# REPORT — the nightly security watch (R-1303), 2026-10-26 night

> A sibling of `REPORT.md`: the night session owns `REPORT.md` tonight. Readings taken alone (the brief's „safest
> reading", stated first):
> 1. **The key:** the operator said yes; the token did not exist by the end, so the watch runs in no-key mode (box
>    programs nightly, apps' advisory lists every second night) and switches by itself when `GH_ADVISORY_TOKEN` exists.
>    The name is `GH_…`, not `GITHUB_…`: Gitea reserves the `GITHUB_` and `GITEA_` prefixes for Actions secrets.
> 2. **The memory:** a file the CI job commits to `main` itself (`documentation/security-watch/state.json`), not the
>    runner's disk (two runners, two disks), not the Actions cache (needs a node step), not DooPlex (a host change).
> 3. **A seed that could not read everything** (no key) leaves those pins pending; their first real read is recorded
>    silently. Otherwise the first nights after the seed would have been the mail storm the brief forbids.

## In plain words

1. **Sources picked:** GitHub's per-repo security advisories (the main source), GitHub release notes, the Cloudflare
   blog plus cloudflared's own `VULN-` notes, OSV for our Go builders, and the registries for „newer version". **They
   cannot see:** a fix told only by mail, forum or a blog we do not read; a security fix nobody calls one; packages inside
   our own images (Debian, Alpine, Samba); closed-source apps (Plex, Emby); floating tags like `redis:7-alpine`.
2. **Watched:** 108 pins — 11 box programs and build bases, 97 catalog images (21 of them with a stated „no source").
3. **First real run (the seed, CI job 2408):** ADVISORY on **30 pins (142 notices)**: 3 box programs (traefik, the file
   manager, cloudflared) and 27 apps; BEHIND on 17; 0 NOT CHECKED. Nothing was mailed — the seed records them.
4. **The test mail arrived:** yes — „[Felhom security] TEST — not a real advisory …" in the admin@felhom.eu mailbox
   (Resend id `01a17a5d-…`, CI job 2407).
5. **The operator does:** make the GitHub key and store it as `GH_ADVISORY_TOKEN` (CC's store and Gitea Actions). Then
   decide the order of triage for the advisory list (R-1305, R-1306).

## The ADVISORY list today (box programs first; full list `audits/security-watch-2026-10-26/ADVISORIES-2026-10-26.md`)

| Program | Our version | Fixed in (notices) |
|---|---|---|
| traefik | v3.7.13 | v3.7.14–v3.7.16 (15; triage: none seems to apply to our config — R-1304) |
| file manager (FileBrowser Quantum) | 1.5.6-stable | 1.5.7-stable for 2 of 36 (GHSA-qx86, needs the password; GHSA-3846); the rest on 2.x (R-1305) |
| cloudflared | 2026.10.3 | 2026.10.4 (VULN-176088, metrics allowlist; our metrics are on the container's own loopback) + the eMudhra blog post (already fixed, R-1300) |
| 27 apps | — | e.g. Jellyfin 10.11.11 → 12.0; Gokapi 1.9.6 → 2.2.4; Seerr 2.7.3 → 3.5.0; Wanderer v0.20.0 → v0.21.2; Rallly 4.15.3 → 4.15.4; Immich v3.2.4 → v3.3.5 (notes); SparkyFitness: no fix yet (R-1306) |

## Commits and CI (by commit)

| Repo | Commit | What | CI |
|---|---|---|---|
| felhom.eu | `97ae7086` | spike + rows R-1303, R-1304 | job 2401 success |
| felhom.eu | `1f62d629` | the watch, the shared list + gate, tests, workflow | job 2402 success |
| felhom.eu | `6ee23a3b` | abandoned = GAP; seed-pending | (see below) |
| app catalog | `f61800a` | `upstream:` in 65 templates, gate + decoys, checklist 1.10 | job 2403 success |
| controller | `e01eb64b` | `upstream.txt`, `# upstream:` comments, gate + decoys | job 2404 success |
| felhom.eu | `ed843da7` | the memory, committed by the CI job itself | — |
| felhom.eu | (this commit) | docs, rows R-1305–R-1309, STATUS, this report | read at the end |

Live runs in CI: job 2405 (dry: every host reached; 30 NOT CHECKED because DooPlex's shared GitHub quota was at 0 —
printed and counted, the reason for the key), 2407 (test mail), 2408 (seed; memory pushed). Tests: 38 checks, no
network; red-proved five ways (dedupe, streak, the 30-day window, a swallowed source error, the seed-pending set); the
two gates' decoys red-proved with a reader that reads comments.

## Rows

Before **215**, after **222**; opened **7** (R-1303 – R-1309), closed **0**.

## Observations

- traefik v3.7.13 inside 12 October advisories — **FILED: R-1304**.
- The file manager 1.5.6-stable inside 36 notices, 2 fixed in its own channel — **FILED: R-1305**.
- 27 app pins with published notices — **FILED: R-1306** (one row; the list is the file).
- Packages inside our own images not watched — **FILED: R-1307**. Floating tags — **FILED: R-1308**. Mail-only and
  silent fixes, closed-source apps — **FILED: R-1309**.
- Three upstream repos renamed (cal.com → `calcom/cal.diy`, jellyseerr → `seerr-team/seerr`, wanderer →
  `open-wanderer/wanderer`) — **NOT-A-FINDING: the mapping uses the new names; the images still pull.**
- plant-it's image name points nowhere — **NOT-A-FINDING: known and stated in its template (abandoned); the watch lists
  it as GAP and never looks it up.**
- The hub's Dockerfile lines are not gated in felhom.eu's own runner (only the catalog's and the controller's are) —
  **NOT-A-FINDING: the watch reads them nightly and reports a missing line as NOT CHECKED; a gate there would need its
  own decoy suite for two lines.**
- nginx's channel test treats 1.31 (mainline) as the same channel as 1.30 (stable) — **NOT-A-FINDING: BEHIND is a weekly
  hint; the notice match does not depend on it.**
- Without a key, the dry run spent DooPlex's whole GitHub quota (shared with every DooPlex client) — **NOT-A-FINDING:
  that is R-1303's „blocked on"; the watch reported it as NOT CHECKED, as designed.**

## Documents changed

`runbooks/monthly-floating-retest.md` §4a (the BEHIND check is nightly; the monthly run keeps the same-name re-test);
`architecture/capability-map-detail/B.md` B23 (a watch mail starts the lane); `architecture/08-alarm-ladder.md` §11 (the
three signals, `[DESIGN]`); `scripts/CHANGELOG.md`; `REUSE.md`; the catalog's `NEW-APP-CHECKLIST.md` 1.10. System
poster: none of the three needed — no machine, path, backup tier or key changed (a CI job reads public sources).

## Teardown

Machine and host: nothing provisioned. Hub: nothing. CI: three manual runs, no lasting change but the memory file. Work
copies `felhom.eu-cfsec`, `app-catalog-cfsec`, `felhom-controller-cfsec` on DooPlex: removed at the end, all pushed.