Security posture (ForeignX)¶
Known remaining (tracked)¶
| Issue | Severity | Status |
|---|---|---|
| Controllers trust client-supplied user IDs; no JWT yet | Critical | Open — OAuth callback should mint signed session |
| KeePass multi-instance race without distributed lock | High | Mitigated deploy: --max-instances=1 |
| Org JSON on local disk | High | Mitigated deploy: single instance; Sheets org tab next |
| Plan limits not enforced on join | Medium | Catalog API live; enforcement next |
Mitigations landed (council pass)¶
- Swagger only in Development
- Engagement actions require list membership + deck membership + approved user
- KeePass org-scoped group path API
- Engagement run uses resolved list members, not “today” only
- Sheets schema: Users col E = org; Lists F/G = mode/org
- Cloud Run deploy script: min=1 max=1, no public unauthenticated by default
Production deploy checklist¶
- Real auth (session cookie or JWT after X OAuth)
- Secret Manager for X secrets, KeePass password, Sheets SA
- GCS bucket for
.kdbx - Cloud Run invoker IAM for your frontend SA only
- Semgrep + gitleaks green on main