# Security review 2026-10-12 — coverage

Each area: what was checked and holds, what fails (→ finding), and what was not reviewed.

| area | checked and holds | fails | not reviewed |
|---|---|---|---|
| C1 box from the internet | bcrypt passwords; host-only dashboard cookie; two CSRF mechanisms cover every state-changing route except one GET (SR-16); visitor address read from the right; traefik strips client-written forwarding headers; traefik dashboard not exposed; gate tokens one-use, host-bound, 60 s; family-gate exceptions anchored | SR-03, SR-09, SR-10, SR-16 | catalog apps changed before 2026-09-28 (FIRST-ADMIN.md covers them) |
| C2 hub from the internet | per-box keys compared in constant time; cross-box checks on every box route (14 with tests, 5 new tests); appliance register rate-limited | SR-01, SR-02, SR-08, SR-22, SR-23 | the claim engine; the `/bind` page's guessing limits; server-side fetches beyond Cloudflare and Gitea; live cross-box GETs (R-955) |
| C3 controller → agent | every local-API route bound to the token's own guest; tokens 256-bit and stored hashed; listens on the island bridge; 64 KiB body cap; the July audit's A1, B1, D3 fixed | SR-06, SR-11, parts of SR-17 | — |
| C4 hub → agent | verify order namespace → allow-list → crypto → target → time → nonce; nonce store on disk and pruned only after expiry; unsigned hub jobs reach no destructive executor; desired state cannot destroy or change retention | parts of SR-17 (no size bounds, no maximum validity) | — |
| C5 supply chain | agent binary and root files need an operator signature with sha256; OS updates are exact apt versions; installer checks agent, golden and bundle hashes; no other catalog template uses privileged mode, host networking or devices | SR-04, SR-12, SR-13, SR-14 | Gitea branch and tag protection (live); the CI runner as a push path; the golden image's start unit |
| C6 secrets | escrow wraps the PBS key with PBS's own passphrase function; identity bundle with age; recovery code ~129 bits; the hub holds ciphertext only; host secret files 0600 (measured) | SR-08, SR-18, parts of SR-17 | the hub's request logging; export and debug bundles |
| C7 host and guest | guest unprivileged; guest root password locked, key-only SSH (measured); operator SSH port reachable only through the tunnel (measured) | SR-07, SR-15, parts of SR-17 | restore of a privileged archive (Proxmox enforces it) |
| C8 public sites | HSTS on all; Gitea sign-up disabled; anonymous Gitea package API refuses; no `.git` or `.env` on felhom.eu | — (four repositories are public: the operator's decision, R-925) | — |

Scanner coverage: `SCANNERS.md`. Not scanned: the 53 catalog app images (R-987).