Finding
Checkers run as in-process callables registered in \CheckerRegistry\ (\�ackend/app/modules/checkers/runner.py). No subprocess isolation, no execution timeout, no resource limits.
Risk
A misbehaving checker (infinite loop, memory exhaustion, file system access) can DoS or compromise the API worker. A malicious or compromised checker can access the database connection, Redis, and all request data via \CheckerContext.
Location
- \checkers/runner.py\ — \Checker(Protocol)\ with \�sync def run(self, context)\
- \CheckerRegistry.register()\ — no sandbox at registration or execution
Recommendation
- Add execution timeout to every checker run
- Move checker execution to an isolated subprocess or Celery task with resource limits
- Audit which checkers access what data and scope their privileges
Severity: High
Finding
Checkers run as in-process callables registered in \CheckerRegistry\ (\�ackend/app/modules/checkers/runner.py). No subprocess isolation, no execution timeout, no resource limits.
Risk
A misbehaving checker (infinite loop, memory exhaustion, file system access) can DoS or compromise the API worker. A malicious or compromised checker can access the database connection, Redis, and all request data via \CheckerContext.
Location
Recommendation
Severity: High