docs(security): record P0#1-3 + P1 SSRF remediation as resolved in April audit

cb9d8932cf7104670ccfd6fb6addba74cdde78ca · 2026-07-12 11:28:02 -0700 · Steve Abrams

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Files touched

M docs/security-audit-2026-04.md

Diff

commit cb9d8932cf7104670ccfd6fb6addba74cdde78ca
Author: Steve Abrams <steve@designerwallcoverings.com>
Date:   Sun Jul 12 11:28:02 2026 -0700

    docs(security): record P0#1-3 + P1 SSRF remediation as resolved in April audit
    
    Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
---
 docs/security-audit-2026-04.md | 1 +
 1 file changed, 1 insertion(+)

diff --git a/docs/security-audit-2026-04.md b/docs/security-audit-2026-04.md
index d3d4065..64fd833 100644
--- a/docs/security-audit-2026-04.md
+++ b/docs/security-audit-2026-04.md
@@ -121,3 +121,4 @@ done
 | Date | Author | Notes |
 |------|--------|--------|
 | 2026-04-12 | Audit (automated + manual) | Initial document from full review + mechanical API pass |
+| 2026-07-12 | vp-security | P0/P1 remediation pass. **P0#1 (gmail/contacts auth):** RESOLVED — `requireRole(req,'admin','staff')` present; verified unauth→307 redirect, bad-sig cookie→401, valid admin→200. **P0#2 (hardcoded cron Basic creds):** RESOLVED — creds now read from env in `lib/cron-auth.ts` (`AUTH_USERNAME`/`AUTH_PASSWORD`), no literal password in source; `buildInternalAuthHeader()` returns '' if unset. **P0#3 (default fallback secrets):** RESOLVED — `SESSION_SECRET` throws at load if unset (`lib/auth.ts`); `WEBHOOK_SECRET` fails closed (`webhooks/pulse-topic` → 500 if unset); `CRON_SECRET` has no predictable string fallback (env→env only). `.env.local` (gitignored) carries strong values so the app boots. **P1#6 (SSRF):** RESOLVED — new `lib/ssrf-guard.ts` `assertPublicUrl()` wired into `nonprofit/enrich` + `email-analyzer/fetch-url`; blocks non-http(s), localhost, RFC1918, loopback, link-local/metadata (169.254.169.254), reserved ranges, and DNS-resolves hostnames; verified private/reserved/file://→400, public→200. Still OPEN: P1#4 (SHA-256 legacy — bcrypt now used for new hashes, auto-rehash on login), P2 items (build gates, CSP, distributed rate-limit). |

← 10f2f97 security(P1): add shared SSRF guard blocking private/reserve · back to Norma · chore: version bump (session close — SSRF guard + security P c7157cf →