docs: add TrustBench flaw review report#1

Open

Co-Messi wants to merge 2 commits intomainfrom

codex/find-flaws-in-the-repository

Owner

Co-Messi commented Mar 30, 2026

Motivation

Surface high-impact security and reliability issues discovered during a source review so maintainers can prioritize fixes and mitigations.

Description

Add docs/security-findings-2026-03-30.md documenting five findings and recommended fixes, including unsafe subprocess fallback in run_benchmark.py, weak subprocess "sandbox" behavior in trustbench/runner/sandbox.py, silent Postgres→SQLite fallback in trustbench/db.py, insecure default CORS in trustbench/api/app.py, and unbounded API reads/pagination in trustbench/api/routes.py.

Testing

Ran pytest -q tests/test_project_setup.py, which produced 1 failing test (test_package_metadata_exposes_console_script); this failure is unrelated to this docs-only change.


          docs: add repo flaw review with security and reliability risks

bf18e31

Co-Messi added the codex label

— with

ChatGPT Codex Connector


          fix: harden defaults for sandbox, db fallback, and API config

df73497

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels