fix(security): device consent phishing guard and 2FA disable throttle - #693

…eport screenshots (#708)

Fixes the findings of the daily security scans. Each spec is the tracker
for its finding.

## Fixed by this PR

- **Y1 (low)**:
`specs/done/2026/10/2026-10-29-01-bug-report-upload-instance-budget.md`.
Anonymous bug-report screenshots are capped at 100 MB per org, but the
caller picks the org, so the instance-wide total is 100 MB times the
number of orgs. Screenshots are also stored past the issue-dispatch cap
and never deleted. The fix adds an instance-wide budget for anonymous
screenshots, reserves the dispatch slot before storing, makes the quota
atomic and adds a retention.

## Earlier scan specs (implemented, in `specs/done/2026/10/`)

- **X1 (high)**:
`2026-10-28-01-pat-cannot-mint-sessions-or-sign-in-factors.md`. A PAT
could open sessions in its owner's other orgs and add sign-in factors.
Fixed in #699.
- **X2 (medium)**:
`2026-10-28-02-status-subscribe-throttle-and-keep-confirmed.md`.
Unthrottled subscribe confirm emails, and re-subscribing un-confirmed a
subscriber. Fixed in #699.
- **X3 (medium on SaaS)**:
`2026-10-28-03-invite-lookup-without-org-scan.md`. Invite lookup scanned
every org. Fixed in #699.
- **X4 (low)**: `2026-10-28-04-snmp-community-secret-field.md`. The SNMP
community was not a secret field. Fixed in #699.
- **V1 (medium)**: `2026-10-27-01-device-consent-phishing-guard.md`.
Device-flow consent phishing. Fixed in #693.
- **W1 (low)**: `2026-10-27-02-disable-2fa-attempt-throttle.md`. `DELETE
/auth/2fa` had no attempt budget. Fixed in #693.
- **U1 (low)**:
`2026-10-26-02-ai-repair-hold-skips-param-only-secrets.md`. The `repair:
auto` hold applied only when the check's `secrets` map had a value.
Fixed in #683.
- **S1 (medium)**:
`2026-10-25-01-ai-repair-grant-dropped-by-reference-resolution.md`. The
repair grant was compared after `${…}` references were resolved. Fixed
in #678; U1 closed the remaining gap.
- **R1 (medium)**:
`2026-10-24-01-ai-repair-auto-apply-partial-runtime-host.md`. `repair:
auto` applied a candidate that kept a literal host and added one built
at runtime. Fixed in #663.
- **Q1 (medium)**:
`2026-10-23-02-ai-loop-secret-relay-through-model.md`. AI loops relayed
an encoded secret through the model.
- **P1 (medium)**:
`2026-10-22-01-ai-script-secret-host-guard-runtime.md`. AI runs with
real secrets were only host-checked by regex.
- **K1 (medium)**: `2026-10-20-01-sender-response-body-caps.md`.
Notification senders and RabbitMQ read responses uncapped.
- **J1 (medium)**: `2026-10-19-01-a2a-response-size-cap.md`. A2A
responses were read uncapped.
- **I1 (low)**: `2026-10-18-01-plugin-schema-file-ref.md`. Plugin schema
`$ref` could load local files.
- **G1/G2 (low)**: `2026-10-17-01-postgres-check-connection-config.md`.
Postgres conninfo escaping and fallback to the worker's `PG*` env.
- **F1**: `2026-10-16-15-pat-cache-revocation.md`. The PAT cache
outlived revocation.
- **E1**: `2026-10-16-14-totp-on-federated-sign-in.md`. No TOTP on
federated sign-in.
- **E2**: `2026-10-16-13-atomic-auth-attempt-counters.md`. Auth attempt
counters were not atomic.
- **H3**: `2026-10-16-12-mcp-tokens-rejected-on-rest.md`. MCP OAuth
tokens worked on REST.
- **H2**: `2026-10-16-11-slack-signature-fail-closed.md`. Slack
signature check failed open.
- **T1 / M2 (high)**: `2026-10-16-10-discovery-scans-egress-guard.md`.
Discovery scans were outside the egress policy.
- **N4**: `2026-10-16-09-js-check-nested-docker-guard.md`. A JS `docker`
sub-check bypassed the gate.
- **N3 (high)**: `2026-10-16-08-status-page-components-cross-org.md`.
Status-page components could be edited across orgs.
- **D2/D3 (high)**:
`2026-10-16-07-guard-status-subscriber-and-publication-webhooks.md`.
Subscriber and publication webhooks were not guarded.
- **C3**: `2026-10-16-06-accept-invite-existing-account.md`. Accepting
an invite logged in as an existing account.
- **C1**: `2026-10-16-05-kubeconfig-exec-and-incluster.md`. Kubeconfig
`exec` and `inCluster` were allowed.
- **N2**: `2026-10-16-04-mysql-dsn-injection.md`. MySQL DSN injection.
- **N1**: `2026-10-16-03-env-secret-reference-allowlist.md`. No
allowlist for `${env:}` references.
- **C2/H1**: `2026-10-16-02-token-purpose-separation.md`. Purpose tokens
were accepted as access tokens.
- **D1**: `2026-10-16-01-microsoft-signin-unverified-email-linking.md`.
Microsoft nOAuth email linking.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

---------

Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>

🤖 I have created a release *beep* *boop*
---


##
[0.42.1](v0.42.0...v0.42.1)
(2026-10-30)


### Bug Fixes

* **checkicmp:** socket-open failure is an infrastructure error
([#712](#712))
([208ff0a](208ff0a))
* **dash0:** explain chart Full range switch and status page visibility
hint ([#702](#702))
([9c6141b](9c6141b))
* **deps:** update github.com/dop251/goja digest to 5f913d1
([#697](#697))
([146cb22](146cb22))
* **deps:** update github.com/dop251/goja digest to 85be141
([#706](#706))
([c6abd8e](c6abd8e))
* **deps:** update github.com/dop251/goja digest to d535508
([#696](#696))
([7529c15](7529c15))
* **deps:** update github.com/dop251/goja digest to f818168
([#709](#709))
([7d03f42](7d03f42))
* **deps:** update go dependencies (non-major)
([#690](#690))
([6de8ac7](6de8ac7))
* **deps:** update go dependencies (non-major)
([#694](#694))
([0838916](0838916))
* **deps:** update go dependencies (non-major)
([#698](#698))
([ea540e8](ea540e8))
* **deps:** update go dependencies (non-major) to v0.37.2
([#704](#704))
([67da7f7](67da7f7))
* **deps:** update module github.com/posthog/posthog-go to v1.39.0
([#711](#711))
([b2a7f2c](b2a7f2c))
* **deps:** update module github.com/prometheus/common to v0.73.0
([#703](#703))
([1ac4dc8](1ac4dc8))
* **deps:** update module github.com/slack-go/slack to v0.32.0
([#707](#707))
([74db3d2](74db3d2))
* ICMP capability for workers, escalation targets on events, login bug
report and degraded incident fixes
([#701](#701))
([9613f98](9613f98))
* **security:** device consent phishing guard and 2FA disable throttle
([#693](#693))
([822186f](822186f))
* **security:** instance-wide budget and retention for anonymous
bug-report screenshots
([#708](#708))
([2be7787](2be7787))
* **security:** PAT org binding, subscribe throttle, invite lookup, SNMP
secret ([#699](#699))
([cdf59bb](cdf59bb))
* **security:** scope on-call override deletion to its schedule and org
([#714](#714))
([6708f03](6708f03))

---
This PR was generated with [Release
Please](https://github.com/googleapis/release-please). See
[documentation](https://github.com/googleapis/release-please#release-please).

…rawl reports (#715)

Specs filed from the daily security scans. Each spec is the tracker for
its finding. This PR files the specs and implements Z1 and Z2.

## Implemented by this PR (specs archived in `specs/done/2026/10/`)

- **Z1 (low)**:
`specs/todos/2026-10-30-02-bug-report-authenticated-org-membership.md`.
Y1 residual. The screenshot budget added in #708 applies only to
anonymous reports. A signed-in user who is not a member of the named org
bypasses it and stores screenshots in any org. The fix treats a
non-member's report like an anonymous one.
- **Z2 (low)**:
`specs/todos/2026-10-30-03-report-retention-spares-crawl-reports.md`.
The bug-report retention sweep added in #708 matches the whole `reports`
storage group, so it also deletes website crawl reports older than 90
days. The same group also makes crawl reports count against the
bug-report quota. The fix restricts both to topic-less files.

## Earlier scan specs (implemented, in `specs/done/2026/10/`)

- **Y1 (low)**: `2026-10-29-01-bug-report-upload-instance-budget.md`.
Anonymous bug-report screenshots were capped per org, not per instance,
and never deleted. Fixed in #708; Z1 and Z2 are follow-ups.
- **X1 (high)**:
`2026-10-28-01-pat-cannot-mint-sessions-or-sign-in-factors.md`. A PAT
could open sessions in its owner's other orgs and add sign-in factors.
Fixed in #699.
- **X2 (medium)**:
`2026-10-28-02-status-subscribe-throttle-and-keep-confirmed.md`.
Unthrottled subscribe confirm emails, and re-subscribing un-confirmed a
subscriber. Fixed in #699.
- **X3 (medium on SaaS)**:
`2026-10-28-03-invite-lookup-without-org-scan.md`. Invite lookup scanned
every org. Fixed in #699.
- **X4 (low)**: `2026-10-28-04-snmp-community-secret-field.md`. The SNMP
community was not a secret field. Fixed in #699.
- **V1 (medium)**: `2026-10-27-01-device-consent-phishing-guard.md`.
Device-flow consent phishing. Fixed in #693.
- **W1 (low)**: `2026-10-27-02-disable-2fa-attempt-throttle.md`. `DELETE
/auth/2fa` had no attempt budget. Fixed in #693.
- **U1 (low)**:
`2026-10-26-02-ai-repair-hold-skips-param-only-secrets.md`. The `repair:
auto` hold applied only when the check's `secrets` map had a value.
Fixed in #683.
- **S1 (medium)**:
`2026-10-25-01-ai-repair-grant-dropped-by-reference-resolution.md`. The
repair grant was compared after `${…}` references were resolved. Fixed
in #678; U1 closed the remaining gap.
- **R1 (medium)**:
`2026-10-24-01-ai-repair-auto-apply-partial-runtime-host.md`. `repair:
auto` applied a candidate that kept a literal host and added one built
at runtime. Fixed in #663.
- **Q1 (medium)**:
`2026-10-23-02-ai-loop-secret-relay-through-model.md`. AI loops relayed
an encoded secret through the model.
- **P1 (medium)**:
`2026-10-22-01-ai-script-secret-host-guard-runtime.md`. AI runs with
real secrets were only host-checked by regex.
- **K1 (medium)**: `2026-10-20-01-sender-response-body-caps.md`.
Notification senders and RabbitMQ read responses uncapped.
- **J1 (medium)**: `2026-10-19-01-a2a-response-size-cap.md`. A2A
responses were read uncapped.
- **I1 (low)**: `2026-10-18-01-plugin-schema-file-ref.md`. Plugin schema
`$ref` could load local files.
- **G1/G2 (low)**: `2026-10-17-01-postgres-check-connection-config.md`.
Postgres conninfo escaping and fallback to the worker's `PG*` env.
- **F1**: `2026-10-16-15-pat-cache-revocation.md`. The PAT cache
outlived revocation.
- **E1**: `2026-10-16-14-totp-on-federated-sign-in.md`. No TOTP on
federated sign-in.
- **E2**: `2026-10-16-13-atomic-auth-attempt-counters.md`. Auth attempt
counters were not atomic.
- **H3**: `2026-10-16-12-mcp-tokens-rejected-on-rest.md`. MCP OAuth
tokens worked on REST.
- **H2**: `2026-10-16-11-slack-signature-fail-closed.md`. Slack
signature check failed open.
- **T1 / M2 (high)**: `2026-10-16-10-discovery-scans-egress-guard.md`.
Discovery scans were outside the egress policy.
- **N4**: `2026-10-16-09-js-check-nested-docker-guard.md`. A JS `docker`
sub-check bypassed the gate.
- **N3 (high)**: `2026-10-16-08-status-page-components-cross-org.md`.
Status-page components could be edited across orgs.
- **D2/D3 (high)**:
`2026-10-16-07-guard-status-subscriber-and-publication-webhooks.md`.
Subscriber and publication webhooks were not guarded.
- **C3**: `2026-10-16-06-accept-invite-existing-account.md`. Accepting
an invite logged in as an existing account.
- **C1**: `2026-10-16-05-kubeconfig-exec-and-incluster.md`. Kubeconfig
`exec` and `inCluster` were allowed.
- **N2**: `2026-10-16-04-mysql-dsn-injection.md`. MySQL DSN injection.
- **N1**: `2026-10-16-03-env-secret-reference-allowlist.md`. No
allowlist for `${env:}` references.
- **C2/H1**: `2026-10-16-02-token-purpose-separation.md`. Purpose tokens
were accepted as access tokens.
- **D1**: `2026-10-16-01-microsoft-signin-unverified-email-linking.md`.
Microsoft nOAuth email linking.

## What changed

- **Z1**: a signed-in user who is not a member of the named org (and not
a super admin) now spends the anonymous screenshot budget and needs a
dispatch slot. Text-only reports still go through.
- **Z2**: `ListFilesByGroup` and `SumFileSizeByGroup` only match
topic-less files, so retention no longer purges crawl reports and they
no longer use the screenshot quota.

## Decided by autopilot

- Z1 spec, open question (refuse a non-member with 403, or treat as
anonymous?): treat as anonymous (recommended answer).

🤖 Generated with [Claude Code](https://claude.com/claude-code)

---------

Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>

…-in factors (#728)

## What changed

- **AA1 (medium)**: a JS check now has a 64 MiB per-run memory budget on
the native builtins that allocate in one call (`repeat`, `padStart/End`,
`join`, `Array(n)`, `ArrayBuffer` and typed arrays, `fill`,
`Array.from`, and the length-driven `sort`, `toSorted`, `map`, `with`,
`toReversed`, `toSpliced`). A refused call throws a `RangeError` and the
worker keeps running. Spec:
`specs/done/2026/10/2026-10-31-01-js-checker-memory-budget.md`.
- **AA2 (low)**: turning on TOTP, registering a passkey and setting a
first password now need the current password (or, without one, a sign-in
within 10 minutes). `2fa/confirm` requires a `setupToken`, and a
`totp-enabled` notice email is sent. dash0 asks for the password first.
Spec:
`specs/done/2026/10/2026-10-31-02-sign-in-factor-enrollment-reauth.md`.

**Breaking API change**: `2fa/setup` and `passkeys/register/begin`
refuse a request without `currentPassword` on accounts with a password;
`2fa/confirm` needs `setupToken`. Sessions issued before this have no
sign-in time, so passwordless accounts must sign in again once.

Known gaps (not covered): string `+` doubling, `replaceAll`,
`JSON.stringify` and `TextEncoder` can still amplify; the long-term fix
is process isolation of check workers (separate spec).

## Earlier scan specs (implemented, in `specs/done/2026/10/`)

- **Z1 (low)**:
`2026-10-30-02-bug-report-authenticated-org-membership.md`. Signed-in
non-members skipped the bug-report screenshot budget. Fixed in #715.
- **Z2 (low)**:
`2026-10-30-03-report-retention-spares-crawl-reports.md`. The report
retention sweep also deleted website crawl reports. Fixed in #715.
- **Y1 (low)**: `2026-10-29-01-bug-report-upload-instance-budget.md`.
Anonymous bug-report screenshots were capped per org, not per instance,
and never deleted. Fixed in #708; Z1 and Z2 are follow-ups.
- **X1 (high)**:
`2026-10-28-01-pat-cannot-mint-sessions-or-sign-in-factors.md`. A PAT
could open sessions in its owner's other orgs and add sign-in factors.
Fixed in #699.
- **X2 (medium)**:
`2026-10-28-02-status-subscribe-throttle-and-keep-confirmed.md`.
Unthrottled subscribe confirm emails, and re-subscribing un-confirmed a
subscriber. Fixed in #699.
- **X3 (medium on SaaS)**:
`2026-10-28-03-invite-lookup-without-org-scan.md`. Invite lookup scanned
every org. Fixed in #699.
- **X4 (low)**: `2026-10-28-04-snmp-community-secret-field.md`. The SNMP
community was not a secret field. Fixed in #699.
- **V1 (medium)**: `2026-10-27-01-device-consent-phishing-guard.md`.
Device-flow consent phishing. Fixed in #693.
- **W1 (low)**: `2026-10-27-02-disable-2fa-attempt-throttle.md`. `DELETE
/auth/2fa` had no attempt budget. Fixed in #693.
- **U1 (low)**:
`2026-10-26-02-ai-repair-hold-skips-param-only-secrets.md`. The `repair:
auto` hold applied only when the check's `secrets` map had a value.
Fixed in #683.
- **S1 (medium)**:
`2026-10-25-01-ai-repair-grant-dropped-by-reference-resolution.md`. The
repair grant was compared after `${…}` references were resolved. Fixed
in #678; U1 closed the remaining gap.
- **R1 (medium)**:
`2026-10-24-01-ai-repair-auto-apply-partial-runtime-host.md`. `repair:
auto` applied a candidate that kept a literal host and added one built
at runtime. Fixed in #663.
- **Q1 (medium)**:
`2026-10-23-02-ai-loop-secret-relay-through-model.md`. AI loops relayed
an encoded secret through the model.
- **P1 (medium)**:
`2026-10-22-01-ai-script-secret-host-guard-runtime.md`. AI runs with
real secrets were only host-checked by regex.
- **K1 (medium)**: `2026-10-20-01-sender-response-body-caps.md`.
Notification senders and RabbitMQ read responses uncapped.
- **J1 (medium)**: `2026-10-19-01-a2a-response-size-cap.md`. A2A
responses were read uncapped.
- **I1 (low)**: `2026-10-18-01-plugin-schema-file-ref.md`. Plugin schema
`$ref` could load local files.
- **G1/G2 (low)**: `2026-10-17-01-postgres-check-connection-config.md`.
Postgres conninfo escaping and fallback to the worker's `PG*` env.
- **F1**: `2026-10-16-15-pat-cache-revocation.md`. The PAT cache
outlived revocation.
- **E1**: `2026-10-16-14-totp-on-federated-sign-in.md`. No TOTP on
federated sign-in.
- **E2**: `2026-10-16-13-atomic-auth-attempt-counters.md`. Auth attempt
counters were not atomic.
- **H3**: `2026-10-16-12-mcp-tokens-rejected-on-rest.md`. MCP OAuth
tokens worked on REST.
- **H2**: `2026-10-16-11-slack-signature-fail-closed.md`. Slack
signature check failed open.
- **T1 / M2 (high)**: `2026-10-16-10-discovery-scans-egress-guard.md`.
Discovery scans were outside the egress policy.
- **N4**: `2026-10-16-09-js-check-nested-docker-guard.md`. A JS `docker`
sub-check bypassed the gate.
- **N3 (high)**: `2026-10-16-08-status-page-components-cross-org.md`.
Status-page components could be edited across orgs.
- **D2/D3 (high)**:
`2026-10-16-07-guard-status-subscriber-and-publication-webhooks.md`.
Subscriber and publication webhooks were not guarded.
- **C3**: `2026-10-16-06-accept-invite-existing-account.md`. Accepting
an invite logged in as an existing account.
- **C1**: `2026-10-16-05-kubeconfig-exec-and-incluster.md`. Kubeconfig
`exec` and `inCluster` were allowed.
- **N2**: `2026-10-16-04-mysql-dsn-injection.md`. MySQL DSN injection.
- **N1**: `2026-10-16-03-env-secret-reference-allowlist.md`. No
allowlist for `${env:}` references.
- **C2/H1**: `2026-10-16-02-token-purpose-separation.md`. Purpose tokens
were accepted as access tokens.
- **D1**: `2026-10-16-01-microsoft-signin-unverified-email-linking.md`.
Microsoft nOAuth email linking.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

---------

Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>