[fclairamb]

Specs filed from the daily security scans. Each spec is the tracker for its finding. This PR only adds or updates spec files, with no code changes.

Open (added by this PR)

• R1 (medium): specs/todos/2026-10-24-01-ai-repair-auto-apply-partial-runtime-host.md. repair: auto applies a candidate that keeps the previous version's literal host and adds a host built at runtime. The runtime host allowlist only holds AI-loop runs, so the applied version can send the check's secrets on its scheduled runs. This is a gap in the P1 fix.

Earlier scan specs on this branch (already implemented, in specs/done/2026/10/)

• Q1 (medium): 2026-10-23-02-ai-loop-secret-relay-through-model.md. AI loops relayed an encoded secret through the model.
• P1 (medium): 2026-10-22-01-ai-script-secret-host-guard-runtime.md. AI runs with real secrets were only host-checked by regex.
• K1 (medium): 2026-10-20-01-sender-response-body-caps.md. Notification senders and RabbitMQ read responses uncapped.
• J1 (medium): 2026-10-19-01-a2a-response-size-cap.md. A2A responses were read uncapped.
• I1 (low): 2026-10-18-01-plugin-schema-file-ref.md. Plugin schema $ref could load local files.
• G1/G2 (low): 2026-10-17-01-postgres-check-connection-config.md. Postgres conninfo escaping and fallback to the worker's PG* env.
• F1: 2026-10-16-15-pat-cache-revocation.md. The PAT cache outlived revocation.
• E1: 2026-10-16-14-totp-on-federated-sign-in.md. No TOTP on federated sign-in.
• E2: 2026-10-16-13-atomic-auth-attempt-counters.md. Auth attempt counters were not atomic.
• H3: 2026-10-16-12-mcp-tokens-rejected-on-rest.md. MCP OAuth tokens worked on REST.
• H2: 2026-10-16-11-slack-signature-fail-closed.md. Slack signature check failed open.
• T1 / M2 (high): 2026-10-16-10-discovery-scans-egress-guard.md. Discovery scans were outside the egress policy.
• N4: 2026-10-16-09-js-check-nested-docker-guard.md. A JS docker sub-check bypassed the gate.
• N3 (high): 2026-10-16-08-status-page-components-cross-org.md. Status-page components could be edited across orgs.
• D2/D3 (high): 2026-10-16-07-guard-status-subscriber-and-publication-webhooks.md. Subscriber and publication webhooks were not guarded.
• C3: 2026-10-16-06-accept-invite-existing-account.md. Accepting an invite logged in as an existing account.
• C1: 2026-10-16-05-kubeconfig-exec-and-incluster.md. Kubeconfig exec and inCluster were allowed.
• N2: 2026-10-16-04-mysql-dsn-injection.md. MySQL DSN injection.
• N1: 2026-10-16-03-env-secret-reference-allowlist.md. No allowlist for ${env:} references.
• C2/H1: 2026-10-16-02-token-purpose-separation.md. Purpose tokens were accepted as access tokens.
• D1: 2026-10-16-01-microsoft-signin-unverified-email-linking.md. Microsoft nOAuth email linking.

🤖 Generated with Claude Code

What changed

• Merged main in.
• fix(ci): TestMCPBridgeLocalErrors used a closed test server's port as an "unreachable" endpoint, and a parallel test could take that port (race). It now keeps the port held with a connection-dropping handler. Test assertions unchanged.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 87.93%. Comparing base (e536f52) to head (cb8337a).

Additional details and impacted files

@@            Coverage Diff             @@
##             main     #663      +/-   ##
==========================================
+ Coverage   87.90%   87.93%   +0.02%     
==========================================
  Files        1288     1288              
  Lines      131310   131310              
==========================================
+ Hits       115434   115469      +35     
+ Misses      15867    15832      -35     
  Partials        9        9              

see 27 files with indirect coverage changes

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.