Security audit remediations (2026-08-31) - #112
Draft
cursor[bot] wants to merge 4 commits into
Draft
Conversation
Scope S3 object actions to encrypted/*, drop unused ListBucket and UpdateItem, and grant sts:GetCallerIdentity so audit attribution works under the managed policy. Encrypt the ops SNS topic with the envault CMK. Keep kms:ScheduleKeyDeletion denied; leave DisableKey available so a compromised key can be frozen without editing the key policy first. Co-authored-by: Specter099 <Specter099@users.noreply.github.com>
Refuse decrypt overwrite unless --force (check before mkstemp). Bind
DynamoDB s3_key values to encrypted/{aa}/{sha256}/…. Walk trees without
following directory symlinks. Confine migrate paths to the import
directory and reject symlink components. Apply ENVAULT_AUDIT_TTL_DAYS on
every put_event path. DescribeKey the rotation target before any
plaintext exists. Warn when exec inherits AWS_* credentials. Use
microsecond CAS tokens and page dashboard last_activity past EVENT
index items. Close the encrypt output fd if the SDK stream fails.
Co-authored-by: Specter099 <Specter099@users.noreply.github.com>
Add cases for decrypt --force, untrusted S3 keys, directory-symlink collection, migrate path confinement, DescribeKey preflight, audit TTL on CLI flag paths, dashboard last_activity paging, and exec AWS-credential inheritance warning. Point rotate-key tests at a moto KMS alias. Co-authored-by: Specter099 <Specter099@users.noreply.github.com>
Replace the stale March 2026 CISO report with current findings, remediations on this branch, and remaining low/informational items. Co-authored-by: Specter099 <Specter099@users.noreply.github.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Weekly static security audit of envault-cli. This PR remediates High and Medium findings still open on
mainand replacesSECURITY_AUDIT.mdwith the 2026-08-31 report.Fixed (6 High, 6 Medium):
--force(check runs before temp files are created).s3_keyvalues must matchencrypted/{aa}/{sha256}/{name}.encrypted.os.walk(followlinks=False)so directory symlinks are not followed.migraterejects.., per-component symlinks, and paths outside the import directory.encrypted/*, unusedListBucket/UpdateItemremoved,sts:GetCallerIdentityadded; SNS topic encrypted with the envault CMK;DisableKeyleft available for IR.rotate-keycallsDescribeKeyon--new-key-idbefore any download/decrypt.ENVAULT_AUDIT_TTL_DAYSapplied on encrypt/decrypt/exec/rotate-key/migrate event writes.last_activitypages until a CURRENT GSI item survives the filter.execwarns when the child would inheritAWS_*credentials (--clean-envremains opt-in).fdopen.Still open / accepted: extra target-key IAM for rotate-key (fails closed at DescribeKey); old S3 versions not a revocation primitive; no lockfile; state-index stores EVENT items; CDK L2 KMS root policy; MFA Delete is post-deploy.
Type of Change
Testing
pytest tests/unit/— 175 passedruff check src/ tests/andruff format --check src/ tests/— cleanmypy src/envault/— cleanChecklist