ShipIt Clean — 13123ca3607e

Total Findings

Critical

High

Medium

Low

main @ fbf3790

AIAI Threat Analysis

REAL THREATS

CRITICAL AUTHENTICATION FLAWS

• Token exposure in verbose mode (2): Token values printed in verbose output could leak to logs.

• Unauthenticated token publishing (3,4): / endpoint returns tokens without any authentication, allowing anyone to obtain valid tokens.

• Token endpoint lacks authentication (22,55): Token publishing endpoint has no auth, enabling token harvesting.

COMMAND INJECTION & SHELL VULNERABILITIES

• Shell injection via eval (6,7,8,9): Multiple shell scripts use eval with unsanitized environment variables, allowing command injection.

• SSH command injection (27): SSH command in token.sh uses variable substitution without sanitization.

• Command injection via os.Args (28): Daemon.go manipulates os.Args without proper validation.

INSECURE DATA HANDLING

• PII stored unencrypted (10,13): Reservation files and SQLite database store MACs, IPs, hostnames without encryption.

• No rate limiting (17,20,62): API endpoints and token validation lack rate limiting, enabling brute force and DoS.

• Non-cryptographically secure tokens (18): Tokens generated with UUIDs, not cryptographically random.

• Unbounded JSON input (11): Reservation endpoints accept unlimited JSON payloads, enabling memory exhaustion.

• No file size limits (37): Reservation writes have no size limits.

INSECURE CONFIGURATION & DEPLOYMENT

• Gin debug mode enabled (47): Debug mode exposes sensitive information.

• No TLS enforcement (48): All traffic unencrypted, exposing PII and tokens.

• No connection timeouts (49): Enables connection exhaustion attacks.

• Unix socket permissions not configured (50): Default permissions may allow unauthorized access.

• Token checking can be disabled (53): -T 0 disables all authentication.

• Missing security headers (56,57): No X-Frame-Options or CSP headers.

AUDIT & LOGGING DEFICIENCIES

• Missing audit logging (12,21,30,38,41,43,45,65): Critical operations lack audit trails for security monitoring.

• No log rotation (54): Logs can fill disk space.

INPUT VALIDATION & DOS VULNERABILITIES

• Path traversal (35): Insufficient path validation in host directory operations.

• Information disclosure (36,63): Detailed error messages reveal internal logic.

• MAC address validation insufficient (34): May not catch all malformed inputs.

• No query complexity limits (42): Database endpoints can be abused for resource exhaustion.

• Unbounded query results (14): Database queries can return unlimited results, causing memory exhaustion.

DATA GOVERNANCE ISSUES

• No consent tracking (31): No mechanism for data collection consent.

• No data retention policy (39): PII stored indefinitely.

• Missing data classification (40): No classification for sensitive fields.

• No cross-border transfer tracking (46): No mechanism to track data location.

ATTACK CHAINS

1. Unauthenticated Token Harvesting → Full System Compromise: Attacker accesses unauthenticated token endpoint (3,4,22,55) → obtains valid token → uses token to access all API endpoints → performs command injection via eval vulnerabilities (6,7,8,9) → gains shell access on server.

2. Memory Exhaustion DoS: Attacker sends unbounded JSON payloads (11) or queries returning unlimited results (14) → exhausts server memory → causes service disruption.

3. PII Data Exfiltration: Attacker accesses unencrypted SQLite database (13) or reservation files (10) → extracts all PII → combines with network sniffing (48) to capture tokens and sensitive data in transit.

VERDICT

IMMEDIATE FIXES REQUIRED:

1. Implement proper authentication on all endpoints, especially token publishing

2. Remove eval usage from shell scripts or implement strict input sanitization

3. Enable TLS encryption for all network traffic

4. Implement rate limiting on all API endpoints

5. Add audit logging for all security-relevant operations

6. Fix command injection vulnerabilities in daemon.go and shell scripts

The system has multiple critical vulnerabilities that allow unauthenticated access, command injection, and data exposure. The authentication system is fundamentally broken, allowing anyone to obtain tokens and access all functionality. This must be addressed before deployment.

60 raw scanner findings — 1 critical · 12 high · 41 medium · 6 low

▶ Raw Scanner Output — 66 pre-cleanup findings

⚠ Pre-Cleanup Report
This is the raw, unprocessed output from all scanner agents before AI analysis. Do not use this to fix issues individually. Multiple agents attack from different angles and frequently report the same underlying vulnerability, resulting in significant duplication. Architectural issues also appear as many separate line-level findings when they require a single structural fix.

Use the Copy Fix Workflow button above to get the AI-cleaned workflow — it deduplicates findings, removes false positives, and provides actionable steps. This raw output is provided for transparency and audit purposes only.

HIGHUnbounded eval Usage - Command Injection DoS

[redacted]/curl.sh:22

[AGENTS: Siege]dos

The curl.sh script uses eval with user-controlled variables: eval curl "$args" "$url" "$*". Malicious input could cause infinite loops, excessive command execution, or resource exhaustion through command injection.

Suggested Fix

Replace eval with direct variable expansion. Validate and sanitize all user inputs before use. Use arrays instead of string concatenation.

HIGHShell Injection via eval in jq expression construction

[redacted]/curl_jq.sh:12

[AGENTS: Specter]command-injection

The script uses 'eval echo' to construct jq expressions from environment variables. If DNSMASQ_WEB_*_jq_sort or DNSMASQ_WEB_*_jq variables are set with malicious input, they could execute arbitrary shell commands through the eval construct.

Suggested Fix

Use parameter expansion and string concatenation instead of eval. Quote all variables properly and validate input before use.

HIGHUnbounded eval in Function Generation

[redacted]/jq_commands.sh:18

[AGENTS: Siege]dos

The script uses eval to dynamically generate shell functions from user-controlled jq expressions. This can lead to infinite loops, excessive memory usage, or command injection via crafted jq expressions.

Suggested Fix

Validate jq expressions against a whitelist of allowed operations. Avoid eval; use safer alternatives like jq's built-in function generation or pre-validated expression templates.

HIGHUnsafe eval usage for function generation

[redacted]/jq_commands.sh:40

[AGENTS: Specter]command-injection

The script uses 'eval' to dynamically generate shell functions from loop variables. If the loop noun variable or any jq expression contains malicious input, it could lead to command injection.

Suggested Fix

Use 'declare -f' or 'type' to define functions without eval, or validate the loop variable against a whitelist of allowed values.

HIGHReservation files stored unencrypted with PII

[redacted]/host_dir.go:1

[AGENTS: Warden]data-encryption

Reservation files in host directory contain MAC addresses, IP addresses, hostnames, and tags. Files are stored with 0640 permissions but not encrypted. Hostnames like 'Adam-s-Phone' may contain personal identifiers.

Suggested Fix

Encrypt reservation files at rest or store them in an encrypted volume. Implement file-level encryption for sensitive data.

HIGHUnbounded JSON Input on Reservation Endpoints

[redacted]/host_dir.go:38

[AGENTS: Wallet]denial_of_wallet

POST /reservations and PUT /reservations/:mac accept arbitrary JSON without size limits. An attacker could submit extremely large payloads, causing excessive file I/O, memory usage, and potential disk space exhaustion.

Suggested Fix

Add request body size limits (e.g., 1MB max) and validate JSON structure before processing.

HIGHReservation file operations lack audit logging

[redacted]/host_dir.go:64

[AGENTS: Trace]audit_trail

Create, update, and delete operations on reservation files (containing MAC addresses and IP assignments) have no audit trail. These are sensitive DHCP configuration changes that should be logged.

Suggested Fix

Add audit logging for all reservation file operations including MAC address, operation type, timestamp, and user/actor information.

HIGHPII stored in unencrypted SQLite database

[redacted]/lease_database.go:1

[AGENTS: Warden]data-encryption

The SQLite database stores MAC addresses, IP addresses, hostnames, and client IDs without encryption at rest. MAC addresses and IP addresses can constitute PII under GDPR and other privacy regulations. The database file is stored in plaintext.

Suggested Fix

Encrypt the SQLite database file using disk-level encryption or implement database-level encryption for sensitive fields (mac, ipv4, hostname, client_id).

HIGHUnbounded Query Results - Memory Exhaustion

[redacted]/lease_database.go:298

[AGENTS: Siege]dos

**Perspective 1:** The /requests endpoint returns all matching requests without pagination or result size limits. A malicious actor could query a large CIDR range or date range that returns thousands of records, exhausting server memory and CPU. **Perspective 2:** All API endpoints lack rate limiting. Rapid sequential requests can exhaust database connections, CPU, and memory resources. The /requests endpoint is particularly vulnerable due to complex queries.

Suggested Fix

Implement rate limiting middleware (e.g., using gin-ratelimit or custom token bucket) on all endpoints, especially /requests, /leases, and /clients.

HIGHNo Rate Limiting on API Endpoints

[redacted]/main.go:218

[AGENTS: Wallet]denial_of_wallet

All HTTP endpoints lack rate limiting. An attacker can hammer any endpoint (leases, requests, reservations) with unlimited requests, causing resource exhaustion and potential billing costs for database operations, file I/O, and network bandwidth.

Suggested Fix

Implement rate limiting middleware using a token bucket or sliding window algorithm. Set reasonable limits per IP address (e.g., 100 requests/minute).

HIGHNon-cryptographically secure token generation

[redacted]/token.go:65

[AGENTS: Cipher]randomness

Token generation uses uuid.New().String() which may not provide sufficient entropy for security tokens. UUIDs are designed for uniqueness, not cryptographic security.

Suggested Fix

Use crypto/rand or crypto/rand.Read() to generate cryptographically secure random tokens.

HIGHDefault unlimited token reuse (maxUses=0)

[redacted]/token.go:67

[AGENTS: Passkey]credential-policy

The default configuration allows unlimited token reuse (maxUses=0 means math.MaxInt). This creates a single-use token that can be used indefinitely, increasing the risk if a token is compromised.

Suggested Fix

Set a reasonable default for maxUses (e.g., 100) and require explicit configuration for unlimited reuse. Document the security implications of unlimited reuse.

HIGHNo rate limiting on token validation endpoint

[redacted]/token.go:82

[AGENTS: Passkey]brute-force-protection

The TokenChecker.Check() method validates tokens without any rate limiting or throttling. An attacker can attempt unlimited token guesses against the validation endpoint without any protection against brute force attacks.

Suggested Fix

Implement rate limiting on token validation requests using middleware or a rate limiter package. Add request counting and lockout after failed attempts.

HIGHMissing audit logging for authentication failures

[redacted]/token_gin.go:15

[AGENTS: Trace]audit_trail

Token validation failures are logged via c.AbortWithStatusJSON but there is no centralized audit log capturing failed authentication attempts. This prevents detection of brute force attacks and unauthorized access attempts.

Suggested Fix

Add structured audit logging that records failed token checks with timestamp, source IP, and attempt count for alerting on repeated failures.

HIGHToken publishing endpoint lacks authentication

[redacted]/token_gin.go:22

[AGENTS: Blacklist]authentication_bypass

The TokenCheckerPublisher endpoint at path '/' returns tokens without requiring authentication. An attacker who knows the path can intercept tokens, defeating the token-based security mechanism.

Suggested Fix

Add authentication middleware before the token publishing route, or require a separate admin token to access the token endpoint.

MEDIUMUnquoted variable in Authorization header

[redacted]/curl.sh:16

[AGENTS: Tripwire]shell_injection

The DNSMASQ_WEB_TOKEN variable is used unquoted in the Authorization header, which could cause issues if the token contains spaces or special characters.

Suggested Fix

Quote the variable: echo "$DNSMASQ_WEB_TOKEN"

MEDIUMUnbounded String Interpolation in JSON

[redacted]/reservations.sh:6

[AGENTS: Siege]dos

The reservation_add function uses string interpolation to construct JSON without validation. Malicious input could cause malformed JSON, excessive memory allocation, or injection attacks.

Suggested Fix

Use jq to construct JSON safely instead of string concatenation. Validate all input fields before inclusion in JSON.

MEDIUMSSH credentials potentially exposed in shell scripts

[redacted]/token.sh:13

[AGENTS: Supply]secrets_management

Shell scripts reference SSH configuration for remote token access. SSH keys or credentials could be accidentally committed or exposed through environment variable logging.

Suggested Fix

Use SSH agent forwarding instead of embedding credentials. Add warnings about not committing SSH keys to version control.

MEDIUMUnquoted variable in curl command

[redacted]/token.sh:14

[AGENTS: Tripwire]shell_injection

The DNSMASQ_WEB_TOKEN_SOCKET variable is used unquoted in the curl command, which could cause word splitting or glob expansion issues if the socket path contains spaces or special characters.

Suggested Fix

Quote the variable: curl --unix-socket "$DNSMASQ_WEB_TOKEN_SOCKET" -s .

MEDIUMSSH command injection via variable substitution

[redacted]/token.sh:20

[AGENTS: Specter]command-injection

The DNSMASQ_WEB_TOKEN_CMD variable is constructed using variable substitution without proper quoting. If DNSMASQ_WEB_SERVER contains malicious input, it could be injected into the curl command.

Suggested Fix

Use proper quoting and validation for all variables. Consider using a whitelist for allowed server address formats.

MEDIUMCommand injection via os.Args manipulation

[redacted]/daemon.go:95

[AGENTS: Specter]command-injection

The daemon uses os.Args directly to construct the child process command. While os.Args is typically controlled by the application, if the application is invoked with malicious arguments, they could be passed to the child process.

Suggested Fix

Explicitly whitelist and validate command-line arguments before passing them to the child process. Use a safe argument parsing mechanism.

MEDIUMUnix socket created before privilege drop

[redacted]/daemon.go:100

[AGENTS: Tripwire]privilege_escalation

The Unix domain socket is created and passed to the child process before privilege dropping occurs. If the socket permissions are not properly restricted, processes running as root could access it before the child process drops privileges.

Suggested Fix

Set restrictive socket permissions (0600) immediately after creation and before passing to child

MEDIUMPID file operations lack audit logging

[redacted]/daemon.go:108

[AGENTS: Trace]audit_trail

PID file creation and deletion have no audit trail. This is important for security monitoring and forensics.

Suggested Fix

Add audit logging for PID file operations including file path, PID, and operation type.

MEDIUMNo consent tracking mechanism for data collection

[redacted]/host_dir.go:1

[AGENTS: Warden]consent-tracking

The application collects and stores client information (MAC addresses, hostnames, IP addresses) without any consent tracking mechanism. GDPR requires explicit consent for processing personal data.

Suggested Fix

Implement consent tracking system to record when and how consent was obtained for data collection. Store consent records alongside client data.

MEDIUMFile path validation insufficient

[redacted]/host_dir.go:75

[AGENTS: Tripwire]file_system

MAC address is used as a filename without proper sanitization. While MAC addresses are generally safe, the code should validate that the normalized MAC doesn't contain path traversal characters or special characters.

Suggested Fix

Add additional validation to ensure MAC address cannot be used for path traversal attacks

MEDIUMFile permissions hardcoded without integrity verification

[redacted]/host_dir.go:86

[AGENTS: Supply]build_integrity

Reservation files are written with 0640 permissions. No verification that file system integrity is maintained, allowing potential tampering of reservation data.

Suggested Fix

Add file integrity checks using checksums. Implement file permission verification on startup.

MEDIUMMAC address validation may not catch all malformed inputs

[redacted]/host_dir.go:105

[AGENTS: Blacklist]input_validation

The validateMAC function uses ipaddr.NewMACAddressString which may accept some edge cases. The validation should be stricter to prevent potential injection through malformed MAC addresses in file names.

Suggested Fix

Add additional validation: validate that MAC address matches expected format pattern before processing.

MEDIUMPotential path traversal in host directory operations

[redacted]/host_dir.go:108

[AGENTS: Specter]path-traversal

The hostDirPath parameter is used with filepath.Join but is not validated against path traversal attempts. An attacker could potentially specify a path like '../../../etc/passwd' if the parameter is user-controlled.

Suggested Fix

Validate hostDirPath to ensure it doesn't contain path traversal sequences. Use filepath.Clean() and verify the resolved path is within an expected base directory.

MEDIUMDetailed error messages reveal validation logic

[redacted]/host_dir.go:118

[AGENTS: Recon]information_disclosure

Error responses include detailed validation messages like 'invalid MAC address', 'invalid IPv4 address', 'no such reservation' which help attackers understand expected data formats and system structure.

Suggested Fix

Use generic error messages for validation failures

MEDIUMNo File Size Limits on Reservation Writes

[redacted]/host_dir.go:120

[AGENTS: Siege]dos

The createReservationFile function writes files without size limits. A malicious actor could create extremely large reservation files, exhausting disk space and I/O resources.

Suggested Fix

Add maximum file size validation before writing. Implement streaming for large file operations.

MEDIUMMissing audit on reservation read operations

[redacted]/host_dir.go:193

[AGENTS: Trace]audit_trail

GET requests to reservation files have no audit trail. Reading sensitive DHCP reservation data should be logged for compliance and security monitoring.

Suggested Fix

Add logging for reservation read operations, especially when accessed by non-admin users.

MEDIUMNo data retention policy or TTL for PII

[redacted]/lease_database.go:1

[AGENTS: Warden]data-retention

Lease, request, and client data persists indefinitely without any expiration mechanism. GDPR Article 17 requires data to be deleted when no longer necessary. No TTL or retention policy is implemented.

Suggested Fix

Implement data retention policies with configurable TTL for leases, requests, and client data. Add automatic cleanup routines for expired data.

MEDIUMMissing data classification for PII fields

[redacted]/lease_database.go:1

[AGENTS: Warden]data-classification

No data classification is implemented to identify which fields contain PII. MAC addresses, IP addresses, and hostnames may be considered personal data under various regulations. Makes compliance verification difficult.

Suggested Fix

Implement data classification schema to mark fields containing PII. Document which data elements are considered personal data for compliance purposes.

MEDIUMDatabase queries lack audit logging

[redacted]/lease_database.go:145

[AGENTS: Trace]audit_trail

Sensitive database operations on leases, clients, and requests tables have no audit trail. This includes queries that could expose client MAC addresses, IP assignments, and network topology information.

Suggested Fix

Implement audit logging for database queries, especially those accessing sensitive fields like MAC addresses and IP assignments.

MEDIUMNo Query Complexity Limits on Database Endpoints

[redacted]/lease_database.go:232

[AGENTS: Wallet]denial_of_wallet

GET /requests and GET /clients endpoints can return large result sets without pagination or result size limits. An attacker could query all data, causing excessive database load and response bandwidth costs.

Suggested Fix

Implement pagination (limit/offset) with sensible defaults (e.g., max 1000 results). Add query timeout and result size caps.

MEDIUMNo logging on requests endpoint queries

[redacted]/lease_database.go:280

[AGENTS: Trace]audit_trail

The /requests endpoint returns detailed DHCP request history including MAC addresses and IP assignments. No audit trail tracks who queried what data.

Suggested Fix

Add audit logging for requests endpoint queries, especially when using CIDR or range filters to query large datasets.

MEDIUMMissing audit logging for sensitive data access

[redacted]/main.go:1

[AGENTS: Warden]audit-logging

No audit logging is implemented for access to sensitive data (leases, reservations, client information). GDPR Article 30 requires record-keeping of data processing activities. Cannot track who accessed what data or when.

Suggested Fix

Implement comprehensive audit logging for all data access operations, including read/write operations on leases, reservations, and client data. Log user identity, timestamp, and operation type.

MEDIUMNo mechanism to track data location for cross-border transfers

[redacted]/main.go:1

[AGENTS: Warden]cross-border-transfers

No tracking of data location or cross-border data transfer mechanisms. GDPR requires safeguards when transferring personal data outside the EEA. Cannot verify if data is stored in compliant jurisdictions.

Suggested Fix

Implement data location tracking and ensure compliance with cross-border transfer requirements (e.g., SCCs, adequacy decisions). Document data storage locations.

MEDIUMGin debug mode enabled by default

[redacted]/main.go:14

[AGENTS: Recon]debug_exposure

gin.Default() is used which may enable debug mode, potentially exposing detailed stack traces and internal framework information in error responses.

Suggested Fix

Explicitly set gin.SetMode(gin.ReleaseMode) before using gin.Default()

MEDIUMNo TLS enforcement - all traffic unencrypted

[redacted]/main.go:27

[AGENTS: Cipher]transport

The application runs on HTTP without TLS enforcement. All API traffic including authentication tokens is transmitted in plaintext, making it vulnerable to interception and token theft.

Suggested Fix

Enforce HTTPS/TLS for all API endpoints. Use TLS 1.2+ with strong cipher suites.

MEDIUMNo Connection Timeout Configuration

[redacted]/main.go:125

[AGENTS: Siege]dos

The Gin server does not configure connection timeouts. Long-running queries or slow clients can hold connections open indefinitely, exhausting server resources.

Suggested Fix

Configure Gin with reasonable read/write timeouts (e.g., 30s) and connection pool limits.

MEDIUMUnix Socket Permissions Not Configured

[redacted]/main.go:145

[AGENTS: Deadbolt]sessions

The Unix domain socket at /run/dnsmasq-web.sock is created without explicit permission restrictions. If accessible by other users, they could retrieve valid tokens.

Suggested Fix

Set restrictive permissions on the Unix socket (e.g., 0600) and ensure only the intended user can access it. Consider using socket directory permissions as an additional control.

MEDIUMToken endpoint exposed on UNIX socket without additional protection

[redacted]/main.go:155

[AGENTS: Passkey]authentication

The token publishing endpoint is accessible via UNIX socket at /run/dnsmasq-web.sock. While UNIX sockets provide some isolation, there's no additional authentication layer beyond the socket itself.

Suggested Fix

Consider implementing additional authentication mechanisms for the token endpoint or restrict socket access via file permissions.

MEDIUMNo Request Size Validation

[redacted]/main.go:180

[AGENTS: Wallet]denial_of_wallet

HTTP requests lack Content-Length validation. Large requests could exhaust memory or cause DoS through oversized payloads.

Suggested Fix

Set maximum request size limits (e.g., 10MB) and reject oversized requests with 413 status code.

MEDIUMToken checking can be completely disabled

[redacted]/main.go:186

[AGENTS: Tripwire]authentication

The -T flag allows setting maxTokens to 0, which completely disables token checking. This should be a warning or require additional confirmation in production.

Suggested Fix

Add a warning message when token checking is disabled, or require additional flags to disable it

MEDIUMNo log rotation or retention policy

[redacted]/main.go:216

[AGENTS: Trace]log_management

The application does not implement log rotation or retention policies. This can lead to disk space exhaustion and makes it difficult to comply with data retention requirements.

Suggested Fix

Implement log rotation with configurable retention period and size limits.

MEDIUMToken endpoint accessible without authentication

[redacted]/main.go:227

[AGENTS: Recon]authentication_bypass

The root endpoint '/' serves tokens via TokenCheckerPublisher without any authentication requirement, allowing attackers to obtain valid tokens for API access.

Suggested Fix

Add authentication requirement to token publishing endpoint or use a separate authenticated endpoint

MEDIUMMissing X-Frame-Options header

[redacted]/main.go:257

[AGENTS: Blacklist]clickjacking

The application does not set X-Frame-Options header, allowing the application to be embedded in iframes by malicious sites. This enables clickjacking attacks where users may unknowingly interact with malicious overlays.

Suggested Fix

Add middleware to set X-Frame-Options header: r.Use(func(c *gin.Context) { c.Header("X-Frame-Options", "DENY"); c.Next() })

MEDIUMMissing Content-Security-Policy header

[redacted]/main.go:257

[AGENTS: Blacklist]content_security_policy

No Content-Security-Policy header is configured. This leaves the application vulnerable to XSS attacks, especially if HTML content is ever rendered. CSP is the last line of defense against XSS.

Suggested Fix

Add CSP middleware: r.Use(func(c *gin.Context) { c.Header("Content-Security-Policy", "default-src 'self'; script-src 'self'; style-src 'self' 'unsafe-inline'; img-src 'self' data:; connect-src 'self'; frame-ancestors 'none'"); c.Next() })

MEDIUMAll API endpoints accessible without authentication when token checking disabled

[redacted]/main.go:257

[AGENTS: Recon]authentication_weakness

When -T 0 flag is used to disable token checking, all endpoints (/leases, /clients, /requests, /reservations, etc.) become completely unauthenticated, allowing unauthorized access to DHCP data.

Suggested Fix

Implement mandatory authentication for all endpoints regardless of token checking configuration

MEDIUMTokens stored only in memory without persistence

[redacted]/token.go:10

[AGENTS: Passkey]credential-storage

Tokens are stored only in memory (tokenChecker.tokens array) and are lost on process restart. This means tokens cannot be reused across restarts, but also means there's no audit trail of token usage.

Suggested Fix

Consider persisting token metadata to disk for audit purposes while maintaining the in-memory validation for performance.

MEDIUMDefault Token Configuration Allows Unlimited Reuse

[redacted]/token.go:67

[AGENTS: Wallet]denial_of_wallet

Default token configuration (maxUses=0, maxTime=0) allows a single token to be used indefinitely forever. If leaked, this provides permanent unlimited access to all API endpoints.

Suggested Fix

Change defaults to require token expiration and limited uses. Use maxUses=100, maxTime=24h by default.

MEDIUMNo token expiration by default

[redacted]/token.go:72

[AGENTS: Passkey]credential-policy

The default tokenTimeout is 0 (forever), meaning tokens never expire. This increases the window of opportunity for token compromise and replay attacks.

Suggested Fix

Set a reasonable default token timeout (e.g., 1 hour) and require explicit configuration for permanent tokens.

MEDIUMToken publishing endpoint exposed without rate limiting

[redacted]/token_gin.go:17

[AGENTS: Supply]secrets_management

TokenCheckerPublisher exposes a public endpoint that generates tokens. Without rate limiting, this could be abused for token enumeration or DoS attacks against the token system.

Suggested Fix

Add rate limiting to token publishing endpoint. Implement token request quotas and cooldown periods.

MEDIUMError message reveals internal implementation

[redacted]/token_gin.go:18

[AGENTS: Blacklist]information_disclosure

The error response 'Unauthorized token' in the middleware response reveals that the application uses token-based authentication, which could aid attackers in reconnaissance.

Suggested Fix

Use generic error messages: c.AbortWithStatusJSON(http.StatusUnauthorized, gin.H{"error": "Access denied"})

MEDIUMToken Ring Buffer Can Be Exhausted

[redacted]/token_gin.go:19

[AGENTS: Siege]dos

The token checker uses a fixed-size ring buffer. If maxCount is set low and many tokens are requested rapidly, the buffer could be exhausted, causing denial of service for legitimate users.

Suggested Fix

Add monitoring for buffer exhaustion and implement graceful degradation or queueing when the buffer is full.

MEDIUMToken publishing endpoint lacks access logging

[redacted]/token_gin.go:25

[AGENTS: Trace]audit_trail

The TokenCheckerPublisher endpoint exposes tokens without any audit trail. Every token retrieval is a security event that should be logged for compliance and security monitoring.

Suggested Fix

Add audit logging to track token retrieval events including timestamp, source, and token UUID (masked in logs).

LOWRelease process documentation lacks build reproducibility guarantees

[redacted]/README.md:1

[AGENTS: Supply]build_reproducibility

README mentions releases but doesn't document build reproducibility requirements or verification procedures for downloaded binaries.

Suggested Fix

Document build reproducibility requirements. Include checksums and signatures in release documentation.

LOWUnsafe eval usage

[redacted]/jq_commands.sh:10

[AGENTS: Tripwire]shell_injection

The script uses eval to construct jq expressions from variable contents. While the variables are set by the script itself, this pattern could be exploited if variables are modified externally.

Suggested Fix

Use safer string manipulation instead of eval where possible

LOWEnvironment Variables Preserved Without Filtering

[redacted]/daemon.go:95

[AGENTS: Wallet]denial_of_wallet

When -E flag is set, all environment variables are copied to child process. Malicious environment variables could configure expensive downstream services or expose credentials.

Suggested Fix

Filter environment variables to only allow whitelisted variables when preserving environment.

LOWNo Query Timeout for Database Operations

[redacted]/main.go:165

[AGENTS: Siege]dos

Database queries in lease_database.go have no timeout configured. Malicious or malformed queries could run indefinitely, exhausting database connections and CPU.

Suggested Fix

Add query timeouts at the database driver level (e.g., 30s for complex queries).

LOWTokens stored in memory without encryption

[redacted]/token.go:1

[AGENTS: Warden]data-encryption

Authentication tokens are stored in memory but not encrypted. While tokens are UUIDs, the token management system could be enhanced with encryption for additional security.

Suggested Fix

Consider encrypting token storage in memory or implementing secure token storage mechanisms.

LOWToken count not persisted across restarts

[redacted]/token.go:26

[AGENTS: Passkey]credential-storage

The token count (usage tracking) is stored in memory only. On restart, all token usage counters are reset, potentially allowing tokens to be reused beyond their intended limits.

Suggested Fix

Persist token usage counts to disk to maintain usage tracking across restarts.

CRITICALToken values may be exposed in verbose mode

[redacted]/main.go:12

[AGENTS: Trace]sensitive_data_exposure

The verbose flag (-v) enables debug output that includes token checking configuration. If verbose mode is enabled in production, token generation parameters and usage patterns could be exposed in logs.

Suggested Fix

Remove verbose logging of token configuration or ensure verbose mode is never enabled in production environments.

CRITICALUnauthenticated Token Publishing Endpoint

[redacted]/token_gin.go:21

[AGENTS: Deadbolt]sessions

The TokenCheckerPublisher function exposes a public endpoint that returns valid authentication tokens without any authentication requirement. An attacker who can reach this endpoint can obtain valid tokens and impersonate legitimate users.

Suggested Fix

Add authentication middleware before the token publishing endpoint, or restrict access to the Unix socket only (local access). Consider requiring a separate admin token or API key to retrieve new tokens.

CRITICALUnauthenticated Token Publishing Endpoint

[redacted]/token_gin.go:25

[AGENTS: Wallet]denial_of_wallet

TokenCheckerPublisher exposes a public endpoint that returns valid tokens without authentication. Any attacker can call this endpoint to obtain unlimited tokens, enabling abuse of all authenticated API endpoints. Combined with no rate limiting, this creates unlimited API access.

Suggested Fix

Add authentication requirement to the token publishing endpoint. Only allow token retrieval from the UNIX socket or require client authentication.

Summary

Consensus from 36 reviewer(s): Pedant, Razor, Chaos, Sentinel, Specter, Blacklist, Syringe, Sanitizer, Vault, Gatekeeper, Deadbolt, Passkey, Cipher, Warden, Compliance, Entropy, Phantom, Siege, Lockdown, Gateway, Harbor, Tripwire, Trace, Supply, Infiltrator, Fuse, Recon, Vector, Provenance, Prompt, Wallet, Mirage, Weights, Exploit, Tenant, Egress Total findings: 89 Severity breakdown: 6 critical, 25 high, 51 medium, 7 low

Note: Fixing issues can create a domino effect — resolving one finding often surfaces new ones that were previously hidden. Multiple scan-and-fix cycles may be needed until you’re satisfied no further issues remain. How deep you go is your call.