# SPIKE — which security-notice sources work (security watch, R-1303), 2026-10-26 evening

Measured from DooPlex (the CI runner is a k3s pod on DooPlex with the same egress; its own reach is proven by the live
run, `LIVE.md`). Raw answers: `raw/`.

## The controls

| Control | What it is | Our pin |
|---|---|---|
| **P1 cloudflared** | Cloudflare's eMudhra notice, 2026-10-20: fixed in 2026.10.2 (image trust store) | was 2026.9.3 (R-1300) |
| **P2 traefik** | GHSA-fh26-gfpp-7xxx (and 11 more, Oct 2026), fixed v3.7.14–v3.7.16; and the older set, e.g. 81 advisories for v3.1.2 | v3.7.13 |
| **P3 vaultwarden** | GHSA-wc45-m6pv-rrf9 and five more (2026-10-03), fixed 1.37.0 | 1.37.4 |
| **P4 immich** | GHSA-q89f-h332-8q2h (2026-09-28, high: SVG upload → RCE), fixed v3.2.4 | v3.2.4 |
| **P5 nextcloud** | advisories published in `nextcloud/security-advisories` (not in `nextcloud/server`) | 34.0.4 |
| **P6 Go builder** | GO-2026-6809 (R-972), fixed in Go 1.27.3 | golang 1.27.3 |
| **N negative** | vaultwarden 1.37.4 vs its advisories; traefik v3.7.16 vs GHSA-hrpp (≤ v3.7.15); Go 1.27.3 | — |

## The table

| Source | P1 cloudflared | P2 traefik | P3 vaultwarden | P4 immich | P5 nextcloud | P6 Go | Negative | Cost per night | Key |
|---|---|---|---|---|---|---|---|---|---|
| **GitHub per-repo security advisories** (`/repos/O/R/security-advisories`) | **no** (only 2 old Windows advisories) | **yes** — 12 affect v3.7.13 | **yes** (6, range ≤ 1.36.0) | **yes** | **yes**, from `nextcloud/security-advisories` (100+, paged) | n/a | **correct** (1.37.4 and v3.7.16 not affected) | 1 request per repo (+1 per 100 more) ≈ 85–90 | 60/hour without a key, **shared by every DooPlex client**; a 304 still counts (measured: 51 → 50). 5000/hour with a key |
| **OSV.dev** `query` | no (`github.com/cloudflare/cloudflared` at 2026.9.3: 0) | **old only** (v3.1.2: 81; v3.7.13: 0 — none of October's) | no (not a package) | no | no (Packagist `nextcloud/server`: 0) | **yes** (Go 1.27.2 → GO-2026-6809) | **correct** (Go 1.27.3: 0) | 1 POST per Go builder | none |
| **GitHub global advisories** (`/advisories?affects=`) | no | no (reviewed only; October's are not) | no | no | no | — | — | 1 per item | same as above |
| **GitHub release feed** (`/O/R/releases.atom`, newest 10, full notes) | no (cloudflared's release body is checksums only) | — | **yes** (1.37.0, 1.37.4 name GHSA ids) | **partly** (v3.3.5 says „security"; v3.2.4 is older than the 10 in the feed) | — | — | — | 1 per repo, **no API quota** (measured: core count unchanged) | none |
| **cloudflared `RELEASE_NOTES`** (raw file) | **no** for 2026.10.2 (no marker) — but Cloudflare marks security fixes `VULN-` (12 so far, e.g. 2026.10.4 VULN-176088) | — | — | — | — | — | — | 1 | none |
| **Cloudflare blog feed** (`blog.cloudflare.com/rss/`, full text, ~2 weeks) | **YES** — „8 eMudhra certificates are compromised" (2026-10-20) names cloudflared | — | — | — | — | — | — | 1 | none |
| **Registry tags** (Docker Hub, ghcr.io anonymous token, `lscr.io` = Docker Hub `linuxserver/*`) | BEHIND only (2026.10.2 existed) | BEHIND only | — | — | — | — | — | 1–3 per image | none |

## The choice (the smallest set that catches every positive control)

1. **GitHub per-repo security advisories** — catches P2, P3, P4, P5. The primary source.
2. **Cloudflare blog feed + cloudflared `RELEASE_NOTES` `VULN-` markers** — the only automated way to P1 (the blog);
   `VULN-` catches Cloudflare's other security releases (2026.10.0, 2026.10.4).
3. **OSV, Go stdlib only** — P6, for the Go builder pins of the controller and the hub.
4. **GitHub release feeds** — no quota; catches apps that write „security"/CVE/GHSA in their notes but publish no
   advisories (a second net, not a primary).
5. **Registry tags** — BEHIND, as `check-infra-pins.py` does, for every pin.

Dropped: OSV for apps (it found nothing the per-repo advisories did not, and nothing from October), GitHub's global
advisory search (reviewed advisories only).

## What the watch CANNOT see

- **A fix announced only by mail, or on a blog we do not read.** P1 is caught only because Cloudflare's blog names
  cloudflared in full text; a vendor that announces in a mail or a forum is invisible.
- **A security fix nobody calls one** (a base-image or trust-store bump with plain release notes, like cloudflared
  2026.10.2's „bump distroless image"). It shows only as BEHIND (weekly).
- **Packages inside our own images:** the Alpine/Debian packages in the controller, hub and Samba images (Samba's
  version is whatever Alpine 3.24 ships; Debian's and Alpine's security trackers are not read). BEHIND on the base image's
  point release is the only signal.
- **Floating tags** (`redis:7-alpine`, `postgres:16-…`, `mariadb:12.3`): there is no exact version to match a range
  against; they are listed as FLOATING, and a pull at install takes the line's newest.
- **Apps with no GitHub home or no notice practice** (PostgreSQL, MariaDB, Plex, Emby, OnlyOffice's server, the
  linuxserver wrappers): only BEHIND, plus release-feed words where a feed exists.
- **Without a key:** the advisory lists of the apps are read every second night (about 40 a night), the box programs
  every night. The operator said yes to a key (2026-10-26); until it exists the watch runs in this mode and says so.

## Facts measured on the way

- Our traefik pin **v3.7.13** is inside 12 advisories of October 2026 (fixed v3.7.14–v3.7.16). Our config uses the
  docker and file providers, no Kubernetes ingress, no FastProxy, no NTLM/Negotiate backend; ForwardAuth goes to the
  controller. None of the 12 seem to apply → **FILED: R-1304** (raise in the next controller release).
- A Gitea Actions secret cannot be named `GITHUB_…` (Gitea reserves the `GITHUB_` and `GITEA_` prefixes), so the CI
  secret is **`GH_ADVISORY_TOKEN`**, and the same name in CC's store.