[Security Review] Daily Security Review — 2026-06-24

[github-actions[bot]]

📊 Executive Summary

AWF v0.23.1 | Review Date: 2026-06-24 | Posture: Good

No critical/high CVEs. Defence-in-depth across 5 layers is well-implemented. 10 threats identified; none critical.

Metric	Value
Security-critical lines analyzed	3,701
Attack surfaces	8
npm critical/high CVEs	0
STRIDE categories covered	6/6
Defence layers	5

---

🔍 Escape Test Findings

From Secret Digger (Copilot) run (2026-04-11, 24273493151):

• GH_AW_SECRET_VERIFICATION_RESULT: success — credentials NOT accessible to agent ✅
• GH_AW_AGENT_CONCLUSION: success + noop-only outputs — no secrets found
• GH_AW_LOCKDOWN_CHECK_FAILED: false

The credential-isolation architecture (tmpfs overlays + API proxy injection) is working correctly.

---

🛡️ Architecture Analysis

5-layer network control (confirmed by code analysis):

1. Host iptables (src/host-iptables-rules.ts) — only Squid source, ESTABLISHED, DNS whitelisted
2. Container iptables (containers/agent/setup-iptables.sh) — DNAT 80/443→Squid, IPv6 disabled, dangerous ports blocked
3. Squid ACL (src/squid/config-generator.ts) — domain allowlist, raw-IP block (dst_ipv4/dst_ipv6 ACLs), forwarded_for delete
4. Capability drop (entrypoint.sh) — capsh drops SYS_CHROOT+SYS_ADMIN before user code
5. Seccomp (seccomp-profile.json) — defaultAction: SCMP_ACT_ERRNO

Domain injection prevention (src/domain-validation.ts): dangerous chars /[\s\0"';#\]/, over-broad pattern rejection (, .), structural validity, ReDoS-safe regex [a-zA-Z0-9.-](not.*`).

No shell injection confirmed: grep -rn "shell: true" src/ → 0 results. Custom ESLint rule no-unsafe-execa enforced project-wide.

---

⚠️ Threat Model

#	STRIDE	Threat	Likelihood	Impact
T1	EoP	SYS_ADMIN capability window before capsh drop (agent-service.ts:76)	Low	High
T2	EoP	--enable-dind Docker socket = full firewall bypass (security-options.ts:29-32)	Med (when used)	Critical
T3	InfoDisc	API proxy at 172.30.0.30 unauthenticated (by design)	Low	Medium
T4	InfoDisc	procfs/self/environ readable by agent; hidepid=2 only covers other pids	Low	Medium
T5	Tampering	User-Agent log injection in Squid access.log (unescaped %{User-Agent}>h)	Medium	Low
T6	DoS	No Squid delay_pools rate limiting → exfiltration via allowed domains	Low	Medium
T7	InfoDisc	SSL Bump CA key on disk if tmpfs fails (silent logger.debug fallback, ssl-bump.ts:68)	Low	High
T8	Spoofing	Unicode homograph domains pass validation (no IDN check)	Low	Medium
T9	Repudiation	1× eslint-disable no-unsafe-execa at log-discovery.ts:155	Low	Low
T10	EoP	AWF_USER_UID/GID validated ≠ 0 but no upper-bound check	Low	Low

---

🎯 Attack Surface Map

Surface	Entry Point	Risk
--allow-domains CLI input	src/domain-validation.ts	Low
Squid proxy port 3128	src/squid/config-generator.ts	Low
Container iptables DNAT	containers/agent/setup-iptables.sh	Low
Agent entrypoint (SYS_ADMIN window)	containers/agent/entrypoint.sh	Medium
Docker socket (DinD disabled by default)	src/services/agent-volumes/docker-socket.ts	High when enabled
API proxy sidecar (no inbound auth)	containers/api-proxy/server.js	Medium
--allow-domains-file	src/commands/preflight.ts:80	Low
Squid access.log User-Agent field	src/squid/config-generator.ts logformat	Low

---

✅ Recommendations

🟠 High

H1 — Add delay_pools rate limiting to Squid config to prevent high-throughput exfiltration via allowed domains.

H2 — Investigate replacing SYS_ADMIN + capsh drop with a dedicated setuid helper or user-namespace remapping to eliminate the capability window at container startup.

🟡 Medium

M1 — Add non-ASCII rejection to src/domain-validation.ts to block Unicode homograph domains:
if (/[^\x00-\x7F]/.test(trimmed)) throw new Error(...)

M2 — Truncate or escape %{User-Agent}>h in Squid access.log logformat to prevent log injection. JSONL audit log already omits User-Agent correctly.

M3 — Elevate ssl-bump.ts:68 fallback from logger.debug → logger.warn so disk-stored CA keys are visible to operators.

M4 — Require an explicit second flag (e.g. --accept-dind-firewall-bypass) with --enable-dind to prevent accidental use.

🟢 Low

L1 — Fix pkg.targets: node18-* inconsistency vs engines.node: >=20.19.0.
L2 — Add CI count-guard on eslint-disable local/no-unsafe-execa comments.
L3 — Restrict API proxy http_access allow in generated Squid config to originate from agent IP only (172.30.0.20).

Generated by Daily Security Review and Threat Modeling · 89.3 AIC · ⊞ 6.9K · ◷

• expires on Jul 1, 2026, 1:11 PM UTC

[github-actions[bot]]

🔮 The ancient spirits stir: the smoke test agent was here, the run was observed, and the firewall held its form.

🔮 The oracle has spoken through Smoke Codex

[github-actions[bot]]

🔮 The ancient spirits stir. The smoke test agent was here, and the omens read clean.

🔮 The oracle has spoken through Smoke Codex

[github-actions[bot]]

🔮 The ancient spirits stir; the smoke test agent passed through, and this discussion now bears the whisper of validation.

Warning

Firewall blocked 1 domain

The following domain was blocked by the firewall during workflow execution:

• registry.npmjs.org

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "registry.npmjs.org"

See Network Configuration for more information.

🔮 The oracle has spoken through Smoke Codex

[github-actions[bot]]

This discussion was automatically closed because it expired on 2026-07-01T13:11:23.021Z.

Closed by Workflow