[fclairamb]

Specs filed from the daily security scans. Each spec is the tracker for its finding.

What changed (specs implemented by this PR)

• AC2 (medium): specs/todos/2026-11-02-01-js-checker-memory-budget-residuals.md. Even after fix(security): JS check memory budget gaps and regexp time limit, Discord link re-authentication, invitation cap #735, one native call in a JS check can allocate GBs: JSON.stringify, toLocaleString, normalize, String.raw, the URI encoders, and ropes flattened by JSON.parse, by a thrown error (which also stores a huge error string with the result) or hidden deeper than the scan's depth cap. Now charged, with the rest of the amplifying builtins; the thrown error text is capped at 16 KiB. Process isolation is filed as AC7.

• AC3 (medium): specs/todos/2026-11-02-02-js-checker-regexp-total-time.md. The 2 s regexp limit of fix(security): JS check memory budget gaps and regexp time limit, Discord link re-authentication, invitation cap #735 applies to each match. A global replace chains slow matches into hours of CPU in one call that the timeout cannot stop. Now bounded for the whole run.

• AC4 (low): specs/todos/2026-11-02-03-crawl-finding-url-scheme.md. Sitemap URLs from robots.txt and sitemap indexes skip the http(s) filter, so a crawled site can plant a javascript: link in a check's findings. The dashboard CSP blocks it today. Now filtered in the crawler, and dash0 renders only http(s) links.

• AC5 (low): specs/todos/2026-11-02-04-status-page-subscribers-admin-only.md. Viewers can list a status page's subscriber email addresses. The list is now admin-only (breaking for viewer/user API clients).

• AC6 (low): specs/todos/2026-11-02-05-password-reset-tokens-purged-on-change.md. Outstanding password-reset links survive a password change, a reset and an email change. Reset links are now deleted on each of these.

• AC7 (medium): specs/todos/2026-11-02-06-js-checker-process-isolation.md. Each JS script now runs in a memory-limited child process of the same binary (heap watchdog, RLIMIT_AS, optional cgroup, kill at timeout); bindings stay served by the parent. A killed child gives an error/timeout result, the parent never crashes. SP_JS_ISOLATION=off, SP_JS_MEMORY_LIMIT_MB, SP_JS_CGROUP documented. About 11-27 ms overhead per run on macOS.

Decided by autopilot

• AC5 (subscribers admin only), open question "should user members keep the list?": no, admin only (recommended answer).

Earlier scan specs (implemented, in specs/done/2026/10/ and specs/done/2026/11/)

• AB1 (medium): 2026-11-01-01-js-checker-memory-budget-gaps.md. The JS memory budget missed ropes, dense-array copies, split, replace and typed arrays. Fixed in fix(security): JS check memory budget gaps and regexp time limit, Discord link re-authentication, invitation cap #735; AC2 covers what is left.
• AB2 (medium): 2026-11-01-02-js-checker-regexp-timeout.md. A backtracking JS regexp had no time limit. Fixed in fix(security): JS check memory budget gaps and regexp time limit, Discord link re-authentication, invitation cap #735 with a per-match limit; AC3 bounds a whole call.
• AB3 (low): 2026-11-01-03-discord-link-reauth.md. Linking Discord needed no re-authentication. Fixed in fix(security): JS check memory budget gaps and regexp time limit, Discord link re-authentication, invitation cap #735.
• AB4 (low): 2026-11-01-04-invitation-cap-and-keyed-lookups.md. Uncapped invitations and instance-wide invitation scans at sign-in. Fixed in fix(security): JS check memory budget gaps and regexp time limit, Discord link re-authentication, invitation cap #735.
• AA1 (medium): 2026-10-31-01-js-checker-memory-budget.md. A JS check had no memory budget: one native builtin call could OOM-kill a shared worker. Fixed in fix(security): JS check memory budget, re-authentication for new sign-in factors #728; AB1 closes its residuals.
• AA2 (low): 2026-10-31-02-sign-in-factor-enrollment-reauth.md. Turning on TOTP and registering a passkey needed no re-authentication. Fixed in fix(security): JS check memory budget, re-authentication for new sign-in factors #728; AB3 covers the Discord link.
• Z1 (low): 2026-10-30-02-bug-report-authenticated-org-membership.md. Signed-in non-members skipped the bug-report screenshot budget. Fixed in fix(security): bug-report budget for non-members, retention sparing crawl reports #715.
• Z2 (low): 2026-10-30-03-report-retention-spares-crawl-reports.md. The report retention sweep also deleted website crawl reports. Fixed in fix(security): bug-report budget for non-members, retention sparing crawl reports #715.
• Y1 (low): 2026-10-29-01-bug-report-upload-instance-budget.md. Anonymous bug-report screenshots were capped per org, not per instance, and never deleted. Fixed in fix(security): instance-wide budget and retention for anonymous bug-report screenshots #708; Z1 and Z2 are follow-ups.
• X1 (high): 2026-10-28-01-pat-cannot-mint-sessions-or-sign-in-factors.md. A PAT could open sessions in its owner's other orgs and add sign-in factors. Fixed in fix(security): PAT org binding, subscribe throttle, invite lookup, SNMP secret #699.
• X2 (medium): 2026-10-28-02-status-subscribe-throttle-and-keep-confirmed.md. Unthrottled subscribe confirm emails, and re-subscribing un-confirmed a subscriber. Fixed in fix(security): PAT org binding, subscribe throttle, invite lookup, SNMP secret #699.
• X3 (medium on SaaS): 2026-10-28-03-invite-lookup-without-org-scan.md. Invite lookup scanned every org. Fixed in fix(security): PAT org binding, subscribe throttle, invite lookup, SNMP secret #699.
• X4 (low): 2026-10-28-04-snmp-community-secret-field.md. The SNMP community was not a secret field. Fixed in fix(security): PAT org binding, subscribe throttle, invite lookup, SNMP secret #699.
• V1 (medium): 2026-10-27-01-device-consent-phishing-guard.md. Device-flow consent phishing. Fixed in fix(security): device consent phishing guard and 2FA disable throttle #693.
• W1 (low): 2026-10-27-02-disable-2fa-attempt-throttle.md. DELETE /auth/2fa had no attempt budget. Fixed in fix(security): device consent phishing guard and 2FA disable throttle #693.
• U1 (low): 2026-10-26-02-ai-repair-hold-skips-param-only-secrets.md. The repair: auto hold applied only when the check's secrets map had a value. Fixed in fix(ai): hold every scheduled repair-auto run to its granted hosts #683.
• S1 (medium): 2026-10-25-01-ai-repair-grant-dropped-by-reference-resolution.md. The repair grant was compared after ${…} references were resolved. Fixed in fix(ai): hold the repair: auto host grant when the script or env holds a reference #678; U1 closed the remaining gap.
• R1 (medium): 2026-10-24-01-ai-repair-auto-apply-partial-runtime-host.md. repair: auto applied a candidate that kept a literal host and added one built at runtime. Fixed in feat(ai): hold auto-applied repairs to the previous version's hosts (+ scan specs) #663.
• Q1 (medium): 2026-10-23-02-ai-loop-secret-relay-through-model.md. AI loops relayed an encoded secret through the model.
• P1 (medium): 2026-10-22-01-ai-script-secret-host-guard-runtime.md. AI runs with real secrets were only host-checked by regex.
• K1 (medium): 2026-10-20-01-sender-response-body-caps.md. Notification senders and RabbitMQ read responses uncapped.
• J1 (medium): 2026-10-19-01-a2a-response-size-cap.md. A2A responses were read uncapped.
• I1 (low): 2026-10-18-01-plugin-schema-file-ref.md. Plugin schema $ref could load local files.
• G1/G2 (low): 2026-10-17-01-postgres-check-connection-config.md. Postgres conninfo escaping and fallback to the worker's PG* env.
• F1: 2026-10-16-15-pat-cache-revocation.md. The PAT cache outlived revocation.
• E1: 2026-10-16-14-totp-on-federated-sign-in.md. No TOTP on federated sign-in.
• E2: 2026-10-16-13-atomic-auth-attempt-counters.md. Auth attempt counters were not atomic.
• H3: 2026-10-16-12-mcp-tokens-rejected-on-rest.md. MCP OAuth tokens worked on REST.
• H2: 2026-10-16-11-slack-signature-fail-closed.md. Slack signature check failed open.
• T1 / M2 (high): 2026-10-16-10-discovery-scans-egress-guard.md. Discovery scans were outside the egress policy.
• N4: 2026-10-16-09-js-check-nested-docker-guard.md. A JS docker sub-check bypassed the gate.
• N3 (high): 2026-10-16-08-status-page-components-cross-org.md. Status-page components could be edited across orgs.
• D2/D3 (high): 2026-10-16-07-guard-status-subscriber-and-publication-webhooks.md. Subscriber and publication webhooks were not guarded.
• C3: 2026-10-16-06-accept-invite-existing-account.md. Accepting an invite logged in as an existing account.
• C1: 2026-10-16-05-kubeconfig-exec-and-incluster.md. Kubeconfig exec and inCluster were allowed.
• N2: 2026-10-16-04-mysql-dsn-injection.md. MySQL DSN injection.
• N1: 2026-10-16-03-env-secret-reference-allowlist.md. No allowlist for ${env:} references.
• C2/H1: 2026-10-16-02-token-purpose-separation.md. Purpose tokens were accepted as access tokens.
• D1: 2026-10-16-01-microsoft-signin-unverified-email-linking.md. Microsoft nOAuth email linking.

🤖 Generated with Claude Code

[codecov]

Codecov Report

❌ Patch coverage is 33.50694% with 766 lines in your changes missing coverage. Please review.
✅ Project coverage is 88.97%. Comparing base (061eca0) to head (eb2914e).

Files with missing lines	Patch %	Lines
...erver/internal/checkers/checkjs/memory_builtins.go	10.67%	293 Missing ⚠️
...erver/internal/checkers/checkjs/regexp_deadline.go	8.21%	190 Missing ⚠️
...erver/internal/checkers/checkjs/isolation_child.go	1.80%	109 Missing ⚠️
server/internal/checkers/checkjs/isolation.go	73.89%	71 Missing ⚠️
...nternal/checkers/checkjs/isolation_limits_linux.go	5.88%	48 Missing ⚠️
...erver/internal/checkers/checkjs/memory_bindings.go	37.50%	25 Missing ⚠️
server/internal/checkers/checkjs/isolation_wire.go	69.76%	13 Missing ⚠️
server/internal/handlers/auth/service.go	79.59%	10 Missing ⚠️
server/internal/checkers/checkjs/checker.go	76.66%	7 Missing ⚠️

❌ Your patch check has failed because the patch coverage (33.50%) is below the target coverage (87.00%). You can increase the patch coverage or adjust the target coverage.

Additional details and impacted files

@@            Coverage Diff             @@
##             main     #742      +/-   ##
==========================================
- Coverage   89.79%   88.97%   -0.83%     
==========================================
  Files        1311     1317       +6     
  Lines      133570   134677    +1107     
==========================================
- Hits       119940   119827     -113     
- Misses      13621    14841    +1220     
  Partials        9        9              

Files with missing lines	Coverage Δ
server/internal/app/server.go	92.04% <100.00%> (+0.01%)	⬆️
server/internal/checkers/checkcrawl/crawl.go	84.10% <100.00%> (+1.34%)	⬆️
server/internal/checkers/checkjs/memory.go	24.93% <100.00%> (-66.96%)	⬇️
server/internal/checkers/checkjs/memory_strings.go	22.50% <100.00%> (-68.72%)	⬇️
server/internal/checkers/checkjs/regexp.go	75.00% <100.00%> (-25.00%)	⬇️
server/internal/envcheck/envcheck.go	87.67% <100.00%> (+0.71%)	⬆️
server/internal/handlers/auth/email_change.go	89.85% <100.00%> (+0.07%)	⬆️
server/internal/checkers/checkjs/checker.go	81.03% <76.66%> (-11.18%)	⬇️
server/internal/handlers/auth/service.go	90.10% <79.59%> (-0.10%)	⬇️
server/internal/checkers/checkjs/isolation_wire.go	69.76% <69.76%> (ø)
... and 6 more

... and 22 files with indirect coverage changes

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.