal/osupdates/service.go:380:13: osupdates.fingerprint calls fmt.Fprintf, which eventually calls http.checkConnErrorWriter.Write + #62: internal/osupdates/service.go:380:13: osupdates.fingerprint calls fmt.Fprintf, which eventually calls http.checkConnErrorWriter.Write + #63: internal/osupdates/service.go:380:13: osupdates.fingerprint calls fmt.Fprintf, which eventually calls http.chunkWriter.Write + #64: internal/osupdates/service.go:380:13: osupdates.fingerprint calls fmt.Fprintf, which eventually calls http.chunkWriter.Write + #65: internal/store/logbundle.go:222:24: store.Store.GetLogBundleContent calls io.ReadAll, which eventually calls http.connReader.Read + #66: internal/store/logbundle.go:222:24: store.Store.GetLogBundleContent calls io.ReadAll, which eventually calls http.connReader.Read + #67: internal/store/logbundle.go:222:24: store.Store.GetLogBundleContent calls io.ReadAll, which calls http.expectContinueReader.Read + #68: internal/store/logbundle.go:222:24: store.Store.GetLogBundleContent calls io.ReadAll, which calls http.expectContinueReader.Read + #69: internal/cloudflare/reach.go:42:2: cloudflare.TokenZones calls http.gzipReader.Close + #70: internal/cloudflare/reach.go:42:2: cloudflare.TokenZones calls http.gzipReader.Close + #71: internal/store/logbundle.go:222:24: store.Store.GetLogBundleContent calls io.ReadAll, which eventually calls http.gzipReader.Read + #72: internal/store/logbundle.go:222:24: store.Store.GetLogBundleContent calls io.ReadAll, which eventually calls http.gzipReader.Read + #73: internal/cloudflare/reach.go:40:72: cloudflare.TokenZones calls http.http2ConnectionError.Error + #74: internal/cloudflare/reach.go:40:72: cloudflare.TokenZones calls http.http2ConnectionError.Error + #75: cmd/hubdb-check/main.go:62:15: hubdb.main calls fmt.Fprintln, which eventually calls http.http2ErrCode.String + #76: cmd/hubdb-check/main.go:62:15: hubdb.main calls fmt.Fprintln, which eventually calls http.http2ErrCode.String + #77: cmd/hubdb-check/main.go:62:15: hubdb.main calls fmt.Fprintln, which eventually calls http.http2FrameHeader.String + #78: cmd/hubdb-check/main.go:62:15: hubdb.main calls fmt.Fprintln, which eventually calls http.http2FrameHeader.String + #79: cmd/hubdb-check/main.go:62:15: hubdb.main calls fmt.Fprintln, which eventually calls http.http2FrameType.String + #80: cmd/hubdb-check/main.go:62:15: hubdb.main calls fmt.Fprintln, which eventually calls http.http2FrameType.String + #81: cmd/hubdb-check/main.go:62:15: hubdb.main calls fmt.Fprintln, which eventually calls http.http2FrameWriteRequest.String + #82: cmd/hubdb-check/main.go:62:15: hubdb.main calls fmt.Fprintln, which eventually calls http.http2FrameWriteRequest.String + #83: internal/cloudflare/reach.go:40:72: cloudflare.TokenZones calls http.http2GoAwayError.Error + #84: internal/cloudflare/reach.go:40:72: cloudflare.TokenZones calls http.http2GoAwayError.Error + #85: cmd/hubdb-check/main.go:62:15: hubdb.main calls fmt.Fprintln, which eventually calls http.http2Setting.String + #86: cmd/hubdb-check/main.go:62:15: hubdb.main calls fmt.Fprintln, which eventually calls http.http2Setting.String + #87: cmd/hubdb-check/main.go:62:15: hubdb.main calls fmt.Fprintln, which eventually calls http.http2SettingID.String + #88: cmd/hubdb-check/main.go:62:15: hubdb.main calls fmt.Fprintln, which eventually calls http.http2SettingID.String + #89: internal/cloudflare/reach.go:40:72: cloudflare.TokenZones calls http.http2StreamError.Error + #90: internal/cloudflare/reach.go:40:72: cloudflare.TokenZones calls http.http2StreamError.Error + #91: internal/osupdates/service.go:380:13: osupdates.fingerprint calls fmt.Fprintf, which eventually calls http.http2bufferedWriterTimeoutWriter.Write + #92: internal/osupdates/service.go:380:13: osupdates.fingerprint calls fmt.Fprintf, which eventually calls http.http2bufferedWriterTimeoutWriter.Write + #93: internal/osupdates/service.go:380:13: osupdates.fingerprint calls fmt.Fprintf, which eventually calls http.http2chunkWriter.Write + #94: internal/osupdates/service.go:380:13: osupdates.fingerprint calls fmt.Fprintf, which eventually calls http.http2chunkWriter.Write + #95: internal/cloudflare/reach.go:40:72: cloudflare.TokenZones calls http.http2connError.Error + #96: internal/cloudflare/reach.go:40:72: cloudflare.TokenZones calls http.http2connError.Error + #97: internal/cloudflare/reach.go:40:72: cloudflare.TokenZones calls http.http2duplicatePseudoHeaderError.Error + #98: internal/cloudflare/reach.go:40:72: cloudflare.TokenZones calls http.http2duplicatePseudoHeaderError.Error + #99: internal/cloudflare/reach.go:42:2: cloudflare.TokenZones calls http.http2gzipReader.Close + #100: internal/cloudflare/reach.go:42:2: cloudflare.TokenZones calls http.http2gzipReader.Close + #101: internal/store/logbundle.go:222:24: store.Store.GetLogBundleContent calls io.ReadAll, which eventually calls http.http2gzipReader.Read + #102: internal/store/logbundle.go:222:24: store.Store.GetLogBundleContent calls io.ReadAll, which eventually calls http.http2gzipReader.Read + #103: internal/cloudflare/reach.go:40:72: cloudflare.TokenZones calls http.http2headerFieldNameError.Error + #104: internal/cloudflare/reach.go:40:72: cloudflare.TokenZones calls http.http2headerFieldNameError.Error + #105: internal/cloudflare/reach.go:40:72: cloudflare.TokenZones calls http.http2headerFieldValueError.Error + #106: internal/cloudflare/reach.go:40:72: cloudflare.TokenZones calls http.http2headerFieldValueError.Error + #107: internal/cloudflare/reach.go:40:72: cloudflare.TokenZones calls http.http2pseudoHeaderError.Error + #108: internal/cloudflare/reach.go:40:72: cloudflare.TokenZones calls http.http2pseudoHeaderError.Error + #109: internal/store/logbundle.go:222:24: store.Store.GetLogBundleContent calls io.ReadAll, which calls http.http2requestBody.Read + #110: internal/store/logbundle.go:222:24: store.Store.GetLogBundleContent calls io.ReadAll, which calls http.http2requestBody.Read + #111: internal/web/server.go:472:10: web.Server.ServeHTTP calls http.http2responseWriter.Write + #112: internal/web/server.go:472:10: web.Server.ServeHTTP calls http.http2responseWriter.Write + #113: internal/api/handler.go:2904:15: api.Handler.handleArtifactManifest calls http.http2responseWriter.WriteHeader + #114: internal/api/handler.go:2904:15: api.Handler.handleArtifactManifest calls http.http2responseWriter.WriteHeader + #115: internal/store/logbundle.go:141:24: store.Store.SaveLogBundle calls gzip.Writer.Write, which eventually calls http.http2responseWriter.WriteString + #116: internal/store/logbundle.go:141:24: store.Store.SaveLogBundle calls gzip.Writer.Write, which eventually calls http.http2responseWriter.WriteString + #117: internal/osupdates/service.go:380:13: osupdates.fingerprint calls fmt.Fprintf, which eventually calls http.http2stickyErrWriter.Write + #118: internal/osupdates/service.go:380:13: osupdates.fingerprint calls fmt.Fprintf, which eventually calls http.http2stickyErrWriter.Write + #119: internal/cloudflare/reach.go:42:2: cloudflare.TokenZones calls http.http2transportResponseBody.Close + #120: internal/cloudflare/reach.go:42:2: cloudflare.TokenZones calls http.http2transportResponseBody.Close + #121: internal/store/logbundle.go:222:24: store.Store.GetLogBundleContent calls io.ReadAll, which eventually calls http.http2transportResponseBody.Read + #122: internal/store/logbundle.go:222:24: store.Store.GetLogBundleContent calls io.ReadAll, which eventually calls http.http2transportResponseBody.Read + #123: cmd/hubdb-check/main.go:62:15: hubdb.main calls fmt.Fprintln, which eventually calls http.http2writeData.String + #124: cmd/hubdb-check/main.go:62:15: hubdb.main calls fmt.Fprintln, which eventually calls http.http2writeData.String + #125: internal/store/logbundle.go:222:24: store.Store.GetLogBundleContent calls io.ReadAll, which eventually calls http.loggingConn.Read + #126: internal/store/logbundle.go:222:24: store.Store.GetLogBundleContent calls io.ReadAll, which eventually calls http.loggingConn.Read + #127: internal/osupdates/service.go:380:13: osupdates.fingerprint calls fmt.Fprintf, which calls http.loggingConn.Write + #128: internal/osupdates/service.go:380:13: osupdates.fingerprint calls fmt.Fprintf, which calls http.loggingConn.Write + #129: internal/store/logbundle.go:222:24: store.Store.GetLogBundleContent calls io.ReadAll, which eventually calls http.maxBytesReader.Read + #130: internal/store/logbundle.go:222:24: store.Store.GetLogBundleContent calls io.ReadAll, which eventually calls http.maxBytesReader.Read + #131: internal/i18n/i18n.go:118:15: i18n.Shared calls sync.Once.Do, which eventually calls http.onceCloseListener.Close + #132: internal/i18n/i18n.go:118:15: i18n.Shared calls sync.Once.Do, which eventually calls http.onceCloseListener.Close + #133: internal/store/logbundle.go:222:24: store.Store.GetLogBundleContent calls io.ReadAll, which eventually calls http.persistConn.Read + #134: internal/store/logbundle.go:222:24: store.Store.GetLogBundleContent calls io.ReadAll, which eventually calls http.persistConn.Read + #135: internal/gitea/gitea.go:241:16: gitea.Client.probe calls io.Copy, which eventually calls http.persistConnWriter.ReadFrom + #136: internal/gitea/gitea.go:241:16: gitea.Client.probe calls io.Copy, which eventually calls http.persistConnWriter.ReadFrom + #137: internal/osupdates/service.go:380:13: osupdates.fingerprint calls fmt.Fprintf, which eventually calls http.persistConnWriter.Write + #138: internal/osupdates/service.go:380:13: osupdates.fingerprint calls fmt.Fprintf, which eventually calls http.persistConnWriter.Write + #139: internal/store/logbundle.go:222:24: store.Store.GetLogBundleContent calls io.ReadAll, which calls http.readTrackingBody.Read + #140: internal/store/logbundle.go:222:24: store.Store.GetLogBundleContent calls io.ReadAll, which calls http.readTrackingBody.Read + #141: internal/store/logbundle.go:222:24: store.Store.GetLogBundleContent calls io.ReadAll, which eventually calls http.readWriteCloserBody.Read + #142: internal/store/logbundle.go:222:24: store.Store.GetLogBundleContent calls io.ReadAll, which eventually calls http.readWriteCloserBody.Read + #143: internal/gitea/gitea.go:241:16: gitea.Client.probe calls io.Copy, which eventually calls http.response.ReadFrom + #144: internal/gitea/gitea.go:241:16: gitea.Client.probe calls io.Copy, which eventually calls http.response.ReadFrom + #145: internal/web/server.go:472:10: web.Server.ServeHTTP calls http.response.Write + #146: internal/web/server.go:472:10: web.Server.ServeHTTP calls http.response.Write + #147: internal/api/handler.go:2904:15: api.Handler.handleArtifactManifest calls http.response.WriteHeader + #148: internal/api/handler.go:2904:15: api.Handler.handleArtifactManifest calls http.response.WriteHeader + #149: internal/store/logbundle.go:141:24: store.Store.SaveLogBundle calls gzip.Writer.Write, which eventually calls http.response.WriteString + #150: internal/store/logbundle.go:141:24: store.Store.SaveLogBundle calls gzip.Writer.Write, which eventually calls http.response.WriteString + #151: internal/cloudflare/reach.go:40:72: cloudflare.TokenZones calls http.transportReadFromServerError.Error + #152: internal/cloudflare/reach.go:40:72: cloudflare.TokenZones calls http.transportReadFromServerError.Error + +Vulnerability #2: GO-2026-6613 + HTTP/1 server connection desynchronization after 2xx CONNECT response in + net/http + More info: https://pkg.go.dev/vuln/GO-2026-6613 + Standard library + Found in: net/http@go1.26 + Fixed in: net/http@go1.26.9 + Example traces found: + #1: internal/cloudflare/reach.go:42:2: cloudflare.TokenZones calls http.http2transportResponseBody.Close, which eventually calls http.CanonicalHeaderKey + #2: internal/cloudflare/reach.go:37:36: cloudflare.TokenZones calls http.Client.Do + #3: internal/web/server.go:458:15: web.Server.ServeHTTP calls http.Error + #4: internal/api/handler.go:2904:15: api.Handler.handleArtifactManifest calls http.http2responseWriter.WriteHeader, which eventually calls http.Header.Del + #5: internal/api/handler.go:2867:26: api.Handler.handleArtifactManifest calls http.Header.Get + #6: internal/web/server.go:470:17: web.Server.ServeHTTP calls http.Header.Set + #7: internal/web/templatefetcher.go:56:29: web.TemplateFetcher.fetch calls http.NewRequest + #8: internal/cloudflare/reach.go:32:40: cloudflare.TokenZones calls http.NewRequestWithContext + #9: internal/web/server.go:478:17: web.Server.ServeHTTP calls http.NotFound + #10: internal/web/server.go:855:16: web.Server.ServeHTTP calls http.Redirect + #11: internal/web/server.go:981:29: web.Server.validateCSRF calls http.Request.BasicAuth + #12: internal/web/server.go:979:25: web.Server.validateCSRF calls http.Request.Cookie + #13: internal/web/server.go:762:43: web.Server.ServeHTTP calls http.Request.FormValue + #14: internal/web/configs.go:1592:23: web.Server.handleSetCustomerFloor calls http.Request.ParseForm + #15: internal/gitea/gitea.go:234:19: gitea.Client.probe calls http.Request.SetBasicAuth + #16: internal/api/wait.go:73:20: api.Handler.handleWait calls http.ResponseController.Flush + #17: internal/api/wait.go:67:25: api.Handler.handleWait calls http.ResponseController.SetWriteDeadline + #18: internal/assets/assets.go:215:16: assets.Manager.ServeFile calls http.ServeFile + #19: cmd/hub/main.go:640:12: hub.main calls http.ServeMux.Handle + #20: cmd/hub/main.go:629:16: hub.main calls http.ServeMux.HandleFunc + #21: cmd/hub/main.go:932:33: hub.main calls http.Server.ListenAndServe + #22: cmd/hub/main.go:926:28: hub.main calls http.Server.Shutdown + #23: internal/web/server.go:939:18: web.Server.handleLogin calls http.SetCookie + #24: internal/gitea/gitea.go:42:53: gitea.New calls http.Transport.Clone + #25: internal/cloudflare/reach.go:42:2: cloudflare.TokenZones calls http.body.Close + #26: internal/store/logbundle.go:222:24: store.Store.GetLogBundleContent calls io.ReadAll, which calls http.body.Read + #27: internal/cloudflare/reach.go:42:2: cloudflare.TokenZones calls http.bodyEOFSignal.Close + #28: internal/store/logbundle.go:222:24: store.Store.GetLogBundleContent calls io.ReadAll, which eventually calls http.bodyEOFSignal.Read + #29: internal/store/logbundle.go:222:24: store.Store.GetLogBundleContent calls io.ReadAll, which eventually calls http.bodyLocked.Read + #30: internal/gitea/gitea.go:241:16: gitea.Client.probe calls io.Copy, which eventually calls http.bufioFlushWriter.Write + #31: internal/cloudflare/reach.go:42:2: cloudflare.TokenZones calls http.cancelTimerBody.Close + #32: internal/store/logbundle.go:222:24: store.Store.GetLogBundleContent calls io.ReadAll, which eventually calls http.cancelTimerBody.Read + #33: internal/cloudflare/reach.go:42:2: cloudflare.TokenZones calls http.http2transportResponseBody.Close, which eventually calls http.checkConnErrorWriter.Write + #34: internal/cloudflare/reach.go:42:2: cloudflare.TokenZones calls http.http2transportResponseBody.Close, which eventually calls http.chunkWriter.Write + #35: internal/store/logbundle.go:222:24: store.Store.GetLogBundleContent calls io.ReadAll, which eventually calls http.connReader.Read + #36: internal/cloudflare/reach.go:42:2: cloudflare.TokenZones calls http.http2transportResponseBody.Close, which eventually calls http.expectContinueReader.Close + #37: internal/store/logbundle.go:222:24: store.Store.GetLogBundleContent calls io.ReadAll, which calls http.expectContinueReader.Read + #38: internal/cloudflare/reach.go:42:2: cloudflare.TokenZones calls http.gzipReader.Close + #39: internal/store/logbundle.go:222:24: store.Store.GetLogBundleContent calls io.ReadAll, which eventually calls http.gzipReader.Read + #40: internal/store/logbundle.go:222:24: store.Store.GetLogBundleContent calls io.ReadAll, which eventually calls http.loggingConn.Read + #41: internal/osupdates/service.go:380:13: osupdates.fingerprint calls fmt.Fprintf, which calls http.loggingConn.Write + #42: internal/store/logbundle.go:222:24: store.Store.GetLogBundleContent calls io.ReadAll, which eventually calls http.maxBytesReader.Read + #43: internal/i18n/i18n.go:118:15: i18n.Shared calls sync.Once.Do, which eventually calls http.onceCloseListener.Close + #44: internal/store/logbundle.go:222:24: store.Store.GetLogBundleContent calls io.ReadAll, which eventually calls http.persistConn.Read + #45: internal/gitea/gitea.go:241:16: gitea.Client.probe calls io.Copy, which eventually calls http.persistConnWriter.ReadFrom + #46: internal/cloudflare/reach.go:42:2: cloudflare.TokenZones calls http.http2transportResponseBody.Close, which eventually calls http.persistConnWriter.Write + #47: internal/cloudflare/reach.go:42:2: cloudflare.TokenZones calls http.http2transportResponseBody.Close, which eventually calls http.readTrackingBody.Close + #48: internal/store/logbundle.go:222:24: store.Store.GetLogBundleContent calls io.ReadAll, which calls http.readTrackingBody.Read + #49: internal/store/logbundle.go:222:24: store.Store.GetLogBundleContent calls io.ReadAll, which eventually calls http.readWriteCloserBody.Read + #50: internal/gitea/gitea.go:241:16: gitea.Client.probe calls io.Copy, which eventually calls http.response.ReadFrom + #51: internal/web/server.go:472:10: web.Server.ServeHTTP calls http.response.Write + #52: internal/api/handler.go:2904:15: api.Handler.handleArtifactManifest calls http.response.WriteHeader + #53: internal/store/logbundle.go:141:24: store.Store.SaveLogBundle calls gzip.Writer.Write, which eventually calls http.response.WriteString + #54: internal/cloudflare/reach.go:40:72: cloudflare.TokenZones calls http.transportReadFromServerError.Error + +Vulnerability #3: GO-2026-6612 + Double flow control refund on HTTP/2 server streams in net/http + More info: https://pkg.go.dev/vuln/GO-2026-6612 + Standard library + Found in: net/http@go1.26 + Fixed in: net/http@go1.26.9 + Example traces found: + #1: internal/cloudflare/reach.go:37:36: cloudflare.TokenZones calls http.Client.Do + #2: internal/cloudflare/reach.go:37:36: cloudflare.TokenZones calls http.Client.Do + #3: internal/web/server.go:458:15: web.Server.ServeHTTP calls http.Error + #4: internal/web/server.go:458:15: web.Server.ServeHTTP calls http.Error + #5: internal/api/handler.go:2867:26: api.Handler.handleArtifactManifest calls http.Header.Get + #6: internal/api/handler.go:2867:26: api.Handler.handleArtifactManifest calls http.Header.Get + #7: internal/web/server.go:470:17: web.Server.ServeHTTP calls http.Header.Set + #8: internal/web/server.go:470:17: web.Server.ServeHTTP calls http.Header.Set + #9: internal/web/templatefetcher.go:56:29: web.TemplateFetcher.fetch calls http.NewRequest + #10: internal/web/templatefetcher.go:56:29: web.TemplateFetcher.fetch calls http.NewRequest + #11: internal/cloudflare/reach.go:32:40: cloudflare.TokenZones calls http.NewRequestWithContext + #12: internal/cloudflare/reach.go:32:40: cloudflare.TokenZones calls http.NewRequestWithContext + #13: internal/web/server.go:478:17: web.Server.ServeHTTP calls http.NotFound + #14: internal/web/server.go:478:17: web.Server.ServeHTTP calls http.NotFound + #15: internal/web/server.go:855:16: web.Server.ServeHTTP calls http.Redirect + #16: internal/web/server.go:855:16: web.Server.ServeHTTP calls http.Redirect + #17: internal/web/server.go:981:29: web.Server.validateCSRF calls http.Request.BasicAuth + #18: internal/web/server.go:981:29: web.Server.validateCSRF calls http.Request.BasicAuth + #19: internal/web/server.go:979:25: web.Server.validateCSRF calls http.Request.Cookie + #20: internal/web/server.go:979:25: web.Server.validateCSRF calls http.Request.Cookie + #21: internal/web/server.go:762:43: web.Server.ServeHTTP calls http.Request.FormValue + #22: internal/web/server.go:762:43: web.Server.ServeHTTP calls http.Request.FormValue + #23: internal/web/configs.go:1592:23: web.Server.handleSetCustomerFloor calls http.Request.ParseForm + #24: internal/web/configs.go:1592:23: web.Server.handleSetCustomerFloor calls http.Request.ParseForm + #25: internal/gitea/gitea.go:234:19: gitea.Client.probe calls http.Request.SetBasicAuth + #26: internal/gitea/gitea.go:234:19: gitea.Client.probe calls http.Request.SetBasicAuth + #27: internal/api/wait.go:73:20: api.Handler.handleWait calls http.ResponseController.Flush + #28: internal/api/wait.go:73:20: api.Handler.handleWait calls http.ResponseController.Flush + #29: internal/api/wait.go:67:25: api.Handler.handleWait calls http.ResponseController.SetWriteDeadline + #30: internal/api/wait.go:67:25: api.Handler.handleWait calls http.ResponseController.SetWriteDeadline + #31: internal/assets/assets.go:215:16: assets.Manager.ServeFile calls http.ServeFile + #32: internal/assets/assets.go:215:16: assets.Manager.ServeFile calls http.ServeFile + #33: cmd/hub/main.go:640:12: hub.main calls http.ServeMux.Handle + #34: cmd/hub/main.go:640:12: hub.main calls http.ServeMux.Handle + #35: cmd/hub/main.go:629:16: hub.main calls http.ServeMux.HandleFunc + #36: cmd/hub/main.go:629:16: hub.main calls http.ServeMux.HandleFunc + #37: cmd/hub/main.go:932:33: hub.main calls http.Server.ListenAndServe + #38: cmd/hub/main.go:932:33: hub.main calls http.Server.ListenAndServe + #39: cmd/hub/main.go:926:28: hub.main calls http.Server.Shutdown + #40: cmd/hub/main.go:926:28: hub.main calls http.Server.Shutdown + #41: internal/web/server.go:939:18: web.Server.handleLogin calls http.SetCookie + #42: internal/web/server.go:939:18: web.Server.handleLogin calls http.SetCookie + #43: internal/gitea/gitea.go:42:53: gitea.New calls http.Transport.Clone + #44: internal/gitea/gitea.go:42:53: gitea.New calls http.Transport.Clone + #45: internal/cloudflare/reach.go:42:2: cloudflare.TokenZones calls http.body.Close + #46: internal/cloudflare/reach.go:42:2: cloudflare.TokenZones calls http.body.Close + #47: internal/store/logbundle.go:222:24: store.Store.GetLogBundleContent calls io.ReadAll, which calls http.body.Read + #48: internal/store/logbundle.go:222:24: store.Store.GetLogBundleContent calls io.ReadAll, which calls http.body.Read + #49: internal/cloudflare/reach.go:42:2: cloudflare.TokenZones calls http.bodyEOFSignal.Close + #50: internal/cloudflare/reach.go:42:2: cloudflare.TokenZones calls http.bodyEOFSignal.Close + #51: internal/store/logbundle.go:222:24: store.Store.GetLogBundleContent calls io.ReadAll, which eventually calls http.bodyEOFSignal.Read + #52: internal/store/logbundle.go:222:24: store.Store.GetLogBundleContent calls io.ReadAll, which eventually calls http.bodyEOFSignal.Read + #53: internal/store/logbundle.go:222:24: store.Store.GetLogBundleContent calls io.ReadAll, which eventually calls http.bodyLocked.Read + #54: internal/store/logbundle.go:222:24: store.Store.GetLogBundleContent calls io.ReadAll, which eventually calls http.bodyLocked.Read + #55: internal/gitea/gitea.go:241:16: gitea.Client.probe calls io.Copy, which eventually calls http.bufioFlushWriter.Write + #56: internal/gitea/gitea.go:241:16: gitea.Client.probe calls io.Copy, which eventually calls http.bufioFlushWriter.Write + #57: internal/cloudflare/reach.go:42:2: cloudflare.TokenZones calls http.cancelTimerBody.Close + #58: internal/cloudflare/reach.go:42:2: cloudflare.TokenZones calls http.cancelTimerBody.Close + #59: internal/store/logbundle.go:222:24: store.Store.GetLogBundleContent calls io.ReadAll, which eventually calls http.cancelTimerBody.Read + #60: internal/store/logbundle.go:222:24: store.Store.GetLogBundleContent calls io.ReadAll, which eventually calls http.cancelTimerBody.Read + #61: internal/osupdates/service.go:380:13: osupdates.fingerprint calls fmt.Fprintf, which eventually calls http.checkConnErrorWriter.Write + #62: internal/osupdates/service.go:380:13: osupdates.fingerprint calls fmt.Fprintf, which eventually calls http.checkConnErrorWriter.Write + #63: internal/osupdates/service.go:380:13: osupdates.fingerprint calls fmt.Fprintf, which eventually calls http.chunkWriter.Write + #64: internal/osupdates/service.go:380:13: osupdates.fingerprint calls fmt.Fprintf, which eventually calls http.chunkWriter.Write + #65: internal/store/logbundle.go:222:24: store.Store.GetLogBundleContent calls io.ReadAll, which eventually calls http.connReader.Read + #66: internal/store/logbundle.go:222:24: store.Store.GetLogBundleContent calls io.ReadAll, which eventually calls http.connReader.Read + #67: internal/store/logbundle.go:222:24: store.Store.GetLogBundleContent calls io.ReadAll, which calls http.expectContinueReader.Read + #68: internal/store/logbundle.go:222:24: store.Store.GetLogBundleContent calls io.ReadAll, which calls http.expectContinueReader.Read + #69: internal/cloudflare/reach.go:42:2: cloudflare.TokenZones calls http.gzipReader.Close + #70: internal/cloudflare/reach.go:42:2: cloudflare.TokenZones calls http.gzipReader.Close + #71: internal/store/logbundle.go:222:24: store.Store.GetLogBundleContent calls io.ReadAll, which eventually calls http.gzipReader.Read + #72: internal/store/logbundle.go:222:24: store.Store.GetLogBundleContent calls io.ReadAll, which eventually calls http.gzipReader.Read + #73: internal/cloudflare/reach.go:40:72: cloudflare.TokenZones calls http.http2ConnectionError.Error + #74: internal/cloudflare/reach.go:40:72: cloudflare.TokenZones calls http.http2ConnectionError.Error + #75: cmd/hubdb-check/main.go:62:15: hubdb.main calls fmt.Fprintln, which eventually calls http.http2ErrCode.String + #76: cmd/hubdb-check/main.go:62:15: hubdb.main calls fmt.Fprintln, which eventually calls http.http2ErrCode.String + #77: cmd/hubdb-check/main.go:62:15: hubdb.main calls fmt.Fprintln, which eventually calls http.http2FrameHeader.String + #78: cmd/hubdb-check/main.go:62:15: hubdb.main calls fmt.Fprintln, which eventually calls http.http2FrameHeader.String + #79: cmd/hubdb-check/main.go:62:15: hubdb.main calls fmt.Fprintln, which eventually calls http.http2FrameType.String + #80: cmd/hubdb-check/main.go:62:15: hubdb.main calls fmt.Fprintln, which eventually calls http.http2FrameType.String + #81: cmd/hubdb-check/main.go:62:15: hubdb.main calls fmt.Fprintln, which eventually calls http.http2FrameWriteRequest.String + #82: cmd/hubdb-check/main.go:62:15: hubdb.main calls fmt.Fprintln, which eventually calls http.http2FrameWriteRequest.String + #83: internal/cloudflare/reach.go:40:72: cloudflare.TokenZones calls http.http2GoAwayError.Error + #84: internal/cloudflare/reach.go:40:72: cloudflare.TokenZones calls http.http2GoAwayError.Error + #85: cmd/hubdb-check/main.go:62:15: hubdb.main calls fmt.Fprintln, which eventually calls http.http2Setting.String + #86: cmd/hubdb-check/main.go:62:15: hubdb.main calls fmt.Fprintln, which eventually calls http.http2Setting.String + #87: cmd/hubdb-check/main.go:62:15: hubdb.main calls fmt.Fprintln, which eventually calls http.http2SettingID.String + #88: cmd/hubdb-check/main.go:62:15: hubdb.main calls fmt.Fprintln, which eventually calls http.http2SettingID.String + #89: internal/cloudflare/reach.go:40:72: cloudflare.TokenZones calls http.http2StreamError.Error + #90: internal/cloudflare/reach.go:40:72: cloudflare.TokenZones calls http.http2StreamError.Error + #91: internal/osupdates/service.go:380:13: osupdates.fingerprint calls fmt.Fprintf, which eventually calls http.http2bufferedWriterTimeoutWriter.Write + #92: internal/osupdates/service.go:380:13: osupdates.fingerprint calls fmt.Fprintf, which eventually calls http.http2bufferedWriterTimeoutWriter.Write + #93: internal/osupdates/service.go:380:13: osupdates.fingerprint calls fmt.Fprintf, which eventually calls http.http2chunkWriter.Write + #94: internal/osupdates/service.go:380:13: osupdates.fingerprint calls fmt.Fprintf, which eventually calls http.http2chunkWriter.Write + #95: internal/cloudflare/reach.go:40:72: cloudflare.TokenZones calls http.http2connError.Error + #96: internal/cloudflare/reach.go:40:72: cloudflare.TokenZones calls http.http2connError.Error + #97: internal/cloudflare/reach.go:40:72: cloudflare.TokenZones calls http.http2duplicatePseudoHeaderError.Error + #98: internal/cloudflare/reach.go:40:72: cloudflare.TokenZones calls http.http2duplicatePseudoHeaderError.Error + #99: internal/cloudflare/reach.go:42:2: cloudflare.TokenZones calls http.http2gzipReader.Close + #100: internal/cloudflare/reach.go:42:2: cloudflare.TokenZones calls http.http2gzipReader.Close + #101: internal/store/logbundle.go:222:24: store.Store.GetLogBundleContent calls io.ReadAll, which eventually calls http.http2gzipReader.Read + #102: internal/store/logbundle.go:222:24: store.Store.GetLogBundleContent calls io.ReadAll, which eventually calls http.http2gzipReader.Read + #103: internal/cloudflare/reach.go:40:72: cloudflare.TokenZones calls http.http2headerFieldNameError.Error + #104: internal/cloudflare/reach.go:40:72: cloudflare.TokenZones calls http.http2headerFieldNameError.Error + #105: internal/cloudflare/reach.go:40:72: cloudflare.TokenZones calls http.http2headerFieldValueError.Error + #106: internal/cloudflare/reach.go:40:72: cloudflare.TokenZones calls http.http2headerFieldValueError.Error + #107: internal/cloudflare/reach.go:40:72: cloudflare.TokenZones calls http.http2pseudoHeaderError.Error + #108: internal/cloudflare/reach.go:40:72: cloudflare.TokenZones calls http.http2pseudoHeaderError.Error + #109: internal/store/logbundle.go:222:24: store.Store.GetLogBundleContent calls io.ReadAll, which calls http.http2requestBody.Read + #110: internal/store/logbundle.go:222:24: store.Store.GetLogBundleContent calls io.ReadAll, which calls http.http2requestBody.Read + #111: internal/web/server.go:472:10: web.Server.ServeHTTP calls http.http2responseWriter.Write + #112: internal/web/server.go:472:10: web.Server.ServeHTTP calls http.http2responseWriter.Write + #113: internal/api/handler.go:2904:15: api.Handler.handleArtifactManifest calls http.http2responseWriter.WriteHeader + #114: internal/api/handler.go:2904:15: api.Handler.handleArtifactManifest calls http.http2responseWriter.WriteHeader + #115: internal/store/logbundle.go:141:24: store.Store.SaveLogBundle calls gzip.Writer.Write, which eventually calls http.http2responseWriter.WriteString + #116: internal/store/logbundle.go:141:24: store.Store.SaveLogBundle calls gzip.Writer.Write, which eventually calls http.http2responseWriter.WriteString + #117: internal/osupdates/service.go:380:13: osupdates.fingerprint calls fmt.Fprintf, which eventually calls http.http2stickyErrWriter.Write + #118: internal/osupdates/service.go:380:13: osupdates.fingerprint calls fmt.Fprintf, which eventually calls http.http2stickyErrWriter.Write + #119: internal/cloudflare/reach.go:42:2: cloudflare.TokenZones calls http.http2transportResponseBody.Close + #120: internal/cloudflare/reach.go:42:2: cloudflare.TokenZones calls http.http2transportResponseBody.Close + #121: internal/store/logbundle.go:222:24: store.Store.GetLogBundleContent calls io.ReadAll, which eventually calls http.http2transportResponseBody.Read + #122: internal/store/logbundle.go:222:24: store.Store.GetLogBundleContent calls io.ReadAll, which eventually calls http.http2transportResponseBody.Read + #123: cmd/hubdb-check/main.go:62:15: hubdb.main calls fmt.Fprintln, which eventually calls http.http2writeData.String + #124: cmd/hubdb-check/main.go:62:15: hubdb.main calls fmt.Fprintln, which eventually calls http.http2writeData.String + #125: internal/store/logbundle.go:222:24: store.Store.GetLogBundleContent calls io.ReadAll, which eventually calls http.loggingConn.Read + #126: internal/store/logbundle.go:222:24: store.Store.GetLogBundleContent calls io.ReadAll, which eventually calls http.loggingConn.Read + #127: internal/osupdates/service.go:380:13: osupdates.fingerprint calls fmt.Fprintf, which calls http.loggingConn.Write + #128: internal/osupdates/service.go:380:13: osupdates.fingerprint calls fmt.Fprintf, which calls http.loggingConn.Write + #129: internal/store/logbundle.go:222:24: store.Store.GetLogBundleContent calls io.ReadAll, which eventually calls http.maxBytesReader.Read + #130: internal/store/logbundle.go:222:24: store.Store.GetLogBundleContent calls io.ReadAll, which eventually calls http.maxBytesReader.Read + #131: internal/i18n/i18n.go:118:15: i18n.Shared calls sync.Once.Do, which eventually calls http.onceCloseListener.Close + #132: internal/i18n/i18n.go:118:15: i18n.Shared calls sync.Once.Do, which eventually calls http.onceCloseListener.Close + #133: internal/store/logbundle.go:222:24: store.Store.GetLogBundleContent calls io.ReadAll, which eventually calls http.persistConn.Read + #134: internal/store/logbundle.go:222:24: store.Store.GetLogBundleContent calls io.ReadAll, which eventually calls http.persistConn.Read + #135: internal/gitea/gitea.go:241:16: gitea.Client.probe calls io.Copy, which eventually calls http.persistConnWriter.ReadFrom + #136: internal/gitea/gitea.go:241:16: gitea.Client.probe calls io.Copy, which eventually calls http.persistConnWriter.ReadFrom + #137: internal/osupdates/service.go:380:13: osupdates.fingerprint calls fmt.Fprintf, which eventually calls http.persistConnWriter.Write + #138: internal/osupdates/service.go:380:13: osupdates.fingerprint calls fmt.Fprintf, which eventually calls http.persistConnWriter.Write + #139: internal/store/logbundle.go:222:24: store.Store.GetLogBundleContent calls io.ReadAll, which calls http.readTrackingBody.Read + #140: internal/store/logbundle.go:222:24: store.Store.GetLogBundleContent calls io.ReadAll, which calls http.readTrackingBody.Read + #141: internal/store/logbundle.go:222:24: store.Store.GetLogBundleContent calls io.ReadAll, which eventually calls http.readWriteCloserBody.Read + #142: internal/store/logbundle.go:222:24: store.Store.GetLogBundleContent calls io.ReadAll, which eventually calls http.readWriteCloserBody.Read + #143: internal/gitea/gitea.go:241:16: gitea.Client.probe calls io.Copy, which eventually calls http.response.ReadFrom + #144: internal/gitea/gitea.go:241:16: gitea.Client.probe calls io.Copy, which eventually calls http.response.ReadFrom + #145: internal/web/server.go:472:10: web.Server.ServeHTTP calls http.response.Write + #146: internal/web/server.go:472:10: web.Server.ServeHTTP calls http.response.Write + #147: internal/api/handler.go:2904:15: api.Handler.handleArtifactManifest calls http.response.WriteHeader + #148: internal/api/handler.go:2904:15: api.Handler.handleArtifactManifest calls http.response.WriteHeader + #149: internal/store/logbundle.go:141:24: store.Store.SaveLogBundle calls gzip.Writer.Write, which eventually calls http.response.WriteString + #150: internal/store/logbundle.go:141:24: store.Store.SaveLogBundle calls gzip.Writer.Write, which eventually calls http.response.WriteString + #151: internal/cloudflare/reach.go:40:72: cloudflare.TokenZones calls http.transportReadFromServerError.Error + #152: internal/cloudflare/reach.go:40:72: cloudflare.TokenZones calls http.transportReadFromServerError.Error + +Vulnerability #4: GO-2026-6611 + Excessive CPU consumption from repeated initial window changes in net/http + More info: https://pkg.go.dev/vuln/GO-2026-6611 + Standard library + Found in: net/http@go1.26 + Fixed in: net/http@go1.26.9 + Example traces found: + #1: internal/cloudflare/reach.go:37:36: cloudflare.TokenZones calls http.Client.Do + #2: internal/cloudflare/reach.go:37:36: cloudflare.TokenZones calls http.Client.Do + #3: internal/web/server.go:458:15: web.Server.ServeHTTP calls http.Error + #4: internal/web/server.go:458:15: web.Server.ServeHTTP calls http.Error + #5: internal/api/handler.go:2867:26: api.Handler.handleArtifactManifest calls http.Header.Get + #6: internal/api/handler.go:2867:26: api.Handler.handleArtifactManifest calls http.Header.Get + #7: internal/web/server.go:470:17: web.Server.ServeHTTP calls http.Header.Set + #8: internal/web/server.go:470:17: web.Server.ServeHTTP calls http.Header.Set + #9: internal/web/templatefetcher.go:56:29: web.TemplateFetcher.fetch calls http.NewRequest + #10: internal/web/templatefetcher.go:56:29: web.TemplateFetcher.fetch calls http.NewRequest + #11: internal/cloudflare/reach.go:32:40: cloudflare.TokenZones calls http.NewRequestWithContext + #12: internal/cloudflare/reach.go:32:40: cloudflare.TokenZones calls http.NewRequestWithContext + #13: internal/web/server.go:478:17: web.Server.ServeHTTP calls http.NotFound + #14: internal/web/server.go:478:17: web.Server.ServeHTTP calls http.NotFound + #15: internal/web/server.go:855:16: web.Server.ServeHTTP calls http.Redirect + #16: internal/web/server.go:855:16: web.Server.ServeHTTP calls http.Redirect + #17: internal/web/server.go:981:29: web.Server.validateCSRF calls http.Request.BasicAuth + #18: internal/web/server.go:981:29: web.Server.validateCSRF calls http.Request.BasicAuth + #19: internal/web/server.go:979:25: web.Server.validateCSRF calls http.Request.Cookie + #20: internal/web/server.go:979:25: web.Server.validateCSRF calls http.Request.Cookie + #21: internal/web/server.go:762:43: web.Server.ServeHTTP calls http.Request.FormValue + #22: internal/web/server.go:762:43: web.Server.ServeHTTP calls http.Request.FormValue + #23: internal/web/configs.go:1592:23: web.Server.handleSetCustomerFloor calls http.Request.ParseForm + #24: internal/web/configs.go:1592:23: web.Server.handleSetCustomerFloor calls http.Request.ParseForm + #25: internal/gitea/gitea.go:234:19: gitea.Client.probe calls http.Request.SetBasicAuth + #26: internal/gitea/gitea.go:234:19: gitea.Client.probe calls http.Request.SetBasicAuth + #27: internal/api/wait.go:73:20: api.Handler.handleWait calls http.ResponseController.Flush + #28: internal/api/wait.go:73:20: api.Handler.handleWait calls http.ResponseController.Flush + #29: internal/api/wait.go:67:25: api.Handler.handleWait calls http.ResponseController.SetWriteDeadline + #30: internal/api/wait.go:67:25: api.Handler.handleWait calls http.ResponseController.SetWriteDeadline + #31: internal/assets/assets.go:215:16: assets.Manager.ServeFile calls http.ServeFile + #32: internal/assets/assets.go:215:16: assets.Manager.ServeFile calls http.ServeFile + #33: cmd/hub/main.go:640:12: hub.main calls http.ServeMux.Handle + #34: cmd/hub/main.go:640:12: hub.main calls http.ServeMux.Handle + #35: cmd/hub/main.go:629:16: hub.main calls http.ServeMux.HandleFunc + #36: cmd/hub/main.go:629:16: hub.main calls http.ServeMux.HandleFunc + #37: cmd/hub/main.go:932:33: hub.main calls http.Server.ListenAndServe + #38: cmd/hub/main.go:932:33: hub.main calls http.Server.ListenAndServe + #39: cmd/hub/main.go:926:28: hub.main calls http.Server.Shutdown + #40: cmd/hub/main.go:926:28: hub.main calls http.Server.Shutdown + #41: internal/web/server.go:939:18: web.Server.handleLogin calls http.SetCookie + #42: internal/web/server.go:939:18: web.Server.handleLogin calls http.SetCookie + #43: internal/gitea/gitea.go:42:53: gitea.New calls http.Transport.Clone + #44: internal/gitea/gitea.go:42:53: gitea.New calls http.Transport.Clone + #45: internal/cloudflare/reach.go:42:2: cloudflare.TokenZones calls http.body.Close + #46: internal/cloudflare/reach.go:42:2: cloudflare.TokenZones calls http.body.Close + #47: internal/store/logbundle.go:222:24: store.Store.GetLogBundleContent calls io.ReadAll, which calls http.body.Read + #48: internal/store/logbundle.go:222:24: store.Store.GetLogBundleContent calls io.ReadAll, which calls http.body.Read + #49: internal/cloudflare/reach.go:42:2: cloudflare.TokenZones calls http.bodyEOFSignal.Close + #50: internal/cloudflare/reach.go:42:2: cloudflare.TokenZones calls http.bodyEOFSignal.Close + #51: internal/store/logbundle.go:222:24: store.Store.GetLogBundleContent calls io.ReadAll, which eventually calls http.bodyEOFSignal.Read + #52: internal/store/logbundle.go:222:24: store.Store.GetLogBundleContent calls io.ReadAll, which eventually calls http.bodyEOFSignal.Read + #53: internal/store/logbundle.go:222:24: store.Store.GetLogBundleContent calls io.ReadAll, which eventually calls http.bodyLocked.Read + #54: internal/store/logbundle.go:222:24: store.Store.GetLogBundleContent calls io.ReadAll, which eventually calls http.bodyLocked.Read + #55: internal/gitea/gitea.go:241:16: gitea.Client.probe calls io.Copy, which eventually calls http.bufioFlushWriter.Write + #56: internal/gitea/gitea.go:241:16: gitea.Client.probe calls io.Copy, which eventually calls http.bufioFlushWriter.Write + #57: internal/cloudflare/reach.go:42:2: cloudflare.TokenZones calls http.cancelTimerBody.Close + #58: internal/cloudflare/reach.go:42:2: cloudflare.TokenZones calls http.cancelTimerBody.Close + #59: internal/store/logbundle.go:222:24: store.Store.GetLogBundleContent calls io.ReadAll, which eventually calls http.cancelTimerBody.Read + #60: internal/store/logbundle.go:222:24: store.Store.GetLogBundleContent calls io.ReadAll, which eventually calls http.cancelTimerBody.Read + #61: internal/osupdates/service.go:380:13: osupdates.fingerprint calls fmt.Fprintf, which eventually calls http.checkConnErrorWriter.Write + #62: internal/osupdates/service.go:380:13: osupdates.fingerprint calls fmt.Fprintf, which eventually calls http.checkConnErrorWriter.Write + #63: internal/osupdates/service.go:380:13: osupdates.fingerprint calls fmt.Fprintf, which eventually calls http.chunkWriter.Write + #64: internal/osupdates/service.go:380:13: osupdates.fingerprint calls fmt.Fprintf, which eventually calls http.chunkWriter.Write + #65: internal/store/logbundle.go:222:24: store.Store.GetLogBundleContent calls io.ReadAll, which eventually calls http.connReader.Read + #66: internal/store/logbundle.go:222:24: store.Store.GetLogBundleContent calls io.ReadAll, which eventually calls http.connReader.Read + #67: internal/store/logbundle.go:222:24: store.Store.GetLogBundleContent calls io.ReadAll, which calls http.expectContinueReader.Read + #68: internal/store/logbundle.go:222:24: store.Store.GetLogBundleContent calls io.ReadAll, which calls http.expectContinueReader.Read + #69: internal/cloudflare/reach.go:42:2: cloudflare.TokenZones calls http.gzipReader.Close + #70: internal/cloudflare/reach.go:42:2: cloudflare.TokenZones calls http.gzipReader.Close + #71: internal/store/logbundle.go:222:24: store.Store.GetLogBundleContent calls io.ReadAll, which eventually calls http.gzipReader.Read + #72: internal/store/logbundle.go:222:24: store.Store.GetLogBundleContent calls io.ReadAll, which eventually calls http.gzipReader.Read + #73: internal/cloudflare/reach.go:40:72: cloudflare.TokenZones calls http.http2ConnectionError.Error + #74: internal/cloudflare/reach.go:40:72: cloudflare.TokenZones calls http.http2ConnectionError.Error + #75: cmd/hubdb-check/main.go:62:15: hubdb.main calls fmt.Fprintln, which eventually calls http.http2ErrCode.String + #76: cmd/hubdb-check/main.go:62:15: hubdb.main calls fmt.Fprintln, which eventually calls http.http2ErrCode.String + #77: cmd/hubdb-check/main.go:62:15: hubdb.main calls fmt.Fprintln, which eventually calls http.http2FrameHeader.String + #78: cmd/hubdb-check/main.go:62:15: hubdb.main calls fmt.Fprintln, which eventually calls http.http2FrameHeader.String + #79: cmd/hubdb-check/main.go:62:15: hubdb.main calls fmt.Fprintln, which eventually calls http.http2FrameType.String + #80: cmd/hubdb-check/main.go:62:15: hubdb.main calls fmt.Fprintln, which eventually calls http.http2FrameType.String + #81: cmd/hubdb-check/main.go:62:15: hubdb.main calls fmt.Fprintln, which eventually calls http.http2FrameWriteRequest.String + #82: cmd/hubdb-check/main.go:62:15: hubdb.main calls fmt.Fprintln, which eventually calls http.http2FrameWriteRequest.String + #83: internal/cloudflare/reach.go:40:72: cloudflare.TokenZones calls http.http2GoAwayError.Error + #84: internal/cloudflare/reach.go:40:72: cloudflare.TokenZones calls http.http2GoAwayError.Error + #85: cmd/hubdb-check/main.go:62:15: hubdb.main calls fmt.Fprintln, which eventually calls http.http2Setting.String + #86: cmd/hubdb-check/main.go:62:15: hubdb.main calls fmt.Fprintln, which eventually calls http.http2Setting.String + #87: cmd/hubdb-check/main.go:62:15: hubdb.main calls fmt.Fprintln, which eventually calls http.http2SettingID.String + #88: cmd/hubdb-check/main.go:62:15: hubdb.main calls fmt.Fprintln, which eventually calls http.http2SettingID.String + #89: internal/cloudflare/reach.go:40:72: cloudflare.TokenZones calls http.http2StreamError.Error + #90: internal/cloudflare/reach.go:40:72: cloudflare.TokenZones calls http.http2StreamError.Error + #91: internal/osupdates/service.go:380:13: osupdates.fingerprint calls fmt.Fprintf, which eventually calls http.http2bufferedWriterTimeoutWriter.Write + #92: internal/osupdates/service.go:380:13: osupdates.fingerprint calls fmt.Fprintf, which eventually calls http.http2bufferedWriterTimeoutWriter.Write + #93: internal/osupdates/service.go:380:13: osupdates.fingerprint calls fmt.Fprintf, which eventually calls http.http2chunkWriter.Write + #94: internal/osupdates/service.go:380:13: osupdates.fingerprint calls fmt.Fprintf, which eventually calls http.http2chunkWriter.Write + #95: internal/cloudflare/reach.go:40:72: cloudflare.TokenZones calls http.http2connError.Error + #96: internal/cloudflare/reach.go:40:72: cloudflare.TokenZones calls http.http2connError.Error + #97: internal/cloudflare/reach.go:40:72: cloudflare.TokenZones calls http.http2duplicatePseudoHeaderError.Error + #98: internal/cloudflare/reach.go:40:72: cloudflare.TokenZones calls http.http2duplicatePseudoHeaderError.Error + #99: internal/cloudflare/reach.go:42:2: cloudflare.TokenZones calls http.http2gzipReader.Close + #100: internal/cloudflare/reach.go:42:2: cloudflare.TokenZones calls http.http2gzipReader.Close + #101: internal/store/logbundle.go:222:24: store.Store.GetLogBundleContent calls io.ReadAll, which eventually calls http.http2gzipReader.Read + #102: internal/store/logbundle.go:222:24: store.Store.GetLogBundleContent calls io.ReadAll, which eventually calls http.http2gzipReader.Read + #103: internal/cloudflare/reach.go:40:72: cloudflare.TokenZones calls http.http2headerFieldNameError.Error + #104: internal/cloudflare/reach.go:40:72: cloudflare.TokenZones calls http.http2headerFieldNameError.Error + #105: internal/cloudflare/reach.go:40:72: cloudflare.TokenZones calls http.http2headerFieldValueError.Error + #106: internal/cloudflare/reach.go:40:72: cloudflare.TokenZones calls http.http2headerFieldValueError.Error + #107: internal/cloudflare/reach.go:40:72: cloudflare.TokenZones calls http.http2pseudoHeaderError.Error + #108: internal/cloudflare/reach.go:40:72: cloudflare.TokenZones calls http.http2pseudoHeaderError.Error + #109: internal/store/logbundle.go:222:24: store.Store.GetLogBundleContent calls io.ReadAll, which calls http.http2requestBody.Read + #110: internal/store/logbundle.go:222:24: store.Store.GetLogBundleContent calls io.ReadAll, which calls http.http2requestBody.Read + #111: internal/web/server.go:472:10: web.Server.ServeHTTP calls http.http2responseWriter.Write + #112: internal/web/server.go:472:10: web.Server.ServeHTTP calls http.http2responseWriter.Write + #113: internal/api/handler.go:2904:15: api.Handler.handleArtifactManifest calls http.http2responseWriter.WriteHeader + #114: internal/api/handler.go:2904:15: api.Handler.handleArtifactManifest calls http.http2responseWriter.WriteHeader + #115: internal/store/logbundle.go:141:24: store.Store.SaveLogBundle calls gzip.Writer.Write, which eventually calls http.http2responseWriter.WriteString + #116: internal/store/logbundle.go:141:24: store.Store.SaveLogBundle calls gzip.Writer.Write, which eventually calls http.http2responseWriter.WriteString + #117: internal/osupdates/service.go:380:13: osupdates.fingerprint calls fmt.Fprintf, which eventually calls http.http2stickyErrWriter.Write + #118: internal/osupdates/service.go:380:13: osupdates.fingerprint calls fmt.Fprintf, which eventually calls http.http2stickyErrWriter.Write + #119: internal/cloudflare/reach.go:42:2: cloudflare.TokenZones calls http.http2transportResponseBody.Close + #120: internal/cloudflare/reach.go:42:2: cloudflare.TokenZones calls http.http2transportResponseBody.Close + #121: internal/store/logbundle.go:222:24: store.Store.GetLogBundleContent calls io.ReadAll, which eventually calls http.http2transportResponseBody.Read + #122: internal/store/logbundle.go:222:24: store.Store.GetLogBundleContent calls io.ReadAll, which eventually calls http.http2transportResponseBody.Read + #123: cmd/hubdb-check/main.go:62:15: hubdb.main calls fmt.Fprintln, which eventually calls http.http2writeData.String + #124: cmd/hubdb-check/main.go:62:15: hubdb.main calls fmt.Fprintln, which eventually calls http.http2writeData.String + #125: internal/store/logbundle.go:222:24: store.Store.GetLogBundleContent calls io.ReadAll, which eventually calls http.loggingConn.Read + #126: internal/store/logbundle.go:222:24: store.Store.GetLogBundleContent calls io.ReadAll, which eventually calls http.loggingConn.Read + #127: internal/osupdates/service.go:380:13: osupdates.fingerprint calls fmt.Fprintf, which calls http.loggingConn.Write + #128: internal/osupdates/service.go:380:13: osupdates.fingerprint calls fmt.Fprintf, which calls http.loggingConn.Write + #129: internal/store/logbundle.go:222:24: store.Store.GetLogBundleContent calls io.ReadAll, which eventually calls http.maxBytesReader.Read + #130: internal/store/logbundle.go:222:24: store.Store.GetLogBundleContent calls io.ReadAll, which eventually calls http.maxBytesReader.Read + #131: internal/i18n/i18n.go:118:15: i18n.Shared calls sync.Once.Do, which eventually calls http.onceCloseListener.Close + #132: internal/i18n/i18n.go:118:15: i18n.Shared calls sync.Once.Do, which eventually calls http.onceCloseListener.Close + #133: internal/store/logbundle.go:222:24: store.Store.GetLogBundleContent calls io.ReadAll, which eventually calls http.persistConn.Read + #134: internal/store/logbundle.go:222:24: store.Store.GetLogBundleContent calls io.ReadAll, which eventually calls http.persistConn.Read + #135: internal/gitea/gitea.go:241:16: gitea.Client.probe calls io.Copy, which eventually calls http.persistConnWriter.ReadFrom + #136: internal/gitea/gitea.go:241:16: gitea.Client.probe calls io.Copy, which eventually calls http.persistConnWriter.ReadFrom + #137: internal/osupdates/service.go:380:13: osupdates.fingerprint calls fmt.Fprintf, which eventually calls http.persistConnWriter.Write + #138: internal/osupdates/service.go:380:13: osupdates.fingerprint calls fmt.Fprintf, which eventually calls http.persistConnWriter.Write + #139: internal/store/logbundle.go:222:24: store.Store.GetLogBundleContent calls io.ReadAll, which calls http.readTrackingBody.Read + #140: internal/store/logbundle.go:222:24: store.Store.GetLogBundleContent calls io.ReadAll, which calls http.readTrackingBody.Read + #141: internal/store/logbundle.go:222:24: store.Store.GetLogBundleContent calls io.ReadAll, which eventually calls http.readWriteCloserBody.Read + #142: internal/store/logbundle.go:222:24: store.Store.GetLogBundleContent calls io.ReadAll, which eventually calls http.readWriteCloserBody.Read + #143: internal/gitea/gitea.go:241:16: gitea.Client.probe calls io.Copy, which eventually calls http.response.ReadFrom + #144: internal/gitea/gitea.go:241:16: gitea.Client.probe calls io.Copy, which eventually calls http.response.ReadFrom + #145: internal/web/server.go:472:10: web.Server.ServeHTTP calls http.response.Write + #146: internal/web/server.go:472:10: web.Server.ServeHTTP calls http.response.Write + #147: internal/api/handler.go:2904:15: api.Handler.handleArtifactManifest calls http.response.WriteHeader + #148: internal/api/handler.go:2904:15: api.Handler.handleArtifactManifest calls http.response.WriteHeader + #149: internal/store/logbundle.go:141:24: store.Store.SaveLogBundle calls gzip.Writer.Write, which eventually calls http.response.WriteString + #150: internal/store/logbundle.go:141:24: store.Store.SaveLogBundle calls gzip.Writer.Write, which eventually calls http.response.WriteString + #151: internal/cloudflare/reach.go:40:72: cloudflare.TokenZones calls http.transportReadFromServerError.Error + #152: internal/cloudflare/reach.go:40:72: cloudflare.TokenZones calls http.transportReadFromServerError.Error + +Vulnerability #5: GO-2026-6610 + HTTP/2 transport accepts malformed framing-related headers in net/http + More info: https://pkg.go.dev/vuln/GO-2026-6610 + Standard library + Found in: net/http@go1.26 + Fixed in: net/http@go1.26.9 + Example traces found: + #1: internal/cloudflare/reach.go:37:36: cloudflare.TokenZones calls http.Client.Do + #2: internal/cloudflare/reach.go:37:36: cloudflare.TokenZones calls http.Client.Do + +Vulnerability #6: GO-2026-6609 + Lack of limit on size of parsed Range headers in net/http + More info: https://pkg.go.dev/vuln/GO-2026-6609 + Standard library + Found in: net/http@go1.26 + Fixed in: net/http@go1.26.9 + Example traces found: + #1: internal/assets/assets.go:215:16: assets.Manager.ServeFile calls http.ServeFile + +Vulnerability #7: GO-2026-6608 + Memory limit bypass when parsing MIME headers in net/textproto, + mime/multipart + More info: https://pkg.go.dev/vuln/GO-2026-6608 + Standard library + Found in: net/textproto@go1.26 + Fixed in: net/textproto@go1.26.9 + Example traces found: + #1: internal/web/server.go:762:43: web.Server.ServeHTTP calls http.Request.FormValue, which eventually calls multipart.Reader.ReadForm + #2: internal/mailrelay/relay.go:131:30: mailrelay.FromDomain calls mail.ReadMessage, which eventually calls textproto.Reader.ReadContinuedLine + #3: internal/store/logbundle.go:222:24: store.Store.GetLogBundleContent calls io.ReadAll, which eventually calls textproto.Reader.ReadMIMEHeader + +Vulnerability #8: GO-2026-6607 + Reject malformed ECH outer extension references in crypto/tls + More info: https://pkg.go.dev/vuln/GO-2026-6607 + Standard library + Found in: crypto/tls@go1.26 + Fixed in: crypto/tls@go1.26.9 + Example traces found: + #1: cmd/hub/main.go:932:33: hub.main calls http.Server.ListenAndServe, which eventually calls tls.Conn.HandshakeContext + #2: internal/store/logbundle.go:222:24: store.Store.GetLogBundleContent calls io.ReadAll, which eventually calls tls.Conn.Read + #3: internal/osupdates/service.go:380:13: osupdates.fingerprint calls fmt.Fprintf, which calls tls.Conn.Write + #4: internal/cloudflare/reach.go:37:36: cloudflare.TokenZones calls http.Client.Do, which eventually calls tls.Dialer.DialContext + +Vulnerability #9: GO-2026-6605 + HTTP/1 client connection desynchronization after CONNECT rejection in + net/http + More info: https://pkg.go.dev/vuln/GO-2026-6605 + Standard library + Found in: net/http@go1.26 + Fixed in: net/http@go1.26.9 + Example traces found: + #1: internal/cloudflare/reach.go:37:36: cloudflare.TokenZones calls http.Client.Do + +Vulnerability #10: GO-2026-6603 + HTTP/2 server memory exhaustion due to Trailer headers in net/http + More info: https://pkg.go.dev/vuln/GO-2026-6603 + Standard library + Found in: net/http@go1.26 + Fixed in: net/http@go1.26.9 + Example traces found: + #1: internal/cloudflare/reach.go:37:36: cloudflare.TokenZones calls http.Client.Do + #2: internal/cloudflare/reach.go:37:36: cloudflare.TokenZones calls http.Client.Do + #3: internal/web/server.go:458:15: web.Server.ServeHTTP calls http.Error + #4: internal/web/server.go:458:15: web.Server.ServeHTTP calls http.Error + #5: internal/api/handler.go:2867:26: api.Handler.handleArtifactManifest calls http.Header.Get + #6: internal/api/handler.go:2867:26: api.Handler.handleArtifactManifest calls http.Header.Get + #7: internal/web/server.go:470:17: web.Server.ServeHTTP calls http.Header.Set + #8: internal/web/server.go:470:17: web.Server.ServeHTTP calls http.Header.Set + #9: internal/web/templatefetcher.go:56:29: web.TemplateFetcher.fetch calls http.NewRequest + #10: internal/web/templatefetcher.go:56:29: web.TemplateFetcher.fetch calls http.NewRequest + #11: internal/cloudflare/reach.go:32:40: cloudflare.TokenZones calls http.NewRequestWithContext + #12: internal/cloudflare/reach.go:32:40: cloudflare.TokenZones calls http.NewRequestWithContext + #13: internal/web/server.go:478:17: web.Server.ServeHTTP calls http.NotFound + #14: internal/web/server.go:478:17: web.Server.ServeHTTP calls http.NotFound + #15: internal/web/server.go:855:16: web.Server.ServeHTTP calls http.Redirect + #16: internal/web/server.go:855:16: web.Server.ServeHTTP calls http.Redirect + #17: internal/web/server.go:981:29: web.Server.validateCSRF calls http.Request.BasicAuth + #18: internal/web/server.go:981:29: web.Server.validateCSRF calls http.Request.BasicAuth + #19: internal/web/server.go:979:25: web.Server.validateCSRF calls http.Request.Cookie + #20: internal/web/server.go:979:25: web.Server.validateCSRF calls http.Request.Cookie + #21: internal/web/server.go:762:43: web.Server.ServeHTTP calls http.Request.FormValue + #22: internal/web/server.go:762:43: web.Server.ServeHTTP calls http.Request.FormValue + #23: internal/web/configs.go:1592:23: web.Server.handleSetCustomerFloor calls http.Request.ParseForm + #24: internal/web/configs.go:1592:23: web.Server.handleSetCustomerFloor calls http.Request.ParseForm + #25: internal/gitea/gitea.go:234:19: gitea.Client.probe calls http.Request.SetBasicAuth + #26: internal/gitea/gitea.go:234:19: gitea.Client.probe calls http.Request.SetBasicAuth + #27: internal/api/wait.go:73:20: api.Handler.handleWait calls http.ResponseController.Flush + #28: internal/api/wait.go:73:20: api.Handler.handleWait calls http.ResponseController.Flush + #29: internal/api/wait.go:67:25: api.Handler.handleWait calls http.ResponseController.SetWriteDeadline + #30: internal/api/wait.go:67:25: api.Handler.handleWait calls http.ResponseController.SetWriteDeadline + #31: internal/assets/assets.go:215:16: assets.Manager.ServeFile calls http.ServeFile + #32: internal/assets/assets.go:215:16: assets.Manager.ServeFile calls http.ServeFile + #33: cmd/hub/main.go:640:12: hub.main calls http.ServeMux.Handle + #34: cmd/hub/main.go:640:12: hub.main calls http.ServeMux.Handle + #35: cmd/hub/main.go:629:16: hub.main calls http.ServeMux.HandleFunc + #36: cmd/hub/main.go:629:16: hub.main calls http.ServeMux.HandleFunc + #37: cmd/hub/main.go:932:33: hub.main calls http.Server.ListenAndServe + #38: cmd/hub/main.go:932:33: hub.main calls http.Server.ListenAndServe + #39: cmd/hub/main.go:926:28: hub.main calls http.Server.Shutdown + #40: cmd/hub/main.go:926:28: hub.main calls http.Server.Shutdown + #41: internal/web/server.go:939:18: web.Server.handleLogin calls http.SetCookie + #42: internal/web/server.go:939:18: web.Server.handleLogin calls http.SetCookie + #43: internal/gitea/gitea.go:42:53: gitea.New calls http.Transport.Clone + #44: internal/gitea/gitea.go:42:53: gitea.New calls http.Transport.Clone + #45: internal/cloudflare/reach.go:42:2: cloudflare.TokenZones calls http.body.Close + #46: internal/cloudflare/reach.go:42:2: cloudflare.TokenZones calls http.body.Close + #47: internal/store/logbundle.go:222:24: store.Store.GetLogBundleContent calls io.ReadAll, which calls http.body.Read + #48: internal/store/logbundle.go:222:24: store.Store.GetLogBundleContent calls io.ReadAll, which calls http.body.Read + #49: internal/cloudflare/reach.go:42:2: cloudflare.TokenZones calls http.bodyEOFSignal.Close + #50: internal/cloudflare/reach.go:42:2: cloudflare.TokenZones calls http.bodyEOFSignal.Close + #51: internal/store/logbundle.go:222:24: store.Store.GetLogBundleContent calls io.ReadAll, which eventually calls http.bodyEOFSignal.Read + #52: internal/store/logbundle.go:222:24: store.Store.GetLogBundleContent calls io.ReadAll, which eventually calls http.bodyEOFSignal.Read + #53: internal/store/logbundle.go:222:24: store.Store.GetLogBundleContent calls io.ReadAll, which eventually calls http.bodyLocked.Read + #54: internal/store/logbundle.go:222:24: store.Store.GetLogBundleContent calls io.ReadAll, which eventually calls http.bodyLocked.Read + #55: internal/gitea/gitea.go:241:16: gitea.Client.probe calls io.Copy, which eventually calls http.bufioFlushWriter.Write + #56: internal/gitea/gitea.go:241:16: gitea.Client.probe calls io.Copy, which eventually calls http.bufioFlushWriter.Write + #57: internal/cloudflare/reach.go:42:2: cloudflare.TokenZones calls http.cancelTimerBody.Close + #58: internal/cloudflare/reach.go:42:2: cloudflare.TokenZones calls http.cancelTimerBody.Close + #59: internal/store/logbundle.go:222:24: store.Store.GetLogBundleContent calls io.ReadAll, which eventually calls http.cancelTimerBody.Read + #60: internal/store/logbundle.go:222:24: store.Store.GetLogBundleContent calls io.ReadAll, which eventually calls http.cancelTimerBody.Read + #61: internal/osupdates/service.go:380:13: osupdates.fingerprint calls fmt.Fprintf, which eventually calls http.checkConnErrorWriter.Write + #62: internal/osupdates/service.go:380:13: osupdates.fingerprint calls fmt.Fprintf, which eventually calls http.checkConnErrorWriter.Write + #63: internal/osupdates/service.go:380:13: osupdates.fingerprint calls fmt.Fprintf, which eventually calls http.chunkWriter.Write + #64: internal/osupdates/service.go:380:13: osupdates.fingerprint calls fmt.Fprintf, which eventually calls http.chunkWriter.Write + #65: internal/store/logbundle.go:222:24: store.Store.GetLogBundleContent calls io.ReadAll, which eventually calls http.connReader.Read + #66: internal/store/logbundle.go:222:24: store.Store.GetLogBundleContent calls io.ReadAll, which eventually calls http.connReader.Read + #67: internal/store/logbundle.go:222:24: store.Store.GetLogBundleContent calls io.ReadAll, which calls http.expectContinueReader.Read + #68: internal/store/logbundle.go:222:24: store.Store.GetLogBundleContent calls io.ReadAll, which calls http.expectContinueReader.Read + #69: internal/cloudflare/reach.go:42:2: cloudflare.TokenZones calls http.gzipReader.Close + #70: internal/cloudflare/reach.go:42:2: cloudflare.TokenZones calls http.gzipReader.Close + #71: internal/store/logbundle.go:222:24: store.Store.GetLogBundleContent calls io.ReadAll, which eventually calls http.gzipReader.Read + #72: internal/store/logbundle.go:222:24: store.Store.GetLogBundleContent calls io.ReadAll, which eventually calls http.gzipReader.Read + #73: internal/cloudflare/reach.go:40:72: cloudflare.TokenZones calls http.http2ConnectionError.Error + #74: internal/cloudflare/reach.go:40:72: cloudflare.TokenZones calls http.http2ConnectionError.Error + #75: cmd/hubdb-check/main.go:62:15: hubdb.main calls fmt.Fprintln, which eventually calls http.http2ErrCode.String + #76: cmd/hubdb-check/main.go:62:15: hubdb.main calls fmt.Fprintln, which eventually calls http.http2ErrCode.String + #77: cmd/hubdb-check/main.go:62:15: hubdb.main calls fmt.Fprintln, which eventually calls http.http2FrameHeader.String + #78: cmd/hubdb-check/main.go:62:15: hubdb.main calls fmt.Fprintln, which eventually calls http.http2FrameHeader.String + #79: cmd/hubdb-check/main.go:62:15: hubdb.main calls fmt.Fprintln, which eventually calls http.http2FrameType.String + #80: cmd/hubdb-check/main.go:62:15: hubdb.main calls fmt.Fprintln, which eventually calls http.http2FrameType.String + #81: cmd/hubdb-check/main.go:62:15: hubdb.main calls fmt.Fprintln, which eventually calls http.http2FrameWriteRequest.String + #82: cmd/hubdb-check/main.go:62:15: hubdb.main calls fmt.Fprintln, which eventually calls http.http2FrameWriteRequest.String + #83: internal/cloudflare/reach.go:40:72: cloudflare.TokenZones calls http.http2GoAwayError.Error + #84: internal/cloudflare/reach.go:40:72: cloudflare.TokenZones calls http.http2GoAwayError.Error + #85: cmd/hubdb-check/main.go:62:15: hubdb.main calls fmt.Fprintln, which eventually calls http.http2Setting.String + #86: cmd/hubdb-check/main.go:62:15: hubdb.main calls fmt.Fprintln, which eventually calls http.http2Setting.String + #87: cmd/hubdb-check/main.go:62:15: hubdb.main calls fmt.Fprintln, which eventually calls http.http2SettingID.String + #88: cmd/hubdb-check/main.go:62:15: hubdb.main calls fmt.Fprintln, which eventually calls http.http2SettingID.String + #89: internal/cloudflare/reach.go:40:72: cloudflare.TokenZones calls http.http2StreamError.Error + #90: internal/cloudflare/reach.go:40:72: cloudflare.TokenZones calls http.http2StreamError.Error + #91: internal/osupdates/service.go:380:13: osupdates.fingerprint calls fmt.Fprintf, which eventually calls http.http2bufferedWriterTimeoutWriter.Write + #92: internal/osupdates/service.go:380:13: osupdates.fingerprint calls fmt.Fprintf, which eventually calls http.http2bufferedWriterTimeoutWriter.Write + #93: internal/osupdates/service.go:380:13: osupdates.fingerprint calls fmt.Fprintf, which eventually calls http.http2chunkWriter.Write + #94: internal/osupdates/service.go:380:13: osupdates.fingerprint calls fmt.Fprintf, which eventually calls http.http2chunkWriter.Write + #95: internal/cloudflare/reach.go:40:72: cloudflare.TokenZones calls http.http2connError.Error + #96: internal/cloudflare/reach.go:40:72: cloudflare.TokenZones calls http.http2connError.Error + #97: internal/cloudflare/reach.go:40:72: cloudflare.TokenZones calls http.http2duplicatePseudoHeaderError.Error + #98: internal/cloudflare/reach.go:40:72: cloudflare.TokenZones calls http.http2duplicatePseudoHeaderError.Error + #99: internal/cloudflare/reach.go:42:2: cloudflare.TokenZones calls http.http2gzipReader.Close + #100: internal/cloudflare/reach.go:42:2: cloudflare.TokenZones calls http.http2gzipReader.Close + #101: internal/store/logbundle.go:222:24: store.Store.GetLogBundleContent calls io.ReadAll, which eventually calls http.http2gzipReader.Read + #102: internal/store/logbundle.go:222:24: store.Store.GetLogBundleContent calls io.ReadAll, which eventually calls http.http2gzipReader.Read + #103: internal/cloudflare/reach.go:40:72: cloudflare.TokenZones calls http.http2headerFieldNameError.Error + #104: internal/cloudflare/reach.go:40:72: cloudflare.TokenZones calls http.http2headerFieldNameError.Error + #105: internal/cloudflare/reach.go:40:72: cloudflare.TokenZones calls http.http2headerFieldValueError.Error + #106: internal/cloudflare/reach.go:40:72: cloudflare.TokenZones calls http.http2headerFieldValueError.Error + #107: internal/cloudflare/reach.go:40:72: cloudflare.TokenZones calls http.http2pseudoHeaderError.Error + #108: internal/cloudflare/reach.go:40:72: cloudflare.TokenZones calls http.http2pseudoHeaderError.Error + #109: internal/store/logbundle.go:222:24: store.Store.GetLogBundleContent calls io.ReadAll, which calls http.http2requestBody.Read + #110: internal/store/logbundle.go:222:24: store.Store.GetLogBundleContent calls io.ReadAll, which calls http.http2requestBody.Read + #111: internal/web/server.go:472:10: web.Server.ServeHTTP calls http.http2responseWriter.Write + #112: internal/web/server.go:472:10: web.Server.ServeHTTP calls http.http2responseWriter.Write + #113: internal/api/handler.go:2904:15: api.Handler.handleArtifactManifest calls http.http2responseWriter.WriteHeader + #114: internal/api/handler.go:2904:15: api.Handler.handleArtifactManifest calls http.http2responseWriter.WriteHeader + #115: internal/store/logbundle.go:141:24: store.Store.SaveLogBundle calls gzip.Writer.Write, which eventually calls http.http2responseWriter.WriteString + #116: internal/store/logbundle.go:141:24: store.Store.SaveLogBundle calls gzip.Writer.Write, which eventually calls http.http2responseWriter.WriteString + #117: internal/osupdates/service.go:380:13: osupdates.fingerprint calls fmt.Fprintf, which eventually calls http.http2stickyErrWriter.Write + #118: internal/osupdates/service.go:380:13: osupdates.fingerprint calls fmt.Fprintf, which eventually calls http.http2stickyErrWriter.Write + #119: internal/cloudflare/reach.go:42:2: cloudflare.TokenZones calls http.http2transportResponseBody.Close + #120: internal/cloudflare/reach.go:42:2: cloudflare.TokenZones calls http.http2transportResponseBody.Close + #121: internal/store/logbundle.go:222:24: store.Store.GetLogBundleContent calls io.ReadAll, which eventually calls http.http2transportResponseBody.Read + #122: internal/store/logbundle.go:222:24: store.Store.GetLogBundleContent calls io.ReadAll, which eventually calls http.http2transportResponseBody.Read + #123: cmd/hubdb-check/main.go:62:15: hubdb.main calls fmt.Fprintln, which eventually calls http.http2writeData.String + #124: cmd/hubdb-check/main.go:62:15: hubdb.main calls fmt.Fprintln, which eventually calls http.http2writeData.String + #125: internal/store/logbundle.go:222:24: store.Store.GetLogBundleContent calls io.ReadAll, which eventually calls http.loggingConn.Read + #126: internal/store/logbundle.go:222:24: store.Store.GetLogBundleContent calls io.ReadAll, which eventually calls http.loggingConn.Read + #127: internal/osupdates/service.go:380:13: osupdates.fingerprint calls fmt.Fprintf, which calls http.loggingConn.Write + #128: internal/osupdates/service.go:380:13: osupdates.fingerprint calls fmt.Fprintf, which calls http.loggingConn.Write + #129: internal/store/logbundle.go:222:24: store.Store.GetLogBundleContent calls io.ReadAll, which eventually calls http.maxBytesReader.Read + #130: internal/store/logbundle.go:222:24: store.Store.GetLogBundleContent calls io.ReadAll, which eventually calls http.maxBytesReader.Read + #131: internal/i18n/i18n.go:118:15: i18n.Shared calls sync.Once.Do, which eventually calls http.onceCloseListener.Close + #132: internal/i18n/i18n.go:118:15: i18n.Shared calls sync.Once.Do, which eventually calls http.onceCloseListener.Close + #133: internal/store/logbundle.go:222:24: store.Store.GetLogBundleContent calls io.ReadAll, which eventually calls http.persistConn.Read + #134: internal/store/logbundle.go:222:24: store.Store.GetLogBundleContent calls io.ReadAll, which eventually calls http.persistConn.Read + #135: internal/gitea/gitea.go:241:16: gitea.Client.probe calls io.Copy, which eventually calls http.persistConnWriter.ReadFrom + #136: internal/gitea/gitea.go:241:16: gitea.Client.probe calls io.Copy, which eventually calls http.persistConnWriter.ReadFrom + #137: internal/osupdates/service.go:380:13: osupdates.fingerprint calls fmt.Fprintf, which eventually calls http.persistConnWriter.Write + #138: internal/osupdates/service.go:380:13: osupdates.fingerprint calls fmt.Fprintf, which eventually calls http.persistConnWriter.Write + #139: internal/store/logbundle.go:222:24: store.Store.GetLogBundleContent calls io.ReadAll, which calls http.readTrackingBody.Read + #140: internal/store/logbundle.go:222:24: store.Store.GetLogBundleContent calls io.ReadAll, which calls http.readTrackingBody.Read + #141: internal/store/logbundle.go:222:24: store.Store.GetLogBundleContent calls io.ReadAll, which eventually calls http.readWriteCloserBody.Read + #142: internal/store/logbundle.go:222:24: store.Store.GetLogBundleContent calls io.ReadAll, which eventually calls http.readWriteCloserBody.Read + #143: internal/gitea/gitea.go:241:16: gitea.Client.probe calls io.Copy, which eventually calls http.response.ReadFrom + #144: internal/gitea/gitea.go:241:16: gitea.Client.probe calls io.Copy, which eventually calls http.response.ReadFrom + #145: internal/web/server.go:472:10: web.Server.ServeHTTP calls http.response.Write + #146: internal/web/server.go:472:10: web.Server.ServeHTTP calls http.response.Write + #147: internal/api/handler.go:2904:15: api.Handler.handleArtifactManifest calls http.response.WriteHeader + #148: internal/api/handler.go:2904:15: api.Handler.handleArtifactManifest calls http.response.WriteHeader + #149: internal/store/logbundle.go:141:24: store.Store.SaveLogBundle calls gzip.Writer.Write, which eventually calls http.response.WriteString + #150: internal/store/logbundle.go:141:24: store.Store.SaveLogBundle calls gzip.Writer.Write, which eventually calls http.response.WriteString + #151: internal/cloudflare/reach.go:40:72: cloudflare.TokenZones calls http.transportReadFromServerError.Error + #152: internal/cloudflare/reach.go:40:72: cloudflare.TokenZones calls http.transportReadFromServerError.Error + +Vulnerability #11: GO-2026-6600 + Recognize yield as regexp preceder keyword in html/template + More info: https://pkg.go.dev/vuln/GO-2026-6600 + Standard library + Found in: html/template@go1.26 + Fixed in: html/template@go1.26.9 + Example traces found: + #1: internal/web/selfbind.go:146:24: web.Server.renderBind calls template.Template.Execute + #2: internal/web/server.go:1205:39: web.Server.handleConfiguration calls template.Template.ExecuteTemplate + +Vulnerability #12: GO-2026-6599 + Reset context tracking on consecutive template expressions in html/template + More info: https://pkg.go.dev/vuln/GO-2026-6599 + Standard library + Found in: html/template@go1.26 + Fixed in: html/template@go1.26.9 + Example traces found: + #1: internal/web/selfbind.go:146:24: web.Server.renderBind calls template.Template.Execute + #2: internal/web/server.go:1205:39: web.Server.handleConfiguration calls template.Template.ExecuteTemplate + +Vulnerability #13: GO-2026-6355 + Prevent DoS on deadlocked established channel in golang.org/x/crypto/ssh + More info: https://pkg.go.dev/vuln/GO-2026-6355 + Module: golang.org/x/crypto + Found in: golang.org/x/crypto@v0.31.0 + Fixed in: golang.org/x/crypto@v0.56.0 + Example traces found: + #1: internal/poke/client.go:106:46: poke.Client.Poke calls ssh.NewClientConn + +Vulnerability #14: GO-2026-6354 + Prevent DoS on deadlocked undecided channel in golang.org/x/crypto/ssh + More info: https://pkg.go.dev/vuln/GO-2026-6354 + Module: golang.org/x/crypto + Found in: golang.org/x/crypto@v0.31.0 + Fixed in: golang.org/x/crypto@v0.56.0 + Example traces found: + #1: internal/poke/client.go:106:46: poke.Client.Poke calls ssh.NewClientConn + +Vulnerability #15: GO-2026-6218 + Avoid quadratic complexity in resolvePath in net/url + More info: https://pkg.go.dev/vuln/GO-2026-6218 + Standard library + Found in: net/url@go1.26 + Fixed in: net/url@go1.26.6 + Example traces found: + #1: internal/cloudflare/reach.go:37:36: cloudflare.TokenZones calls http.Client.Do, which eventually calls url.URL.Parse + +Vulnerability #16: GO-2026-6091 + Fix Javascript regexp context tracking in html/template + More info: https://pkg.go.dev/vuln/GO-2026-6091 + Standard library + Found in: html/template@go1.26 + Fixed in: html/template@go1.26.6 + Example traces found: + #1: internal/web/selfbind.go:146:24: web.Server.renderBind calls template.Template.Execute + #2: internal/web/server.go:1205:39: web.Server.handleConfiguration calls template.Template.ExecuteTemplate + +Vulnerability #17: GO-2026-6090 + Limit handshake messages we are willing to accept post-handshake in + crypto/tls + More info: https://pkg.go.dev/vuln/GO-2026-6090 + Standard library + Found in: crypto/tls@go1.26 + Fixed in: crypto/tls@go1.26.6 + Example traces found: + #1: cmd/hub/main.go:932:33: hub.main calls http.Server.ListenAndServe, which eventually calls tls.Conn.HandshakeContext + #2: internal/store/logbundle.go:222:24: store.Store.GetLogBundleContent calls io.ReadAll, which eventually calls tls.Conn.Read + #3: internal/osupdates/service.go:380:13: osupdates.fingerprint calls fmt.Fprintf, which calls tls.Conn.Write + #4: internal/cloudflare/reach.go:37:36: cloudflare.TokenZones calls http.Client.Do, which eventually calls tls.Dialer.DialContext + +Vulnerability #18: GO-2026-6089 + Apply ReadHeaderTimeout when doing unencrypted HTTP/2 check in net/http + More info: https://pkg.go.dev/vuln/GO-2026-6089 + Standard library + Found in: net/http@go1.26 + Fixed in: net/http@go1.26.6 + Example traces found: + #1: cmd/hub/main.go:932:33: hub.main calls http.Server.ListenAndServe + +Vulnerability #19: GO-2026-5972 + Enforce maximum recursion depth in encoding/asn1 + More info: https://pkg.go.dev/vuln/GO-2026-5972 + Standard library + Found in: encoding/asn1@go1.26 + Fixed in: encoding/asn1@go1.26.6 + Example traces found: + #1: internal/tenantsync/client.go:78:36: tenantsync.New calls ssh.ParsePrivateKey, which eventually calls asn1.Unmarshal + +Vulnerability #20: GO-2026-5856 + Invoking Encrypted Client Hello privacy leak in crypto/tls + More info: https://pkg.go.dev/vuln/GO-2026-5856 + Standard library + Found in: crypto/tls@go1.26 + Fixed in: crypto/tls@go1.26.5 + Example traces found: + #1: cmd/hub/main.go:932:33: hub.main calls http.Server.ListenAndServe, which eventually calls tls.Conn.HandshakeContext + #2: internal/store/logbundle.go:222:24: store.Store.GetLogBundleContent calls io.ReadAll, which eventually calls tls.Conn.Read + #3: internal/osupdates/service.go:380:13: osupdates.fingerprint calls fmt.Fprintf, which calls tls.Conn.Write + #4: internal/cloudflare/reach.go:37:36: cloudflare.TokenZones calls http.Client.Do, which eventually calls tls.Dialer.DialContext + +Vulnerability #21: GO-2026-5039 + Arbitrary inputs are included in errors without any escaping in + net/textproto + More info: https://pkg.go.dev/vuln/GO-2026-5039 + Standard library + Found in: net/textproto@go1.26 + Fixed in: net/textproto@go1.26.4 + Example traces found: + #1: cmd/hubdb-check/main.go:62:15: hubdb.main calls fmt.Fprintln, which eventually calls textproto.Error.Error + #2: internal/store/logbundle.go:222:24: store.Store.GetLogBundleContent calls io.ReadAll, which eventually calls textproto.Reader.ReadMIMEHeader + #3: internal/mailrelay/relay.go:59:26: mailrelay.ResendSMTP.Send calls smtp.NewClient, which calls textproto.Reader.ReadResponse + +Vulnerability #22: GO-2026-5037 + Inefficient candidate hostname parsing in crypto/x509 + More info: https://pkg.go.dev/vuln/GO-2026-5037 + Standard library + Found in: crypto/x509@go1.26 + Fixed in: crypto/x509@go1.26.4 + Example traces found: + #1: cmd/hub/main.go:932:33: hub.main calls http.Server.ListenAndServe, which eventually calls x509.Certificate.Verify + #2: cmd/hub/main.go:932:33: hub.main calls http.Server.ListenAndServe, which eventually calls x509.Certificate.VerifyHostname + #3: cmd/hubdb-check/main.go:62:15: hubdb.main calls fmt.Fprintln, which eventually calls x509.HostnameError.Error + +Vulnerability #23: GO-2026-5026 + Invoking failure to reject ASCII-only Punycode-encoded labels in + golang.org/x/net/idna + More info: https://pkg.go.dev/vuln/GO-2026-5026 + Standard library + Found in: net/http@go1.26 + Fixed in: net/http@go1.26.6 + Example traces found: + #1: internal/cloudflare/reach.go:37:36: cloudflare.TokenZones calls http.Client.Do + +Vulnerability #24: GO-2026-5020 + Invoking infinite loop on large channel writes in golang.org/x/crypto/ssh + More info: https://pkg.go.dev/vuln/GO-2026-5020 + Module: golang.org/x/crypto + Found in: golang.org/x/crypto@v0.31.0 + Fixed in: golang.org/x/crypto@v0.52.0 + Example traces found: + #1: internal/poke/client.go:106:46: poke.Client.Poke calls ssh.NewClientConn + #2: internal/poke/client.go:129:23: poke.Client.Poke calls ssh.Session.Run + #3: internal/gitea/gitea.go:241:16: gitea.Client.probe calls io.Copy, which eventually calls ssh.channel.Write + +Vulnerability #25: GO-2026-5019 + Invoking bypass of FIDO/U2F security keys physical interaction in + golang.org/x/crypto/ssh + More info: https://pkg.go.dev/vuln/GO-2026-5019 + Module: golang.org/x/crypto + Found in: golang.org/x/crypto@v0.31.0 + Fixed in: golang.org/x/crypto@v0.52.0 + Example traces found: + #1: internal/poke/client.go:106:46: poke.Client.Poke calls ssh.NewClientConn + +Vulnerability #26: GO-2026-5018 + Invoking pathological RSA/DSA parameters may cause DoS in + golang.org/x/crypto/ssh + More info: https://pkg.go.dev/vuln/GO-2026-5018 + Module: golang.org/x/crypto + Found in: golang.org/x/crypto@v0.31.0 + Fixed in: golang.org/x/crypto@v0.52.0 + Example traces found: + #1: internal/poke/client.go:106:46: poke.Client.Poke calls ssh.NewClientConn + #2: internal/offsitekeys/offsitekeys.go:100:50: offsitekeys.KeyFingerprint calls ssh.ParseAuthorizedKey + #3: internal/tenantsync/client.go:78:36: tenantsync.New calls ssh.ParsePrivateKey + +Vulnerability #27: GO-2026-5017 + Invoking client can cause server deadlock on unexpected responses in + golang.org/x/crypto/ssh + More info: https://pkg.go.dev/vuln/GO-2026-5017 + Module: golang.org/x/crypto + Found in: golang.org/x/crypto@v0.31.0 + Fixed in: golang.org/x/crypto@v0.52.0 + Example traces found: + #1: internal/poke/client.go:106:46: poke.Client.Poke calls ssh.NewClientConn + #2: internal/poke/client.go:129:23: poke.Client.Poke calls ssh.Session.Run + +Vulnerability #28: GO-2026-5013 + Invoking byte arithmetic causes underflow and panic in + golang.org/x/crypto/ssh + More info: https://pkg.go.dev/vuln/GO-2026-5013 + Module: golang.org/x/crypto + Found in: golang.org/x/crypto@v0.31.0 + Fixed in: golang.org/x/crypto@v0.52.0 + Example traces found: + #1: internal/poke/client.go:106:46: poke.Client.Poke calls ssh.NewClientConn + +Vulnerability #29: GO-2026-4986 + Quadratic string concatentation in consumeComment in net/mail + More info: https://pkg.go.dev/vuln/GO-2026-4986 + Standard library + Found in: net/mail@go1.26 + Fixed in: net/mail@go1.26.3 + Example traces found: + #1: internal/mailrelay/relay.go:139:32: mailrelay.FromDomain calls mail.ParseAddress + #2: internal/mailrelay/relay.go:141:38: mailrelay.FromDomain calls mail.ParseAddressList + +Vulnerability #30: GO-2026-4982 + Bypass of meta content URL escaping causes XSS in html/template + More info: https://pkg.go.dev/vuln/GO-2026-4982 + Standard library + Found in: html/template@go1.26 + Fixed in: html/template@go1.26.3 + Example traces found: + #1: internal/web/selfbind.go:146:24: web.Server.renderBind calls template.Template.Execute + #2: internal/web/server.go:1205:39: web.Server.handleConfiguration calls template.Template.ExecuteTemplate + +Vulnerability #31: GO-2026-4980 + Escaper bypass leads to XSS in html/template + More info: https://pkg.go.dev/vuln/GO-2026-4980 + Standard library + Found in: html/template@go1.26 + Fixed in: html/template@go1.26.3 + Example traces found: + #1: internal/web/selfbind.go:146:24: web.Server.renderBind calls template.Template.Execute + #2: internal/web/server.go:1205:39: web.Server.handleConfiguration calls template.Template.ExecuteTemplate + +Vulnerability #32: GO-2026-4977 + Quadratic string concatenation in consumePhrase in net/mail + More info: https://pkg.go.dev/vuln/GO-2026-4977 + Standard library + Found in: net/mail@go1.26 + Fixed in: net/mail@go1.26.3 + Example traces found: + #1: internal/mailrelay/relay.go:139:32: mailrelay.FromDomain calls mail.ParseAddress + #2: internal/mailrelay/relay.go:141:38: mailrelay.FromDomain calls mail.ParseAddressList + +Vulnerability #33: GO-2026-4971 + Panic in Dial and LookupPort when handling NUL byte on Windows in net + More info: https://pkg.go.dev/vuln/GO-2026-4971 + Standard library + Found in: net@go1.26 + Fixed in: net@go1.26.3 + Example traces found: + #1: internal/poke/client.go:97:33: poke.Client.Poke calls net.Dialer.DialContext + #2: cmd/hub/main.go:932:33: hub.main calls http.Server.ListenAndServe, which calls net.Listen + +Vulnerability #34: GO-2026-4947 + Unexpected work during chain building in crypto/x509 + More info: https://pkg.go.dev/vuln/GO-2026-4947 + Standard library + Found in: crypto/x509@go1.26 + Fixed in: crypto/x509@go1.26.2 + Example traces found: + #1: cmd/hub/main.go:932:33: hub.main calls http.Server.ListenAndServe, which eventually calls x509.Certificate.Verify + +Vulnerability #35: GO-2026-4946 + Inefficient policy validation in crypto/x509 + More info: https://pkg.go.dev/vuln/GO-2026-4946 + Standard library + Found in: crypto/x509@go1.26 + Fixed in: crypto/x509@go1.26.2 + Example traces found: + #1: cmd/hub/main.go:932:33: hub.main calls http.Server.ListenAndServe, which eventually calls x509.Certificate.Verify + +Vulnerability #36: GO-2026-4918 + Infinite loop in HTTP/2 transport when given bad SETTINGS_MAX_FRAME_SIZE in + net/http/internal/http2 in golang.org/x/net + More info: https://pkg.go.dev/vuln/GO-2026-4918 + Standard library + Found in: net/http@go1.26 + Fixed in: net/http@go1.26.3 + Example traces found: + #1: internal/cloudflare/reach.go:37:36: cloudflare.TokenZones calls http.Client.Do + +Vulnerability #37: GO-2026-4870 + Unauthenticated TLS 1.3 KeyUpdate record can cause persistent connection + retention and DoS in crypto/tls + More info: https://pkg.go.dev/vuln/GO-2026-4870 + Standard library + Found in: crypto/tls@go1.26 + Fixed in: crypto/tls@go1.26.2 + Example traces found: + #1: cmd/hub/main.go:932:33: hub.main calls http.Server.ListenAndServe, which eventually calls tls.Conn.HandshakeContext + #2: internal/store/logbundle.go:222:24: store.Store.GetLogBundleContent calls io.ReadAll, which eventually calls tls.Conn.Read + #3: internal/osupdates/service.go:380:13: osupdates.fingerprint calls fmt.Fprintf, which calls tls.Conn.Write + #4: internal/cloudflare/reach.go:37:36: cloudflare.TokenZones calls http.Client.Do, which eventually calls tls.Dialer.DialContext + +Vulnerability #38: GO-2026-4866 + Case-sensitive excludedSubtrees name constraints cause Auth Bypass in + crypto/x509 + More info: https://pkg.go.dev/vuln/GO-2026-4866 + Standard library + Found in: crypto/x509@go1.26 + Fixed in: crypto/x509@go1.26.2 + Example traces found: + #1: cmd/hub/main.go:932:33: hub.main calls http.Server.ListenAndServe, which eventually calls x509.Certificate.Verify + +Vulnerability #39: GO-2026-4865 + JsBraceDepth Context Tracking Bugs (XSS) in html/template + More info: https://pkg.go.dev/vuln/GO-2026-4865 + Standard library + Found in: html/template@go1.26 + Fixed in: html/template@go1.26.2 + Example traces found: + #1: cmd/hubdb-check/main.go:62:15: hubdb.main calls fmt.Fprintln, which eventually calls template.Error.Error + #2: internal/web/selfbind.go:146:24: web.Server.renderBind calls template.Template.Execute + #3: internal/web/server.go:1205:39: web.Server.handleConfiguration calls template.Template.ExecuteTemplate + #4: internal/web/server.go:169:46: web.New calls template.Template.Funcs + #5: internal/web/selfbind.go:129:63: web.buildBindTemplates calls template.Template.Parse + #6: internal/web/server.go:169:63: web.New calls template.Template.ParseFS + #7: cmd/hubdb-check/main.go:62:15: hubdb.main calls fmt.Fprintln, which eventually calls template.context.String + +Vulnerability #40: GO-2026-4603 + URLs in meta content attribute actions are not escaped in html/template + More info: https://pkg.go.dev/vuln/GO-2026-4603 + Standard library + Found in: html/template@go1.26 + Fixed in: html/template@go1.26.1 + Example traces found: + #1: internal/web/selfbind.go:146:24: web.Server.renderBind calls template.Template.Execute + #2: internal/web/server.go:1205:39: web.Server.handleConfiguration calls template.Template.ExecuteTemplate + +Vulnerability #41: GO-2026-4602 + FileInfo can escape from a Root in os + More info: https://pkg.go.dev/vuln/GO-2026-4602 + Standard library + Found in: os@go1.26 + Fixed in: os@go1.26.1 + Example traces found: + #1: internal/assets/assets.go:215:16: assets.Manager.ServeFile calls http.ServeFile, which eventually calls os.File.ReadDir + #2: internal/assets/assets.go:215:16: assets.Manager.ServeFile calls http.ServeFile, which eventually calls os.File.Readdir + #3: internal/dbsnap/dbsnap.go:112:26: dbsnap.List calls os.ReadDir + +Vulnerability #42: GO-2026-4601 + Incorrect parsing of IPv6 host literals in net/url + More info: https://pkg.go.dev/vuln/GO-2026-4601 + Standard library + Found in: net/url@go1.26 + Fixed in: net/url@go1.26.1 + Example traces found: + #1: internal/web/server.go:855:16: web.Server.ServeHTTP calls http.Redirect, which calls url.Parse + #2: cmd/hub/main.go:932:33: hub.main calls http.Server.ListenAndServe, which eventually calls url.ParseRequestURI + #3: internal/cloudflare/reach.go:37:36: cloudflare.TokenZones calls http.Client.Do, which eventually calls url.URL.Parse + +Vulnerability #43: GO-2026-4600 + Panic in name constraint checking for malformed certificates in crypto/x509 + More info: https://pkg.go.dev/vuln/GO-2026-4600 + Standard library + Found in: crypto/x509@go1.26 + Fixed in: crypto/x509@go1.26.1 + Example traces found: + #1: cmd/hub/main.go:932:33: hub.main calls http.Server.ListenAndServe, which eventually calls x509.Certificate.Verify + +Vulnerability #44: GO-2026-4599 + Incorrect enforcement of email constraints in crypto/x509 + More info: https://pkg.go.dev/vuln/GO-2026-4599 + Standard library + Found in: crypto/x509@go1.26 + Fixed in: crypto/x509@go1.26.1 + Example traces found: + #1: cmd/hub/main.go:932:33: hub.main calls http.Server.ListenAndServe, which eventually calls x509.Certificate.Verify + +Vulnerability #45: GO-2025-3487 + Potential denial of service in golang.org/x/crypto + More info: https://pkg.go.dev/vuln/GO-2025-3487 + Module: golang.org/x/crypto + Found in: golang.org/x/crypto@v0.31.0 + Fixed in: golang.org/x/crypto@v0.35.0 + Example traces found: + #1: internal/poke/client.go:118:35: poke.Client.Poke calls ssh.Client.NewSession + #2: internal/poke/client.go:111:25: poke.Client.Poke calls ssh.NewClient + #3: internal/poke/client.go:106:46: poke.Client.Poke calls ssh.NewClientConn + #4: internal/poke/client.go:122:2: poke.Client.Poke calls ssh.Session.Close + #5: internal/poke/client.go:129:23: poke.Client.Poke calls ssh.Session.Run + #6: internal/store/store.go:1549:19: store.Store.Close calls sql.DB.Close, which eventually calls ssh.channel.CloseWrite + #7: internal/store/logbundle.go:222:24: store.Store.GetLogBundleContent calls io.ReadAll, which eventually calls ssh.channel.Read + #8: internal/gitea/gitea.go:241:16: gitea.Client.probe calls io.Copy, which eventually calls ssh.channel.Write + #9: internal/store/logbundle.go:222:24: store.Store.GetLogBundleContent calls io.ReadAll, which eventually calls ssh.extChannel.Read + +Your code is affected by 45 vulnerabilities from 1 module and the Go standard library. +This scan also found 12 vulnerabilities in packages you import and 11 +vulnerabilities in modules you require, but your code doesn't appear to call +these vulnerabilities. +Use '-show verbose' for more details. diff --git a/documentation/audits/security-review-2026-10-12/scanners/trivy-cloudflare_cloudflared_2026.9.3.json.gz b/documentation/audits/security-review-2026-10-12/scanners/trivy-cloudflare_cloudflared_2026.9.3.json.gz new file mode 100644 index 00000000..88eb3991 Binary files /dev/null and b/documentation/audits/security-review-2026-10-12/scanners/trivy-cloudflare_cloudflared_2026.9.3.json.gz differ diff --git a/documentation/audits/security-review-2026-10-12/scanners/trivy-gitea.dooplex.hu_admin_felhom-controller_0.307.0.json.gz b/documentation/audits/security-review-2026-10-12/scanners/trivy-gitea.dooplex.hu_admin_felhom-controller_0.307.0.json.gz new file mode 100644 index 00000000..b4a7f6b9 Binary files /dev/null and b/documentation/audits/security-review-2026-10-12/scanners/trivy-gitea.dooplex.hu_admin_felhom-controller_0.307.0.json.gz differ diff --git a/documentation/audits/security-review-2026-10-12/scanners/trivy-gitea.dooplex.hu_admin_felhom-hub_0.146.0.json.gz b/documentation/audits/security-review-2026-10-12/scanners/trivy-gitea.dooplex.hu_admin_felhom-hub_0.146.0.json.gz new file mode 100644 index 00000000..05bb7329 Binary files /dev/null and b/documentation/audits/security-review-2026-10-12/scanners/trivy-gitea.dooplex.hu_admin_felhom-hub_0.146.0.json.gz differ diff --git a/documentation/audits/security-review-2026-10-12/scanners/trivy-gitea.dooplex.hu_admin_felhom-samba_1.1.0.json.gz b/documentation/audits/security-review-2026-10-12/scanners/trivy-gitea.dooplex.hu_admin_felhom-samba_1.1.0.json.gz new file mode 100644 index 00000000..b6e3b491 Binary files /dev/null and b/documentation/audits/security-review-2026-10-12/scanners/trivy-gitea.dooplex.hu_admin_felhom-samba_1.1.0.json.gz differ diff --git a/documentation/audits/security-review-2026-10-12/scanners/trivy-gtstef_filebrowser_1.5.6-stable.json.gz b/documentation/audits/security-review-2026-10-12/scanners/trivy-gtstef_filebrowser_1.5.6-stable.json.gz new file mode 100644 index 00000000..1a8b771d Binary files /dev/null and b/documentation/audits/security-review-2026-10-12/scanners/trivy-gtstef_filebrowser_1.5.6-stable.json.gz differ diff --git a/documentation/audits/security-review-2026-10-12/scanners/trivy-summary.txt b/documentation/audits/security-review-2026-10-12/scanners/trivy-summary.txt new file mode 100644 index 00000000..5a264338 --- /dev/null +++ b/documentation/audits/security-review-2026-10-12/scanners/trivy-summary.txt @@ -0,0 +1,82 @@ +=== cloudflare/cloudflared:2026.9.3 13.7 debian + cloudflare/cloudflared:2026.9.3 (debian 13.7) debian all={'MEDIUM': 25, 'LOW': 10, 'HIGH': 1} fixable={'HIGH': 1, 'MEDIUM': 10, 'LOW': 2} + usr/local/bin/cloudflared gobinary all={'MEDIUM': 9, 'UNKNOWN': 7, 'HIGH': 4, 'LOW': 1} fixable={'MEDIUM': 9, 'HIGH': 4, 'UNKNOWN': 6, 'LOW': 1} + go pkgs w/ vulns: [('golang.org/x/crypto', 'v0.55.0'), ('golang.org/x/net', 'v0.58.0'), ('stdlib', 'v1.26.8')] + HIGH CVE-2026-78669 golang.org/x/net v0.58.0 -> 0.60.0 | net/http: net/http/internal/http2: golang: golang.org/x/net/ + HIGH CVE-2026-78667 stdlib v1.26.8 -> 1.26.9, 1.27.2 | net/http: golang: golang: Denial of Service via crafted HTTP + HIGH CVE-2026-78669 stdlib v1.26.8 -> 1.26.9, 1.27.2 | net/http: net/http/internal/http2: golang: golang.org/x/net/ + HIGH CVE-2026-97031 stdlib v1.26.8 -> 1.26.9, 1.27.2 | crypto/tls: golang: crypto/tls: Denial of Service via multip +=== gitea.dooplex.hu/admin/felhom-controller:0.307.0 12.15 debian + gitea.dooplex.hu/admin/felhom-controller:0.307.0 (debian 12. debian all={'LOW': 215, 'HIGH': 144, 'MEDIUM': 275, 'UNKNOWN': 17, 'CRITICAL': 16} fixable={'HIGH': 23, 'MEDIUM': 27, 'LOW': 1, 'CRITICAL': 12, 'UNKNOWN': 1} + CRIT-fixable CVE-2026-13221 libperl5.36 5.36.0-7+deb12u3 -> 5.36.0-7+deb12u4 + CRIT-fixable CVE-2026-42496 libperl5.36 5.36.0-7+deb12u3 -> 5.36.0-7+deb12u4 + CRIT-fixable CVE-2026-8376 libperl5.36 5.36.0-7+deb12u3 -> 5.36.0-7+deb12u4 + CRIT-fixable CVE-2026-13221 perl 5.36.0-7+deb12u3 -> 5.36.0-7+deb12u4 + CRIT-fixable CVE-2026-42496 perl 5.36.0-7+deb12u3 -> 5.36.0-7+deb12u4 + CRIT-fixable CVE-2026-8376 perl 5.36.0-7+deb12u3 -> 5.36.0-7+deb12u4 + CRIT-fixable CVE-2026-13221 perl-base 5.36.0-7+deb12u3 -> 5.36.0-7+deb12u4 + CRIT-fixable CVE-2026-42496 perl-base 5.36.0-7+deb12u3 -> 5.36.0-7+deb12u4 + CRIT-fixable CVE-2026-8376 perl-base 5.36.0-7+deb12u3 -> 5.36.0-7+deb12u4 + CRIT-fixable CVE-2026-13221 perl-modules-5.36 5.36.0-7+deb12u3 -> 5.36.0-7+deb12u4 + CRIT-fixable CVE-2026-42496 perl-modules-5.36 5.36.0-7+deb12u3 -> 5.36.0-7+deb12u4 + CRIT-fixable CVE-2026-8376 perl-modules-5.36 5.36.0-7+deb12u3 -> 5.36.0-7+deb12u4 + usr/bin/docker gobinary all={'HIGH': 3, 'MEDIUM': 5, 'LOW': 1, 'UNKNOWN': 4} fixable={'HIGH': 3, 'MEDIUM': 5, 'LOW': 1, 'UNKNOWN': 4} + go pkgs w/ vulns: [('stdlib', 'v1.26.8')] + usr/libexec/docker/cli-plugins/docker-compose gobinary all={'MEDIUM': 9, 'UNKNOWN': 7, 'HIGH': 4, 'LOW': 1} fixable={'MEDIUM': 9, 'HIGH': 4, 'UNKNOWN': 6, 'LOW': 1} + go pkgs w/ vulns: [('github.com/containerd/containerd/v2', 'v2.3.4'), ('golang.org/x/crypto', 'v0.56.0'), ('golang.org/x/net', 'v0.58.0'), ('stdlib', 'v1.26.6')] + HIGH CVE-2026-78667 stdlib v1.26.6 -> 1.26.9, 1.27.2 | net/http: golang: golang: Denial of Service via crafted HTTP + HIGH CVE-2026-78669 stdlib v1.26.6 -> 1.26.9, 1.27.2 | net/http: net/http/internal/http2: golang: golang.org/x/net/ + HIGH CVE-2026-97031 stdlib v1.26.6 -> 1.26.9, 1.27.2 | crypto/tls: golang: crypto/tls: Denial of Service via multip + usr/local/bin/felhom-controller gobinary all={'HIGH': 34, 'MEDIUM': 22, 'UNKNOWN': 6, 'LOW': 2} fixable={'HIGH': 34, 'MEDIUM': 22, 'UNKNOWN': 5, 'LOW': 2} + go pkgs w/ vulns: [('golang.org/x/crypto', 'v0.31.0'), ('golang.org/x/sys', 'v0.37.0'), ('stdlib', 'v1.24.13')] + HIGH CVE-2025-22869 golang.org/x/crypto v0.31.0 -> 0.35.0 | golang.org/x/crypto/ssh: Denial of Service in the Key Exchan + HIGH CVE-2025-47913 golang.org/x/crypto v0.31.0 -> 0.43.0 | golang.org/x/crypto/ssh/agent: golang.org/x/crypto/ssh/agent + HIGH CVE-2026-39828 golang.org/x/crypto v0.31.0 -> 0.52.0 | golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Unauthoriz + HIGH CVE-2026-39829 golang.org/x/crypto v0.31.0 -> 0.52.0 | golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Denial of + HIGH CVE-2026-39830 golang.org/x/crypto v0.31.0 -> 0.52.0 | golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Denial of + HIGH CVE-2026-39831 golang.org/x/crypto v0.31.0 -> 0.52.0 | golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Security k + HIGH CVE-2026-39832 golang.org/x/crypto v0.31.0 -> 0.52.0 | golang.org/x/crypto/ssh/agent: golang.org/x/crypto/ssh/agent + HIGH CVE-2026-39835 golang.org/x/crypto v0.31.0 -> 0.52.0 | golang.org/x/crypto/ssh: golang: golang.org/x/crypto/ssh: De + HIGH CVE-2026-42508 golang.org/x/crypto v0.31.0 -> 0.52.0 | golang.org/x/crypto/ssh/knownhosts: golang: golang.org/x/cry + HIGH CVE-2026-46595 golang.org/x/crypto v0.31.0 -> 0.52.0 | golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Authorizat + HIGH CVE-2026-46597 golang.org/x/crypto v0.31.0 -> 0.52.0 | golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Denial of + HIGH CVE-2026-56854 golang.org/x/crypto v0.31.0 -> 0.55.0 | golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Authentica + HIGH CVE-2026-25679 stdlib v1.24.13 -> 1.25.8, 1.26.1 | net/url: Incorrect parsing of IPv6 host literals in net/url + HIGH CVE-2026-27145 stdlib v1.24.13 -> 1.25.11, 1.26.4 | crypto/x509: golang: golang crypto/x509: Denial of Service v + HIGH CVE-2026-32280 stdlib v1.24.13 -> 1.25.9, 1.26.2 | crypto/x509: crypto/tls: golang: Go: Denial of Service vulne + HIGH CVE-2026-32281 stdlib v1.24.13 -> 1.25.9, 1.26.2 | crypto/x509: golang: Go crypto/x509: Denial of Service via i + HIGH CVE-2026-32283 stdlib v1.24.13 -> 1.25.9, 1.26.2 | crypto/tls: golang: Go crypto/tls: Denial of Service via mul + HIGH CVE-2026-33811 stdlib v1.24.13 -> 1.25.10, 1.26.3 | net: golang: Go net package: Denial of Service via long CNAM + HIGH CVE-2026-33814 stdlib v1.24.13 -> 1.25.10, 1.26.3 | net/http/internal/http2: golang: golang.org/x/net: Go HTTP/2 + HIGH CVE-2026-33818 stdlib v1.24.13 -> 1.25.13, 1.26.6, 1.27.0-rc.3 | encoding/asn1: golang: Go encoding/asn1: Denial of Service v + HIGH CVE-2026-39820 stdlib v1.24.13 -> 1.25.10, 1.26.3 | net/mail: golang: Go net/mail: Denial of Service via crafted + HIGH CVE-2026-39821 stdlib v1.24.13 -> 1.25.13, 1.26.6, 1.27.0-rc.3 | golang.org/x/net/idna: golang: net/http: golang.org/x/net/id + HIGH CVE-2026-39822 stdlib v1.24.13 -> 1.25.12, 1.26.5, 1.27.0-rc.2 | golang: Go os.Root: Symlink following vulnerability allows d + HIGH CVE-2026-39836 stdlib v1.24.13 -> 1.25.10, 1.26.3 | net: golang: Go net package: Denial of Service via NUL byte + HIGH CVE-2026-42499 stdlib v1.24.13 -> 1.25.10, 1.26.3 | net/mail: golang: net/mail: Denial of Service via pathologic + HIGH CVE-2026-42504 stdlib v1.24.13 -> 1.25.11, 1.26.4 | mime: golang: Golang MIME: Denial of Service via maliciously + HIGH CVE-2026-56853 stdlib v1.24.13 -> 1.25.13, 1.26.6, 1.27.0-rc.3 | net/http: golang: Go net/http: Unencrypted HTTP/2 connection + HIGH CVE-2026-56858 stdlib v1.24.13 -> 1.25.13, 1.26.6, 1.27.0-rc.3 | html/template: golang: Go html/template: Cross-Site Scriptin + HIGH CVE-2026-56859 stdlib v1.24.13 -> 1.25.13, 1.26.6, 1.27.0-rc.3 | encoding/xml: golang: Go: Denial of Service via XML decoding + HIGH CVE-2026-56860 stdlib v1.24.13 -> 1.25.13, 1.26.6, 1.27.0-rc.3 | net/url: golang: golang net/url: Denial of Service from quad + HIGH CVE-2026-56862 stdlib v1.24.13 -> 1.25.13, 1.26.6, 1.27.0-rc.3 | crypto/tls: golang: Golang crypto/tls: Denial of Service via + HIGH CVE-2026-78667 stdlib v1.24.13 -> 1.26.9, 1.27.2 | net/http: golang: golang: Denial of Service via crafted HTTP + HIGH CVE-2026-78669 stdlib v1.24.13 -> 1.26.9, 1.27.2 | net/http: net/http/internal/http2: golang: golang.org/x/net/ + HIGH CVE-2026-97031 stdlib v1.24.13 -> 1.26.9, 1.27.2 | crypto/tls: golang: crypto/tls: Denial of Service via multip +=== gitea.dooplex.hu/admin/felhom-hub:0.146.0 3.21.8 alpine + gitea.dooplex.hu/admin/felhom-hub:0.146.0 (alpine 3.21.8) alpine all={'HIGH': 2, 'MEDIUM': 17, 'LOW': 2} fixable={'HIGH': 2, 'MEDIUM': 17, 'LOW': 2} + usr/local/bin/felhom-hub gobinary all={'HIGH': 34, 'MEDIUM': 22, 'UNKNOWN': 6, 'LOW': 2} fixable={'HIGH': 34, 'MEDIUM': 22, 'UNKNOWN': 5, 'LOW': 2} +=== gitea.dooplex.hu/admin/felhom-samba:1.1.0 3.21.7 alpine + gitea.dooplex.hu/admin/felhom-samba:1.1.0 (alpine 3.21.7) alpine all={'HIGH': 48, 'MEDIUM': 59, 'LOW': 28} fixable={'HIGH': 48, 'MEDIUM': 59, 'LOW': 28} +=== gtstef/filebrowser:1.5.6-stable 3.24.1 alpine + gtstef/filebrowser:1.5.6-stable (alpine 3.24.1) alpine all={'HIGH': 2, 'MEDIUM': 8, 'LOW': 12, 'CRITICAL': 1} fixable={'HIGH': 2, 'MEDIUM': 8, 'LOW': 12, 'CRITICAL': 1} + CRIT-fixable CVE-2026-13221 perl 5.42.2-r0 -> 5.42.2-r1 + home/filebrowser/filebrowser gobinary all={'UNKNOWN': 7, 'HIGH': 4, 'MEDIUM': 7, 'LOW': 1} fixable={'HIGH': 4, 'MEDIUM': 7, 'UNKNOWN': 6, 'LOW': 1} + go pkgs w/ vulns: [('golang.org/x/crypto', 'v0.56.0'), ('golang.org/x/net', 'v0.58.0'), ('stdlib', 'v1.27.1')] + HIGH CVE-2026-78667 stdlib v1.27.1 -> 1.26.9, 1.27.2 | net/http: golang: golang: Denial of Service via crafted HTTP + HIGH CVE-2026-78669 stdlib v1.27.1 -> 1.26.9, 1.27.2 | net/http: net/http/internal/http2: golang: golang.org/x/net/ + HIGH CVE-2026-97031 stdlib v1.27.1 -> 1.26.9, 1.27.2 | crypto/tls: golang: crypto/tls: Denial of Service via multip +=== traefik:v3.7.13 3.24.2 alpine + traefik:v3.7.13 (alpine 3.24.2) alpine all={'MEDIUM': 1} fixable={'MEDIUM': 1} + usr/local/bin/traefik gobinary all={'MEDIUM': 9, 'LOW': 5, 'UNKNOWN': 7, 'HIGH': 4} fixable={'MEDIUM': 9, 'LOW': 5, 'HIGH': 4, 'UNKNOWN': 6} + go pkgs w/ vulns: [('go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploggrpc', 'v0.20.0'), ('go.opentelemetry.io/otel/exporters/otlp/otlptrace', 'v1.44.0'), ('go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc', 'v1.44.0'), ('go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp', 'v1.44.0'), ('go.opentelemetry.io/otel/sdk', 'v1.44.0'), ('go.opentelemetry.io/otel/sdk/log', 'v0.20.0'), ('golang.org/x/crypto', 'v0.56.0'), ('golang.org/x/net', 'v0.58.0')] diff --git a/documentation/audits/security-review-2026-10-12/scanners/trivy-traefik_v3.7.13.json.gz b/documentation/audits/security-review-2026-10-12/scanners/trivy-traefik_v3.7.13.json.gz new file mode 100644 index 00000000..1283fabc Binary files /dev/null and b/documentation/audits/security-review-2026-10-12/scanners/trivy-traefik_v3.7.13.json.gz differ