brain-of-reese/.agents/VULNS.md

VULNS.md — Known & Historically Found Vulnerabilities

Registry of security findings for Brain of Reese. Full details, proofs of concept, and the priority-ordered remediation task list live in .agents/remediation_plan.md (this file is the quick-reference index; when a finding is fixed, update its status here and append to the fixed log at the bottom).

Conventions:

• Statuses: open → mitigated (control in place) → fixed (remediated + verified) → accepted (owner decision, risk consciously kept) → false positive (intended behavior — never re-raise or "fix" without an explicit owner decision).
• Prior-audit IDs keep their original numbering (SEC-0x = audit 2026-09-07, SEC-14-xx = audit 2026-09-14).

Open findings

ID	Sev	Type (CWE)	Location	Status
SEC-14-04	Medium	In-flight SSE chat stream pins a DB connection for the whole turn → pool-exhaustion DoS (~15 streams, one token user) (CWE-770/400)	app/api/chat.py (request-scoped get_db across the StreamingResponse), app/db.py (default pool 5+10)	open

SEC-14-04 — one-line essence: 16 slow curl -N streams on /api/chat with any token hang every DB-backed route (default pool = 15 connections). Remediation: short-lived sessions per DB step inside the stream (the sync/upload house pattern), explicit pool kwargs, optional chat concurrency cap — see .agents/remediation_plan.md §SEC-14-04.

False positives — 2026-09-14 audit (owner: intended behavior, well known)

Reclassified by the owner on 2026-09-14: every 2026-09-14 finding except SEC-14-04 is intended, well-known behavior of a single-owner homelab app — not a vulnerability to remediate. Kept here for the record so a future audit (or a future agent) does not re-raise them. Do NOT "fix" these without an explicit owner decision; the trade-offs below are deliberate.

ID	Sev (as audited)	Type (CWE)	Location	Why it's intended
SEC-14-01	Medium	Unthrottled anonymous write surface → storage-exhaustion DoS (CWE-770/307)	app/api/chats.py (public POST/PUT /api/chats, POST /{id}/share); app/core/rate_limit.py covers login routes only	Public chat-save is the owner-locked phase-55 A1 design (the visitor saves their own conversation; auto-save is a normal traffic path). Homelab LAN trust model.
SEC-14-02	Medium	Guest IDOR — chat-id holder can force-share / overwrite a private chat (CWE-639)	app/api/chats.py share_chat, update_chat	Owner-locked trust model: the unguessable uuid4 row id IS the credential (phase 51/55). Sharing/overwriting by an id holder is intended.
SEC-14-03	Medium	Postgres on 0.0.0.0:5432 with weak documented creds reese:reese (CWE-790/668)	compose.yaml (db ports, POSTGRES_PASSWORD), app/config.py default database_url, .env.example	Deliberate homelab dev convenience; the trusted LAN is the security boundary and the creds are documented on purpose.
SEC-14-05	Low	Cleartext transport + plaintext admin password (CWE-319/256)	app/main.py (https_only=False), app/config.py	Owner decision 2026-08-22: plaintext password and homelab HTTP are deliberate (TLS is a documented non-goal).
SEC-14-06	Low	debugpy binds 0.0.0.0:5678 when DEBUGPY=1 → LAN RCE if left on (CWE-1188)	app/core/debugging.py	Explicit opt-in dev feature (AGENTS.md rule 7); the wide bind is intentional for remote IDE attach.
SEC-14-07	Low	No throttle on /api/chat for token users — leaked token = unlimited LLM turns (CWE-770)	app/api/chat.py, app/rag/llm.py	Tokens are capability credentials by design (phase 79); holders are trusted to use the models.
SEC-14-08	Low	Importer reads source files whole, no per-file size cap (git/local sources; uploads are capped) (CWE-770)	app/rag/importer.py:390	Source dirs are admin-chosen trusted content; the never-truncated A7 contract implies whole-file reads.
SEC-14-09	Low	Full question text + tool args in stdout logs and query_log (CWE-532)	app/api/chat.py per-turn line, app/rag/agent.py tool line	The full per-turn log line is a locked PLAN §9 requirement (AGENTS.md rule 10: "amply log").
SEC-14-10	Info	Admin git-source registry reaches arbitrary https/ssh/git@ hosts (admin-gated SSRF) (CWE-918)	app/api/git_sources.py URL_RE → scripts/git_sync.py	Admin-only surface; the admin already controls the host. Arbitrary remotes are the feature (phase 59/35).
SEC-14-11	Info	No Referrer-Policy / Permissions-Policy (owner decision A4, phase 82) (CWE-538)	app/core/security_headers.py	Phase-82 decision A4 deliberately scoped headers to CSP + XFO + nosniff; no external requests exist (No-CDN).
SEC-14-12	Info	BOR_SESSION_SECRET only checked non-empty — weak secret allows cookie forgery (CWE-340)	app/core/auth.py ensure_admin_configured	Operator-provisioned secret (generator command documented in .env.example); strength is the operator's choice.

Note: .agents/remediation_plan.md (the audit report) still lists these with remediation tasks — its task list items P1 (parts), P2, P4, P5, P6, P7 address findings now reclassified as false positives and are dropped unless the owner reopens them. Only task P3 (SEC-14-04) remains actionable.

Fixed (verified present in the 2026-09-14 audit)

ID	Sev	What it was	Fixed by	Fixed phase
SEC-03	Medium	No rate limit on failed sign-ins (/api/login, /api/token-auth)	Per-IP sliding window (10 fails / 15 min, shared counter, fail-open) — app/core/rate_limit.py	81
SEC-04	Medium	No CSP / X-Frame-Options / nosniff → clickjacking of the admin UI	SecurityHeadersMiddleware — CSP default-src 'self'; base-uri 'none'; frame-ancestors 'none' + X-Frame-Options: DENY + nosniff on every response	82
SEC-05	Medium	Unbounded anonymous payload on the public chat-save surface	Schema caps: ≤200 messages, 32 KB text/thinking, nested list caps (~13 MB worst-case) — app/schemas.py	83
SEC-08	Medium	Docs-push 502 leaked git stderr with user:pass@ credentials	app/core/errors.sanitize_error userinfo masker applied to all error surfaces	84
SEC-13	Low	LLM error strings interpolated the raw base URL (possible embedded creds)	Same sanitizer on every LLM error f-string	84

Controls verified sound (2026-09-14 audit — no finding)

• SQL injection: all ORM / parameter-bound text(); FTS tsquery regex-constrained to [a-z0-9.] and bound as a parameter.
• XSS: escape-first renderMarkdown(), textContent for all data, strict CSP, no unsafe-inline (theme tag uses a sha256-hashed style-src exemption), all innerHTML sites audited static-or-escaped.
• Command injection: single list-argv subprocess funnel (scripts/git_sync.run_git), no shell=True; branch tokens shape-validated at boot; draft paths refuse absolute/...
• Archive upload: traversal / absolute / drive-letter / symlink-hardlink escape / device-FIFO rejection, compressed + extracted byte caps (zip-bomb), atomic swap-in with rollback — app/rag/archive_upload.py.
• API tokens: 128-bit CSPRNG, SHA-256 hash stored (plaintext one-shot in the 201 body only), per-request live row check = revocation, generic 401s (no enumeration).
• Open redirect: login ?next= restricted to same-origin relative paths.
• Agent tools: model-supplied ls/read/grep resolve against Postgres rows only (no FS/network), round cap bounds loops, fixed-substring grep (no ReDoS).
• Dependencies: pip-audit clean on the locked set (2026-09-14); bandit hits are false positives / dev scripts.
• Git history: no committed secrets across all 161 commits (2026-09-14 scan); .env gitignored.

Re-audit triggers

Re-run the audit (or at least the relevant lens) when any of these land: a reverse proxy or TLS in front of the app, a multi-user/auth rework, changes to app/api/chats.py write gating, the compose port bindings, the subprocess/git surface, the upload pipeline, or any dependency with a published CVE (uvx pip-audit).

Changelog

• 2026-09-14 (owner reclassification) — all 2026-09-14 findings except SEC-14-04 reclassified as false positives (intended behavior, well known). Open count: 12 → 1.
• 2026-09-14 — second audit: 12 new findings (4 Medium / 4 Low / 4 Info), 5 prior findings verified fixed. Full report: .agents/remediation_plan.md.