fix: weekly security audit remediations (2026-08-17) - #111
Draft
cursor[bot] wants to merge 2 commits into
Draft
Conversation
Refuse decrypt overwrites without --force, skip directory-symlink trees, validate DynamoDB S3 keys against the encrypted/ prefix, and fail rotate-key on DescribeKey before any plaintext temp is written. Honor ENVAULT_AUDIT_TTL_DAYS on every event write, reject absolute/symlink migrate paths, and warn when exec inherits AWS credentials. Dashboard last_activity pages past EVENT GSI hits instead of Limit=1; CAS tokens use microsecond timestamps. The managed policy drops unused UpdateItem and ListBucket, scopes objects to encrypted/*, grants sts:GetCallerIdentity, and no longer denies kms:DisableKey. Co-authored-by: Specter099 <Specter099@users.noreply.github.com>
Replace the stale CISO review (which described already-fixed decrypt-path bugs) with this week's findings. Document rotate-key extra-key IAM, the 365-day noncurrent-version window, decrypt --force, and ENVAULT_* in .env.example. Co-authored-by: Specter099 <Specter099@users.noreply.github.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Weekly static security audit of envault-cli. Prior Critical decrypt-path issues (plaintext-before-verify, no streaming) were already fixed on
main. This PR closes the remaining High/Medium items that were still open and replaces the stale in-tree CISO report.Type of Change
What changed
CLI / crypto orchestration
decryptrefuses to overwrite an existing destination unless--force(check runs beforemkstemp)._collect_filesno longer follows directory symlinks (os.walk(followlinks=False)).s3_keyvalues must matchencrypted/{aa}/{sha256}/{name}.encryptedbefore GetObject.rotate-keycallsDescribeKeyon--new-key-idbefore any download/decrypt.ENVAULT_AUDIT_TTL_DAYSis applied on encrypt, decrypt, exec, rotate-key, and migrate event writes.migraterejects absolute paths and symlinks, not only..components.execwarns when the child would inheritAWS_*credentials (--clean-envremains opt-in).State
last_activitypages until a CURRENT item survives the GSI filter (noLimit=1beforeFilterExpression).IAM / KMS
kms:DisableKeyremoved from the key-policy deny (incident response);ScheduleKeyDeletionstays denied.dynamodb:UpdateItemands3:ListBucketdropped; object actions scoped toencrypted/*.sts:GetCallerIdentitygranted so audit events can record a principal.Docs / CI
SECURITY_AUDIT.mdrewritten for this week (residual risk documented).--force, rotate-key extra-key IAM, 365-day noncurrent versions,--clean-env.Remaining (not in this PR)
state-indexhot partition / event bloat needs a GSI migration.--clean-envdefault would be a breaking change.Testing
ruff check/ruff format --check/mypy src/envault/— cleanpytest tests/unit/— 177 passedChecklist