fix(core): low-severity audit batch findings (exousia/horismos/apotheke/kritike) - #502
Merged
Conversation
added 2 commits
July 2, 2026 12:33
…ke/kritike) Applies the verified low-severity findings from the wave-1 + deeper-pass audit batches: bearer 401s distinguish TOKEN_EXPIRED; login no longer leaks inactive-account existence; password length validation; numeric refresh-token expiry comparison with overflow-clamped generation and config-load TTL validation; random_alphanum entropy fix; ConfigHandle::borrow footgun removed; SIGHUP reload moved off the executor; apotheke transactional daily-stats and release-group reads, Option-returning parse_media_type (also kritike), LIMIT-bounded queries, single-JOIN list_zones, plus test coverage. Closes #441 Closes #462 Closes #442 Closes #463 Closes #438 Closes #443 Gate-Passed: kanon 0.1.5 +stages:fmt,check,clippy,nextest,lint sha:b64773743a8fe472fd40cc6c8cfee8d214c43271
The shared exousia unit-test secret "test-secret-that-is-long-enough-for-hs256" tripped the generic-api-key rule when exousia/src/service.rs gained inline tests. Value-scoped allowlist covers all three exousia test modules (lib.rs, middleware.rs, service.rs) without blinding gitleaks to real secrets in those source files, and needs no per-file maintenance as tests move.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Applies the verified low-severity findings from the wave-1 + deeper-pass audit batches for the core/auth crates.
Closes #441, #462, #442, #463, #438, #443.
Highlights: bearer 401s distinguish
TOKEN_EXPIRED; login no longer leaks inactive-account existence; password length validation (min 8 / max 256); numeric refresh-token expiry comparison with overflow-clamped generation + config-load TTL validation;random_alphanumentropy fix; theConfigHandle::borrowhold-across-await footgun removed; SIGHUP reload moved tospawn_blocking; apotheke transactional daily-stats + release-group reads,Option-returningparse_media_type(also kritike), LIMIT-bounded queries, single-JOINlist_zones, plus coverage. 26 findings fixed; 9 were already fixed on main by earlier hardening; 1 (login rate-limit/lockout) deferred per its own fix-plan as a dedicated PR (schema + config + new subsystem).kanon gate --fullgreen (261 crate tests + 166 archon, clippy workspace, kanon lint).