From 2349ef9d59cc1a409bb9e838e0dd526b8ac308b9 Mon Sep 17 00:00:00 2001 From: robbond Date: Thu, 10 Sep 2026 14:21:10 +0100 Subject: [PATCH] docs(confidence-engine): close pre-tester security review --- docs/current-handoff.md | 45 +++++++++++++++++++++++++++++++++++ docs/current-project-state.md | 29 ++++++++++++++++++++++ 2 files changed, 74 insertions(+) diff --git a/docs/current-handoff.md b/docs/current-handoff.md index c62509a..9897939 100644 --- a/docs/current-handoff.md +++ b/docs/current-handoff.md @@ -134,6 +134,51 @@ Jenkins SCM branch used to load the Jenkinsfile is conceptually separate from th - No punctuation/HTML/SQL-style content stripping introduced. - Reasoning semantics unchanged. +## Pre-Tester Input Security Review + +**Status:** closed — sufficient for controlled external-user testing. Not a general security audit, penetration test, or production-launch certification. + +### SQL injection +- No raw request-driven SQL construction found. +- Persistence uses Supabase/PostgREST query-builder boundaries. +- SQL-character stripping / sanitisation is not warranted. + +### XSS +- Normal user-controlled text is React-escaped. +- No user-controlled unsafe HTML sink found. +- HTML / script stripping of prose is not warranted. + +### Reasoning error disclosure +- Browser-facing reasoning errors have been sanitised (commit `2cb2d55`). + +### Focused user input +- Bounded to 10,000 characters server-side on `/api/focused-investigation/deconstruct`. +- UI exposes matching `maxLength` and character counter (commit `a6796c6`). + +### Investigation snapshot size +- Authenticated persistence envelope currently lacks a whole-snapshot size ceiling. +- Not classified as an outstanding pre-tester blocker. +- Legitimate investigation size / turn depth is not yet known. +- No arbitrary product ceiling imposed before real-user evidence exists. +- Monitor snapshot growth later via metadata (serialized bytes / revision / contribution count) without logging investigation content. +- Malformed-envelope / runtime validation remains a separate future hardening opportunity. + +### Prompt injection +- Assessed as **low risk under the current architecture** — not claimed to be impossible or "solved". +- Untrusted scenario / answer / persisted text can influence model reasoning. +- No evidence it gains application authority: no model-accessible arbitrary tools, DB targeting, auth identity control, ownership bypass, deletion, or arbitrary external requests found. +- Model/provider configuration is server-owned; model output passes through parsing/structured validation/domain boundaries before application mutation. +- No prompt-injection phrase / keyword filtering warranted; do not strip instruction-like natural-language content. +- Not a pre-tester blocker. + +### Deferred non-security observations (backlog only — no code change) +- Orchestrator update flow contains an implicitly correct but indent-control-flow-unclear fall-through / else structure worth cleaning up later. +- Investigation overview validation may accept unexpected extra fields. +- Provider JSON recovery is intentionally/permissively capable of recovering malformed JSON; may merit a future robustness review. + +### Tester-readiness position +Identified MEDIUM pre-tester security work is sufficiently addressed for controlled external-user testing. The application has **not** been generally security-audited, penetration-tested, or certified as production-secure or commercially launch-ready. + ## CURRENT MVP DIRECTION Initial-decomposition hardening is frozen for the current MVP stage. diff --git a/docs/current-project-state.md b/docs/current-project-state.md index 27d8922..013025d 100644 --- a/docs/current-project-state.md +++ b/docs/current-project-state.md @@ -287,6 +287,35 @@ The following material learnings are carried forward as durable context for safe User-selected/active investigation ownership must survive substantive ties and question-formulation rejection. (Already documented in `docs/current-handoff.md`.) +## 11. Pre-Tester Input Security Review (closed) + +**Status:** closed — sufficient for controlled external-user testing. Not a general security audit, penetration test, or production-launch certification. + +### SQL injection +- No raw request-driven SQL construction found; persistence uses Supabase/PostgREST query-builder boundaries. + +### XSS +- Normal user-controlled text is React-escaped; no unsafe HTML sink found. + +### Reasoning error disclosure +- Browser-facing reasoning errors sanitised (commit `2cb2d55`). + +### Focused input bound +- 10,000-character server-side + UI boundary on focused investigation (commit `a6796c6`). + +### Investigation snapshot size envelope +- Authenticated persistence lacks a whole-snapshot size ceiling. Not a pre-tester blocker — legitimate size/depth is unknown; monitor via metadata later without logging content. + +### Prompt injection +- **Low risk under the current architecture.** Untrusted text can influence model reasoning but no evidence it gains application authority. No model-accessible arbitrary tools, DB targeting, auth control, or privileged side effects found. Output passes structured validation before application mutation. Not a pre-tester blocker. + +### Deferred non-security observations +- Orchestrator update flow indentation/control-flow clarity deferred. +- Investigation overview validation may accept unexpected extra fields. +- Provider JSON recovery permissiveness deferred as future robustness review. + +--- + ### RTO learning from Experiments 14–17 Since the handoff document was written, further learning has emerged from Return-to-Origin work (RTO.14–17):