v1.0.51

Security note: this release was NOT covered by a current security review. See the release run summary for details.

Automated ZAF app package for v1.0.51.

Verify provenance before install:
gh attestation verify tsanet-connect-v.zip --repo tsanetgit/Zendesk_App
Or verify the checksum against checksums.txt:
sha256sum -c checksums.txt

Install via Zendesk Admin Center → Apps and integrations → Zendesk Support apps → Upload/Update private app.

v1.0.50

v1.0.50 — security fixes

Update manually. Zendesk private apps do not auto-update. v1.0.49 shipped with the SDK integrity regression below and does not fix itself: install this version through Admin Center → Apps and integrations → Zendesk Support apps → Update private app.

This release fixes every finding from the security review of v1.0.49, plus two further defects caught before this tag was cut rather than after publish.

Fixed

#122 (HIGH) — ZAF SDK loaded from a mutable URL with no integrity check.
deploy.html, new in v1.0.49, loaded the SDK from the moving 2.0 channel with no integrity and no crossorigin, while the app's other two pages pinned 2.0.37 with SRI. Zendesk could have repointed that channel and the script would have executed unverified — inside a Zendesk administrator's session, on the one screen that writes account-level ZIS configuration. Regressed a control established by #94. All three pages now carry an identical pinned, SRI-protected tag, verified against the CDN.

#123 (MEDIUM) — the security audit did not check new pages.
scripts/security-audit.py inspected a hardcoded list of two HTML files, so any page added later was invisible to it. It reported 11 PASS over the tree containing #122. It now discovers pages by glob and fails if it finds none, so a green audit means what it appears to mean.

#124 (MEDIUM) — app settings could alter the uploaded ZIS bundle.
Per-instance values were spliced into the bundle as text with no escaping, so a setting containing a double quote could break out of its JSON string and inject structure — and the result still parsed, so nothing downstream rejected it. Settings are now validated, JSON-escaped, and the finished bundle must parse before anything is uploaded.

#125 (MEDIUM, partially addressed) — documentation asserted an untested boundary.
v1.0.49 stated in three places that ZIS rejects non-administrators, which nobody had tested. Those statements now cite Zendesk's own Allowed for: Admins documentation and say plainly that this is vendor documentation rather than something TSANet has probed. This finding remains open pending a test with an agent-role session.

Also fixed, found before release

$ in a connection name silently corrupted the bundle. The substitution used a replacement string, where $ is special, so my$$conn became my$conn — valid JSON with the wrong connection name, past all three of the protections added for #124. Now uses a function replacement. Caught by QA review of #126.

Substitution was not single-pass, so one value could overwrite another. Placeholders were replaced sequentially, re-scanning text already written. A field ID set to another placeholder's token shipped the wrong field's value, and a connection name of YOUR_TSANET_API_EMAIL shipped the engineer email instead. Both passed validation, left no placeholder behind, and parsed cleanly. Field IDs are now replaced in a single pass and the connection substitution runs last. Fixed in #127.

Not changed

No change to how the connector authenticates at runtime, to the ZIS flow bundle itself, or to any credential. The deploy screen added in v1.0.49 behaves the same; it is simply harder to feed it a value that produces a wrong bundle.

Verification

• Mechanical security audit: 12 pass, 0 fail, 1 warning. The warning is the known v1-endpoint sunset (#101), unchanged.
• SDK pin checked against the CDN: versioned URL resolves, served bytes match the declared sha384 hash, and CORS permits the integrity check.
• Substitution fixes verified by a harness that evaluates the shipped source directly rather than a copy of it.
• This release was covered by a security review before the tag was cut.

---

Install

Zendesk private apps do not auto-update. Install through Admin Center → Apps and integrations → Zendesk Support apps → Update private app.

Verify provenance before installing:

gh attestation verify tsanet-connect-v1.0.50.zip --repo tsanetgit/Zendesk_App

Or verify the checksum:

sha256sum -c checksums.txt

Security gate record

Preserved verbatim from the release run, since it is the record of what was accepted at publish time:

Security note: this release was reviewed (the audit record covers the released commit, with no source drift) and was published with 5 of 6 open security finding(s) at high/medium/unprioritised severity, knowingly accepted — #125 medium-priority; #124 medium-priority; #123 medium-priority; #119 unprioritised; #98 low-priority; #96 medium-priority.

Two clarifications, neither of which changes what was accepted:

• #123 and #124 are listed as open because the gate queried GitHub a few minutes before they were closed. Both are fixed in this release.
• The remaining entries are standing backlog rather than defects in this build: #96 and #119 are long-horizon architecture items, #98 is low-priority, and #125 is the documented-but-unprobed authorization boundary described above.

The gate flagged every release regardless of its actual state, which made that banner uninformative. That is fixed in #129 and takes effect from the next tag.

v1.0.49

Security note: this release was NOT covered by a current security review. See the release run summary for details.

Automated ZAF app package for v1.0.49.

Verify provenance before install:
gh attestation verify tsanet-connect-v.zip --repo tsanetgit/Zendesk_App
Or verify the checksum against checksums.txt:
sha256sum -c checksums.txt

Install via Zendesk Admin Center → Apps and integrations → Zendesk Support apps → Upload/Update private app.

v1.0.48

Security note: this release was reviewed (the audit record covers the released commit, with no source drift) and was published with 1 known open finding(s) accepted — #98 low-priority; #96 medium-priority.

Automated ZAF app package for v1.0.48.

Verify provenance before install:
gh attestation verify tsanet-connect-v.zip --repo tsanetgit/Zendesk_App
Or verify the checksum against checksums.txt:
sha256sum -c checksums.txt

Install via Zendesk Admin Center → Apps and integrations → Zendesk Support apps → Upload/Update private app.

v1.0.47

Security note: this release was reviewed (the security audit record covers the released commit, with no source drift), and was published with one known open finding accepted: tsanetgit/Zendesk_App#96 (durable audit trail), a documentation deliverable deliberately sequenced after the v2 webhook migration tsanetgit/Zendesk_App#101. No unreviewed change shipped in this release.

Security fix: API-sourced values in the collaboration card are now escaped before rendering (tsanetgit/Zendesk_App#111). The case token is no longer interpolated into markup or a CSS selector at all.

Also in this release cycle: members are now told how to verify this package before installing it (tsanetgit/Zendesk_App#110), documented in the ZAF Quick Start, the Implementation Guide, and the published Security Considerations page.

Verify provenance before install:

gh attestation verify tsanet-connect-v1.0.47.zip --repo tsanetgit/Zendesk_App
sha256sum -c checksums.txt

Install via Zendesk Admin Center → Apps and integrations → Zendesk Support apps → Upload/Update private app.

v1.0.46

Security release: two hardening changes from the EDB Security Design Review follow-ups.

• ZAF SDK pinned with Subresource Integrity (tsanetgit/Zendesk_App#94): the SDK now loads from an exact-version URL with an integrity hash, so a tampered or unexpectedly changed SDK is blocked by the browser.
• Optional app-level RBAC on TSANet actions (tsanetgit/Zendesk_App#97): new Allowed action roles setting restricts which Zendesk roles can invoke Accept / Reject / Request Info / Add Note / Close / New Collaboration. Empty (default) keeps current behavior, so no action is needed on existing installs unless you want the restriction. Defense-in-depth for the UI; the TSANet Connect API remains the authorization boundary.

Verify provenance before install:

gh attestation verify tsanet-connect-v1.0.46.zip --repo tsanetgit/Zendesk_App
sha256sum -c checksums.txt

Install via Zendesk Admin Center → Apps and integrations → Zendesk Support apps → Upload/Update private app.

v1.0.44

Automated ZAF app package for v1.0.44. Install via Zendesk Admin Center → Apps and integrations → Zendesk Support apps → Upload/Update private app.

v1.0.43

Automated ZAF app package for v1.0.43. Install via Zendesk Admin Center → Apps and integrations → Zendesk Support apps → Upload/Update private app.

v1.0.42

Automated ZAF app package for v1.0.42. Install via Zendesk Admin Center → Apps and integrations → Zendesk Support apps → Upload/Update private app.

v1.0.41

Automated ZAF app package for v1.0.41. Install via Zendesk Admin Center → Apps and integrations → Zendesk Support apps → Upload/Update private app.