feat(enrichment): flag insecure HTTP security-header settings in iac-misconfig

[luciferlive112116]

Summary

The IaC-misconfig analyzer already covers Kubernetes, Dockerfile, Docker Compose, and TLS-bypass
misconfigurations. This adds 3 HTTP security-header rules for insecure header values that appear in the
config files the analyzer already scans (nginx*.conf, .conf, YAML/Helm ingress annotations, .toml, .json):

kind	fires on	risk
hsts-disabled	Strict-Transport-Security … max-age=0	disables HSTS (browsers stop enforcing HTTPS)
referrer-policy-leak	Referrer-Policy: unsafe-url	leaks the full URL (path + query) cross-origin
cookie-not-httponly	httpOnly: false	exposes the cookie to JavaScript (XSS can read it)

Why these are false-positive-safe: each rule requires its own header token on the same line as the
weakening value, so an unrelated line that merely contains the value is not flagged: a normal
Cache-Control: max-age=0 caching directive does not fire the HSTS rule (asserted in the negative test).
Within a header that IS being set, the matched value is the weakening itself — the secure value uses a
different token the regex never matches (max-age=31536000, strict-origin-when-cross-origin,
httpOnly: true), also asserted to produce no finding. Each header token (Strict-Transport-Security,
Referrer-Policy, httpOnly) has no report-only/prefixed variant that changes its enforcement meaning, so
the anchor is unambiguous.

No existing rule is modified, and the analyzer's finding schema is {file, line, kind} — the kind union is
not part of the analyzer descriptor, so analyzer-metadata.json and the generated UI mirror are unchanged.
The render-brief switch is TypeScript-exhaustive, so each new kind is compiler-forced to have a public-safe
explanation.

No linked issue: additive detection-coverage that extends an existing multi-domain analyzer along its own
established lines; each rule is a self-evident, named HTTP-hardening check (OWASP Secure Headers) with no public
API/schema/deploy surface change — fits the repo's preferred (not required) linked-issue policy.

Scope

• The PR title follows type(scope): short summary Conventional Commit format, for example fix(api): restore profile access checks.
• This PR is focused and does not mix unrelated backend, UI, MCP, docs, dependency, and deploy changes.
• This follows CONTRIBUTING.md and does not reintroduce GitHub Pages, VitePress, site/, or CNAME.
• I linked an issue, or this is small enough that the summary explains why an issue is not needed.

Validation

• git diff --check
• npm run typecheck
• npm run rees:test — the review-enrichment build + analyzer suite (see note below)
• npm run test:coverage (N/A — this analyzer is in review-enrichment/, outside the root src/** Codecov scope)
• npm run ui:build
• npm audit --audit-level=moderate
• New or changed behavior has unit/integration tests for new branches, fallback paths, and sanitizer boundaries

If any required check was skipped, explain why:

• Ran locally: git diff --check (clean), the review-enrichment TypeScript build (exit 0 — which proves the
  render switch is exhaustive over the 3 new kinds), and the analyzer suite via node --test. The
  iac-misconfig file passes 21/21: a table test asserting each of the 3 settings produces exactly one finding
  of its own kind, and a negative test asserting the secure counterpart of each — including a normal
  Cache-Control: max-age=0 (which must NOT fire the HSTS rule) — produces none. The full node --test run's
  only failures are the two upload-sourcemaps tests (they shell out to the Sentry CLI, absent on this dev
  box), which fail identically on unmodified main.
• Not run locally: the UI, root typecheck, and the metadata:check step of rees:test. This change adds only
  finding kinds and rules, not any analyzer descriptor field, so the committed analyzer-metadata.json / UI
  mirror are unchanged (a local regeneration produces a zero-content diff) and metadata:check passes on CI
  (Linux). On this Windows dev box metadata:check reports a spurious line-ending difference; it fails
  identically on unmodified main. analyzer-metadata.json was NOT modified.

Safety

• No secrets, wallet details, hotkeys, coldkeys, user PATs, private keys, raw trust scores, private rankings, or private maintainer evidence are exposed.
• Public GitHub text stays sanitized, low-noise, and does not imply compensation guarantees or optimization tactics.
• Auth, cookie, CORS, GitHub App, Cloudflare, or session changes include negative-path tests.
• API/OpenAPI/MCP behavior is updated and tested where needed.
• UI changes use live API data or real empty/error/loading states, not production mock/demo fallbacks.
• Visible UI changes include a UI Evidence section below with JPG/JPEG or PNG screenshots arranged as organized, captioned, clickable thumbnails. SVG screenshots are not used as review evidence. Review-only screenshots or recordings are not committed to the repository.
• Public docs/changelogs are updated where needed; changelogs are only edited for release-prep PRs.

Notes

• Detection-only additions: 3 new stateless rules following the existing single-line pattern; no existing rule,
  threshold, or descriptor changed, so current findings and analyzer-metadata.json are unaffected. Each new
  kind reports only file:line + the public-safe kind, never the matched line content.
• The HSTS and Referrer-Policy rules are anchored to their own header token so an unrelated line carrying the
  same value (e.g. Cache-Control: max-age=0) is never flagged.

[superagent-security]

Superagent didn't find any vulnerabilities or security issues in this PR.

[loopover-orb]

Warning

🟨🟨🟨🟨🟨🟨🟨🟨🟨🟨🟨🟨

⏸️ Gittensory review result - manual review recommended

_{Review updated: 2026-07-05 05:55:01 UTC}

4 files · 1 AI reviewer · no blockers · readiness 80/100 · CI green · clean

⏸️ Suggested Action - Manual Review

Review summary
This change cleanly extends the IaC misconfig analyzer with three additive HTTP-header findings, updates the finding kind union, and adds render text for each new kind. The scanner wiring follows the existing single-line regex pattern, the render switch remains exhaustive, and the tests cover the primary positive and safe-value negative paths including the Cache-Control false-positive case. I do not see a reachable correctness defect in the provided diff.

Nits — 5 non-blocking

• nit: review-enrichment/src/analyzers/iac-misconfig.ts:119 makes `COOKIE_NOT_HTTPONLY_RE` broader than the other two header rules because it only anchors on `httpOnly` plus `false`, so it can flag non-cookie configuration fields that happen to use the same option name; keep it if that is intentional, or tighten the surrounding token/path expectation.
• nit: review-enrichment/test/iac-misconfig.test.ts:450 exercises all three new detections through `nginx.conf` only, while the PR explicitly calls out YAML/Helm, TOML, and JSON shapes; one representative `values.yaml` annotation or `netlify.toml` case would make the claimed surface less dependent on regex inference.
• nit: review-enrichment/test/iac-misconfig.test.ts:468 covers `httpOnly: true` as the secure counterpart, but not common quoted JSON/TOML spellings such as `"httpOnly": false`; add one quoted-key case if those formats are part of the intended contract.
• At review-enrichment/src/analyzers/iac-misconfig.ts:119, either document why any added `httpOnly: false` config line is treated as cookie-related, or narrow the rule with a cookie/session/header-adjacent token if false positives show up.
• At review-enrichment/test/iac-misconfig.test.ts:450, add one positive fixture outside `nginx.conf` to lock down the multi-format claim made in the PR description.

Signal	Result	Evidence
Code review	✅ No blockers	1 reviewer
Linked issue	✅ No-issue rationale	PR body explains why no issue is linked.
Related work	✅ No active overlap found	No same-issue or scoped active PR overlap found.
Change scope	✅ 20/20	Low review scope from cached public metadata (no linked issue context).
Validation posture	❌ 5/25	Preflight is holding this PR: the review lane is unavailable, so it is not ready for automated review.
Contributor workload	✅ 10/10	Author activity: 146 registered-repo PR(s), 80 merged, 21 issue(s).
Contributor context	✅ Confirmed Gittensor contributor	luciferlive112116; Gittensor profile; 146 PR(s), 21 issue(s).
Gate result	✅ Passing	No configured blocker found.

Review context

• Author: luciferlive112116
• Role context: outside_contributor
• Public audience mode: oss maintainer
• Lane context: Repository registration is not available in the local Gittensory cache.
• Public profile languages: not available
• Official Gittensor activity: 146 PR(s), 21 issue(s).
• PR-specific overlap: none found.

Contributor next steps

• Await review-lane availability.
• Refresh registry data or choose a registered active repo.
• Link the issue being solved, or explicitly explain why this is a no-issue PR.

Signal definitions

• Related work = same linked issue, overlapping active PRs, or title/path similarity.
• Change scope = cached public metadata such as size labels, draft state, and review-burden hints.
• Validation posture = whether the PR provides enough public validation/test evidence for maintainer review.
• Contributor workload = public contributor activity and cleanup pressure, not a repo-wide quality failure.
• Contributor context = public GitHub/Gittensor identity context; non-Gittensor status is not a blocker.

_{🟩 Safe / merged · 🟦 Advisory · 🟨 Held for review · 🟥 Blocked / closed}

---

💰 Earn for open-source contributions like this. Gittensor lets GitHub contributors earn for the work they already do — register to start earning →.

Checked by Gittensory, a quiet PR intelligence layer for OSS maintainers.

• Re-run Gittensory review

[loopover-orb]

Gittensory approves — the gate is satisfied and CI is green.