chore(security): full-codebase security audit — hardening sweep

[SoundMindsAI]

Summary

A full-codebase security audit (backend API/services/agent/workers, frontend, CI/CD + container/infra, secrets + LLM surfaces) plus automated scanners (Bandit, pip-audit, pnpm audit, gitleaks, tracked-file secret scan). No critical or high-severity vulnerabilities were found — the codebase has an unusually strong posture (SandboxedEnvironment for all templates, constant-time HMAC webhook verification, git tokens injected via process env not argv, path-traversal containment checks, SHA-pinned actions, least-privilege CI tokens, non-root digest-pinned containers, loopback-only port binds, file-mounted secrets).

This PR fixes the safely-fixable low/medium residual-risk items inline and captures the design-level items (that need a product/UX decision or coordinated Dependabot work) as idea files. Because a security audit is inherently cross-cutting, this PR intentionally spans backend, frontend, CI, and scripts.

Fixes applied

#	Sev	Area	Fix
1	Med	Frontend	Clickjacking / security headers — the no-auth localhost control plane (Open PR, launch study, demo reset buttons) shipped zero HTTP security headers. Added X-Frame-Options: DENY, CSP frame-ancestors 'none', X-Content-Type-Options: nosniff, Referrer-Policy in next.config.mjs.
2	Med	CI	Unverified gitleaks binary — the secrets-scan job downloaded the gitleaks release asset with no checksum (release assets are mutable even under a fixed tag). Added a sha256sum --check gate against the upstream-published digest before extract/exec.
3	High/Med	Deps	Dependabot alerts — bumped undici (high, WS DoS → ≥7.28.0) and js-yaml (med, quadratic DoS → ≥4.2.0) via pnpm.overrides. Both dev-only transitive (jsdom/vitest, eslint); cleared both open alerts.
4	Low	Backend	Log scrubber coverage — the global structlog redactor covered only GitHub PATs. Extended it to OpenAI keys (sk-*, incl. sk-proj-/sk-svcacct-) as the CLAUDE.md Rule #10 defense-in-depth backstop. New [REDACTED-OPENAI-KEY] placeholder + unit tests.
5	Low	Frontend	javascript: link bypass — the guide markdown link resolver supplied a custom urlTransform, which disables react-markdown's built-in scheme allowlist. Chained defaultUrlTransform so javascript:/data: links render inert.
6	Low	Frontend	Unvalidated pr_url href — only render proposal.pr_url as a live <a href> when it is https://.
7	Low	Scripts	Corp-CA trust-on-first-use — corp-ca-extract.sh silently trusted whatever CA was MITM-ing the connection. Now prints the CA SHA256 fingerprint and requires explicit confirmation (--yes / RELYLOOP_CORP_CA_ASSUME_YES=1 for automation; refuses on a non-interactive shell) before installing it.
8	Low	Backend/Agent	SSE worker pinning — bounded the chat orchestrator's AsyncOpenAI client with an operator-tunable per-request timeout (OPENAI_CHAT_HTTP_TIMEOUT_S, default 120s) so a slow/hostile OPENAI_BASE_URL can't hold a streaming worker for the SDK's 600s default across the tool loop.
9	Low	CI	One unpinned action — SHA-pinned the sole tag-pinned action (actions/checkout@v4 in the reconcile workflow, to the repo's existing v4 SHA) and routed its dry_run input through env: for consistency with the dco.yml convention.

Deferred (captured as idea files)

These need a product/UX decision or coordinated Dependabot work, so per the CLAUDE.md inline-vs-idea rubric they're filed rather than forced into this PR:

• 02_mvp2/bug_agent_confirmation_binds_tool_name_not_args — the chat confirmation gate binds the tool name (recently hardened) but not the tool arguments, so a confirmed mutation could theoretically fire against a different resource ID than the human approved. Needs a UX decision on how the assistant echoes/matches the target.
• 04_ga/chore_supply_chain_pin_precommit_and_compose_images — pre-commit hooks and Compose service images are tag-pinned, not digest-pinned (inconsistent with the SHA-pinned actions/Dockerfiles). Wants a coordinated Dependabot change.
• 04_ga/bug_github_webhook_no_delivery_id_replay_cache — the webhook has no X-GitHub-Delivery replay cache; current handlers are idempotent via the DB state machine so it's defense-in-depth only.

Reviewed and accepted (no change)

• SSRF relyloop_allow_private_clusters=True default — by-design for MVP1 (local dev registers ES at 127.0.0.1:9200); flipping it would break the core local-dev flow. Already acknowledged in spec §10 and slated to flip at MVP3. The DNS-rebinding TOCTOU follow-on is already tracked in bug_cluster_url_ssrf_hostname_bypass/phase2_idea.md.
• CORS allow_credentials=True — explicit localhost origin allowlist (no wildcard); all /api/v1 endpoints consume application/json, forcing a preflight a non-allowlisted origin fails. No credentials exist to steal (no auth).
• Bandit medium findings — all 3 are in scripts/seed_meaningful_demos.py, a local dev-only seeding CLI with closed-set (SCENARIOS) inputs and SQL escaping; not an API-reachable surface.
• Remaining pnpm audit items — a Windows-only vite dev-server advisory and a dev-only @babel/core sourcemap read; both dev-tooling transitive, not Dependabot-flagged.

Testing

• Backend: 2817 unit tests pass; ruff + mypy --strict clean on changed files; new redaction tests cover OpenAI-key scrubbing + near-miss non-matches.
• Frontend: 1300 vitest pass (incl. new javascript:-sanitization and non-https-pr_url regression tests); tsc + eslint clean; next.config headers() validated.
• corp-ca-extract.sh syntax-checked (bash -n).

🤖 Generated with Claude Code

---

CI status — two RED checks, both pre-existing and NOT caused by this PR

Verified during the CI watch; documented here so the red checks aren't mistaken for regressions from this sweep:

1. CodeQL (Analyze) — the analysis runs and exports SARIF fine, but the upload fails with "Code scanning is not enabled for this repository." This is a repo-admin setting (Settings → Code security → Code scanning), not a code fix. Red on main HEAD (e75f1e19) for the same reason. This PR adds actions: read to match GitHub's recommended CodeQL permission template, but the repo-setting must be enabled out-of-band. Operator action required.

2. backend (contract + integration + cov) — one integration test fails: test_synthetic_ubi_seed_round_trip_hits_rung_3 (seeds 640 UBI events into Elasticsearch, reads back rung_1 instead of rung_3). Code-stable ~6 weeks; untouched by this branch's diff; not a refresh race (the writer already uses refresh=wait_for). Root cause is a UBI-classifier/query-filter or engine-reachability read issue that needs a live ES stack to diagnose. Captured as 02_mvp2/bug_ubi_fast_test_classifies_rung_1_in_ci. All contract tests and all of this PR's own new tests pass; only this one pre-existing integration test is red.

Every check that this PR's changes are actually responsible for is green (frontend static-checks/tests/build, backend unit + static-checks, docker builds, gitleaks, secrets-guard, DCO, all freshness gates).

[gemini-code-assist]

Code Review

This pull request introduces several security hardening measures across the codebase, including configuring a timeout for the OpenAI chat client, redacting OpenAI API keys in logs, adding a trust-on-first-use gate to the corporate CA extraction script, setting baseline security headers in the UI, upgrading vulnerable frontend dependencies, and sanitizing links in Markdown guides and PR panels. Feedback on these changes suggests adding a word boundary prefix (\b) to the OpenAI key redaction regular expression to prevent false-positive redactions on common hyphenated words.

Important

The consumer version of Gemini Code Assist on GitHub is being sunset. Starting June 18, 2026, new organization installations will be blocked, and all code review activity will officially cease on July 17, 2026.
For more details on the timeline and next steps, please review the Help Documentation.

[gemini-code-assist]

The regular expression sk-[A-Za-z0-9_-]{20,} can lead to false-positive redactions on common hyphenated words or phrases containing sk- if the subsequent part is 20 or more characters long. For example, phrases like risk-assessment-questionnaire (containing sk-assessment-questionnaire) or task-scheduling-service-impl (containing sk-scheduling-service-impl) will be incorrectly redacted to ri[REDACTED-OPENAI-KEY] or ta[REDACTED-OPENAI-KEY].\n\nTo prevent this, add a word boundary \b prefix to the pattern so that it only matches when sk- starts a word.

Suggested change

	_OPENAI_KEY_PATTERN = re.compile(r"sk-[A-Za-z0-9_-]{20,}")
	_OPENAI_KEY_PATTERN = re.compile(r"\bsk-[A-Za-z0-9_-]{20,}")

[SoundMindsAI]

Review adjudication (pre-merge)

Gemini Code Assist — 1 finding, adjudicated:

Finding	Severity	Verdict	Action
redaction.py:47 — sk-[A-Za-z0-9_-]{20,} false-positives on hyphenated words containing sk- (e.g. risk-assessment-questionnaire)	Medium	Accept — correct; - is in the class with no leading boundary, so the pattern matches mid-word	Fixed in 5d8e8dfa: added \b anchor + regression test for both cited examples. A real key always begins at a token boundary, so true-positive coverage is unchanged.

Pre-existing red checks (NOT introduced by this PR — see PR description):

• CodeQL — analysis runs; SARIF upload blocked by "Code scanning is not enabled for this repository" (repo-admin setting; red on main too).
• backend (contract + integration) — one pre-existing integration test (test_synthetic_ubi_seed_round_trip_hits_rung_3, UBI subsystem, untouched by this diff, needs a live ES stack to diagnose). Captured as bug_ubi_fast_test_classifies_rung_1_in_ci.

All checks this PR's changes are responsible for are green. Merge-skew: clean (main unchanged at e75f1e19 since branch point).