jappel/leistungsbilanz-ts
1
0
Fork 1
Code Issues 6 Pull requests Projects Releases Packages Wiki Activity Actions

docs(security): Threat-Model anlegen, Entscheidung zu geteilten Projekten offen
Some checks are pending
security-baseline / secrets (push) Waiting to run
Details
security-baseline / node (push) Waiting to run
Details
security-baseline / semgrep (push) Waiting to run
Details
security-baseline / trivy (push) Waiting to run
Details

Browse source 
docs/THREATMODEL.md (threat-model-light): System, Assets, Angreifer,
Vertrauensgrenzen, Risiken R1-R14 mit Beleg. R3 (ASVS-light B1/B2) bleibt
offen, bis Julian E1 (Projekte teamweit geteilt) bestaetigt. idorGap-
Kommentar und AGENTS.md verweisen darauf.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
This commit is contained in:
Grovy311 2026-10-17 12:40:43 +02:00
parent b0e8161918
commit 1cf406d216
4 changed files with 146 additions and 11 deletions
Download patch file Download diff file Expand all files Collapse all files

21
AGENTS.md
View file

@ -797,15 +797,22 @@ Rules for agents working on this repo:
Open security points (state at adoption, 2026-10-15; updated 2026-10-17):
- **No `docs/THREATMODEL.md` yet.** B1/B2 (object access, list filtering) are K items in
the ASVS-light checklist, so `pre-release-gate` reports No-Go until the shared-projects
decision behind `idorGap` is written down there (who decided, why, which instance/team),
e.g. with the `threat-model-light` skill. `idorGap` alone is not evidence.
- **Threat model: `docs/THREATMODEL.md`** (German, since 2026-10-17). Keep it current when
auth, roles, routes, imports/exports or deployment change. Its "Design-Entscheidungen"
section is still empty: only Julian or Christian record decisions there, agents never do.
- **Shared-projects decision pending (THREATMODEL R3 / E1, blocks release).** B1/B2 (object
access, list filtering) are K items in the ASVS-light checklist. `pre-release-gate` reports
No-Go until E1 is answered and recorded as a design decision (who decided, when, why, which
instance/team, when to re-evaluate). `idorGap` alone is not evidence.
- **Projects have no owner.** Every signed-in user can read and change every project.
The IDOR tests in `baseline.test.ts` run but are reported as TODO via `idorGap` in
`security.config.ts`. Introduce per-project ownership/sharing, then remove `idorGap`;
the tests must turn green.
`security.config.ts`. If E1 is answered "no": introduce per-project ownership/sharing,
then remove `idorGap`; the tests must turn green.
- Further open items from the threat model (no decision needed, see its "Nächste Schritte"):
R6 live port 3090 reachable over plain HTTP in the LAN, R7 global 25 MB JSON limit before
the auth guard, R8 no XLSX zip-bomb guard before `workbook.xlsx.load`, R11 no route test
for the logo upload, R12 `actorId` never set in project history. Open decisions E2 (public
without Authelia) and E3 (who may change office profile/logo).
- `npm audit`: 6 moderate findings without a non-breaking fix (`drizzle-kit` dev tooling
via `esbuild`, `exceljs` via `uuid`). High/critical: none.
- ESLint warnings (not blocking): `security/detect-unsafe-regex` in