Nimstead Assure 0.4.0

Security round 4 and what a first team needs: people management, two-step sign-in, API tokens and CSV export. Agent 0.3.0.

Upgrade from 0.3.x: run deploy/update.sh on the Docker host. Things to know:

• Admins who sign in with a password are signed out by the upgrade and set up two-step sign-in at their next sign-in (any authenticator app), including break-glass sign-in. Save the recovery codes it shows.
• Swagger UI at /api/docs is off unless NIMSTEAD_API_DOCS=1 (it runs scripts from a CDN); /api/openapi.json is still served.
• The app now listens on 127.0.0.1:8000 only. Your HTTPS proxy on the same host keeps working. If something on another machine reached port 8000 directly, put it behind the proxy, or set NIMSTEAD_BIND=0.0.0.0 in .env.
• Sign-up links sent before the upgrade stop working; ask for a new one.
• Agents update themselves to 0.3.0. Machines enrolled before 0.3.0 keep taking every channel; rerun the install command to tie one to your server's channel.

Security

• Sign-up can no longer be used to pre-set someone else's password. Emailed sign-ups, invitations and resets let the address owner choose the password on the link's page; the request never carries one.
• Two-step sign-in (TOTP) is required for admins who sign in with a password, with one-time recovery codes; anyone else can turn it on in Settings. A new admin's first session comes from signing in (after sign-up you're sent to the sign-in page), wrong codes are limited per account from every address, and promoting someone signs them out so they set it up.
• Request bodies are capped at 10 MB as they arrive, so a chunked upload can't exhaust memory.
• Per-organisation limits: assets (NIMSTEAD_MAX_ASSETS_PER_ORG, 5,000), enrolments per token, inventories per hour, and AI calls per user and organisation.
• Security headers on every response: Content-Security-Policy, HSTS (with secure cookies), X-Frame-Options: DENY, nosniff, Referrer-Policy: no-referrer. /.well-known/security.txt is served.
• The evidence ledger now records organisation creation, every agent enrolment (with the token used), password sign-ins and every change to people and tokens.
• Agent 0.3.0: a fix never installs an older version (pins are compared by the package manager; dry-run downgrades are refused); rollback copies are deleted once the outcome is saved and no change starts below 1 GiB free; signed releases from a less proven channel than the machine's are refused; job fields are validated without trailing newlines; server responses are size-capped.
• Windows installs without remediation failed at "Scheduling failed" (since agent 0.2.0): removing the job-poll task that wasn't there left PowerShell exiting 1 with no output. Found on a real Windows 11 VM; the agent now removes it only if it exists, and says the exit code if scheduling ever fails. Rerun the install command on machines that showed the error.
• The Windows installer's trusted-folder check had lost a backslash, so C:\Program Files Evil\ passed it (the agent's own check still stopped it). Fixed. The Linux installer fetches over HTTPS only and prints the agent's SHA-256.
• deploy/update.sh refuses untracked files and Compose override files, checks out the exact verified commit, runs as root only from a checkout only root can change, and checks the backup is readable before dropping the database on rollback.
• CI actions are pinned to commits with a read-only token; a CI job audits Python and npm dependencies; Dependabot covers both; the release signing step installs only hash-pinned packages.

Added

• People in Settings: invite by email, make admin or member, remove (signed out at once). An organisation always keeps one admin. Sessions end after 12 hours idle; Sign out everywhere.
• Change password and Forgot password? (emailed link, 1 hour; you still need your authenticator code).
• API tokens: read-only access for scripts to findings, assets, the summary and evidence, as Authorization: Bearer …. Creating one needs your authenticator code; each expires within a year, and stops working when its creator is no longer an admin, signs out everywhere, or changes or resets their password.
• Export CSV on Findings, with the page's filters (cells a spreadsheet would run as formulas are escaped).
• Remediation deadlines per priority in Settings, used and shown in evidence packs. Each finding is held to the deadline in force when it was detected, so relaxing one later can't make an old miss pass.
• Evidence packs map to SOC 2 CC7.1 and CC8.1 and NIS2 Art. 21(2)(e) too.
• Risk acceptance: accept one vulnerability on every host it's open on, and revoke an acceptance (both recorded).
• Each release publishes CycloneDX SBOMs of Assure's own dependencies; upload them to an application to scan Assure with Assure.
• Docs: installing an agent without trusting the server, restoring a backup, release-key rotation and the bad-release runbook (docs/release-keys.md).

Changed

• SECURITY.md: response targets per severity, safe harbour, and which releases get fixes.

Full list: CHANGELOG.