The passes stopped at G, and A-G share an assumption that hides an entire class
of defect: every one of them asks a legitimate user to do legitimate things.
Nothing looked at what happens when the caller is not who they claim, does not
own what they ask for, or asks too often.
That assumption has already cost this portfolio once. requireCoupleContext in
Closer-Couples never verified the caller belonged to the couple whose data was
returned -- authentication present, correct, and proving nothing about
ownership. No pass A-G would have found it.
Pass H covers six cases: authenticated endpoints called logged-out, a list
endpoint checked for rows the caller should not see, User A requesting User B's
object by id, a privileged route opened as an ordinary user, the expensive
endpoint hit repeatedly, and the built bundle and localStorage inspected.
The organising sentence, which is the reason it is a separate pass rather than
more rows in B: authenticated is not the same as owning, and neither is the
same as permitted.
closes#2
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
The basis for every project here was itself unversioned: no .git, no remote,
no history. Changes to it had no diff and no revert, and two of its own guards
could not run at all -- doc-claims.sh and doc-triggers.py both read git
history, so the script written to catch documentation drift could not be run
against the documents that define drift.
This is the tree as it stands, including work that until now existed only as
loose files on disk: WORK_CYCLE.md, TOOLS.md, the Portainer image-line fix in
deploy.py, the status vocabulary corrected to the four words the conformance
checker actually enforces, the Exempt: mechanism documented, and the Forgejo
instance named in README.md.
secrets.sh --tracked reports one candidate, migrate.sh:480. It is the comment
documenting the three Postgres credential shapes that script redacts, with
literal placeholders, and it is left alone deliberately: GUARDS.md section 2
is that a source-grep guard must tell code from the comment about code, and
deleting an explanation to quiet a scanner is the failure it names.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
null