Weekly security audit remediations (2026-08-15) - #110
Draft
cursor[bot] wants to merge 3 commits into
Draft
Conversation
Remove unused dynamodb:UpdateItem, scope ListBucket to the bucket ARN, and drop kms:DisableKey from the key-policy deny so a compromised CMK can be disabled without a CloudFormation change. Version the access-logs bucket. Co-authored-by: Specter099 <Specter099@users.noreply.github.com>
Refuse decrypt overwrites unless --force, validate DynamoDB-supplied S3 keys, honour ENVAULT_AUDIT_TTL_DAYS on every event write, and preflight DescribeKey before rotate-key decrypts plaintext. Tighten last_updated CAS to microseconds and page past EVENT items for dashboard last_activity. Co-authored-by: Specter099 <Specter099@users.noreply.github.com>
Document remaining High/Medium issues, justify pip-audit CVE ignores, point .env.example at ENVAULT_* variables, and extend CODEOWNERS to cli.py and isolation.py. Co-authored-by: Specter099 <Specter099@users.noreply.github.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Weekly static security audit of envault-cli. Prior Critical findings from March/July (plaintext-before-verify, one-shot decrypt, overwritable audit events, unconstrained KMS discovery) are already fixed on
main. This change remediates leftover High/Medium items and replaces the stale rootSECURITY_AUDIT.mdwith a current-state report.Type of Change
What changed
dynamodb:UpdateItem; scopes3:ListBucketto the bucket ARN.DisableKeyfrom the key-policy DENY so incident response can disable a CMK without a CloudFormation edit.--force; validate DynamoDB-supplied S3 keys (encrypted/prefix, no..).ENVAULT_AUDIT_TTL_DAYSon every audit event write.rotate-key:DescribeKeythe target key before any plaintext is written.last_activitypages past EVENT items.ENVAULT_*.env.example, pip-audit CVE justifications, CODEOWNERS forcli.py/isolation.py.Remaining (not in this PR)
See
SECURITY_AUDIT.md: 0 Critical, 2 High, 9 Medium, 7 Low. Highest leftovers are rotate-key still scoped to the stack CMK only, and noncurrent S3 versions remaining readable under the old key for 365 days.Testing
ruff check/ruff format --check/mypy src/envault/— passpytest tests/unit/— 172 passedChecklist