Skip to content

security: complete v1 beta security review #72

Description

@RentnerKev

Summary

Perform the comprehensive security review before RentnerProxy enters
the v1 Beta phase.

This is a review + remediation issue, not a compliance certification.

Review Areas

Authentication

  • login
  • password reset
  • invites
  • TOTP
  • recovery codes
  • passkeys
  • sessions
  • disabled users
  • rate limiting

Authorization

  • RBAC
  • permission enforcement
  • custom roles
  • last-owner protection
  • server-side authorization
  • hidden UI actions do not replace backend checks

Proxy Runtime

  • Caddy Admin API isolation
  • revision/application boundary
  • failed apply behavior
  • unknown host behavior
  • Forwarded headers
  • trusted proxy behavior

Access Policies

  • Basic Auth
  • IP allow/deny
  • Forward Auth if implemented
  • CrowdSec if implemented

Certificates

  • private key handling
  • certificate upload
  • ACME
  • DNS provider secrets
  • Trusted CAs
  • upstream TLS verification

Web/API

  • CSRF
  • XSS
  • injection
  • redirects
  • SSRF
  • security headers
  • secret exposure
  • error sanitization

Files / Backup

  • path traversal
  • tar extraction
  • file permissions
  • restore validation
  • encrypted secrets
  • backup disclosure

GitHub / Supply Chain

  • workflow permissions
  • pinned Actions
  • preview trust boundary
  • release automation
  • container dependencies
  • Caddy/custom modules

Acceptance Criteria

  • findings classified by severity
  • all release-blocking findings fixed
  • regression tests added for fixes
  • required checks green
  • no known P0/P1 security blocker remains

Do NOT create a docs/security-report file unless repository policy
already requires one.

Priority

P0

Dependencies and sequencing

Initial review can start in parallel. Final review must include #64 and #65 if shipped, plus importer #66, upgrade #67 and backup/restore #71 changes. Review the existing runtime/access-policy foundations #19 and #28. Release-blocking findings must be resolved before #75 closes.

Report exploitable vulnerabilities and sensitive evidence through SECURITY.md; public tracking should contain sanitized findings and remediation status only.

Activity

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Labels

    area: authAuthentication, accounts, sessions, passkeys, and access control.area: runtimeOpenResty and privileged controller runtime behavior.securityPublic security hardening or remediation; disclose vulnerabilities privately.

    Projects

    No projects

      Relationships

      None yet

      Development

      No branches or pull requests

      Issue actions