jappel/leistungsbilanz-ts
1
0
Fork 1
Code Issues 6 Pull requests Projects Releases Packages Wiki Activity Actions

docs(security): Design-Entscheidung D1 (Projekte teamweit geteilt) eintragen
Some checks are pending
security-baseline / secrets (push) Waiting to run
Details
security-baseline / node (push) Waiting to run
Details
security-baseline / semgrep (push) Waiting to run
Details
security-baseline / trivy (push) Waiting to run
Details

Browse source 
Julian hat am 17.10.2026 bestaetigt: die Software laeuft nur im eigenen
Team, alle Nutzer sehen alle Projekte. Bevor Externe Konten bekommen, wird
Besitz/Freigabe pro Projekt eingefuehrt. R3 (ASVS-light B1/B2) damit nicht
anwendbar; idorGap-Kommentar und AGENTS.md verweisen auf D1.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
This commit is contained in:
Grovy311 2026-10-17 12:56:23 +02:00
parent 1cf406d216
commit e51752f3e1
3 changed files with 30 additions and 40 deletions
Download patch file Download diff file Expand all files Collapse all files

19
AGENTS.md
View file

@ -798,16 +798,15 @@ Rules for agents working on this repo:
Open security points (state at adoption, 2026-10-15; updated 2026-10-17):
- **Threat model: `docs/THREATMODEL.md`** (German, since 2026-10-17). Keep it current when
auth, roles, routes, imports/exports or deployment change. Its "Design-Entscheidungen"
section is still empty: only Julian or Christian record decisions there, agents never do.
- **Shared-projects decision pending (THREATMODEL R3 / E1, blocks release).** B1/B2 (object
access, list filtering) are K items in the ASVS-light checklist. `pre-release-gate` reports
No-Go until E1 is answered and recorded as a design decision (who decided, when, why, which
instance/team, when to re-evaluate). `idorGap` alone is not evidence.
- **Projects have no owner.** Every signed-in user can read and change every project.
The IDOR tests in `baseline.test.ts` run but are reported as TODO via `idorGap` in
`security.config.ts`. If E1 is answered "no": introduce per-project ownership/sharing,
then remove `idorGap`; the tests must turn green.
auth, roles, routes, imports/exports or deployment change. Only Julian or Christian record
decisions in its "Design-Entscheidungen" section; agents only write down what they state.
- **Projects are shared team-wide by design (THREATMODEL D1, Julian, 2026-10-17).** Every
signed-in user can read and change every project, because the software runs only within
the own team. ASVS-light B1/B2 are therefore not applicable (R3). The IDOR tests in
`baseline.test.ts` run but are reported as TODO via `idorGap` in `security.config.ts`.
- **Before any external account (customers, subcontractors) is created:** introduce
per-project ownership/sharing, remove `idorGap`, the tests must turn green. D1 no longer
holds once externals get accounts.
- Further open items from the threat model (no decision needed, see its "Nächste Schritte"):
R6 live port 3090 reachable over plain HTTP in the LAN, R7 global 25 MB JSON limit before
the auth guard, R8 no XLSX zip-bomb guard before `workbook.xlsx.load`, R11 no route test