Security audit follow-up: validate and remediate 30 candidates

[QueryPlanner]

Context

A standard-profile security audit was performed with Cloudflare's security-audit-skill against main at commit d006624c150973a5637dbfb47ec0b4a6ff3ed613.

Result: 0 confirmed findings, 30 needs-validation candidates, and 41 coverage units. The audit was source-only because the required OS-enforced sandbox was unavailable. The candidates below are not confirmed vulnerabilities until the listed local or deployment checks are completed.

Completion criteria

• Assign an owner for each item and record whether the relevant interface is deployed and reachable.
• Apply code, workflow, configuration, or deployment hardening where the risk is confirmed.
• Run bounded local checks only in an OS-enforced, no-network, read-only target sandbox using dummy data and mocked providers.
• Complete the owner/deployment checks for GitHub Actions, SSH/Tailscale, dashboard exposure, provider limits, R2 lifecycle, ADK authentication, and registry/package provenance.
• Add regression tests for every confirmed issue.
• Rerun the security audit, update each fingerprint as confirmed, rejected, or still needs validation, and attach the evidence.

Candidate checklist

Access control, identity, and provenance

• agent/registry:unscoped-owner-tools - Bind the public ADK root's memory and database tools to authenticated request identity. Verify with two dummy owners that a caller cannot select the other owner's ID.
• declarative-db/tool-context-provenance - Ensure declarative database tools derive the owner from trusted provenance rather than caller-selected context. Test the native ADK/web path and the Telegram-bound path.
• gmail/tool-context-provenance - Bind Gmail tools to authenticated caller identity or disable them on generic ADK/web surfaces. Test mismatched and missing Telegram context with dummy Gmail records.
• userfiles-plugin-unbound-sender-state-generic-app - Prevent generic sessions from setting temp:telegram_sender_user_id; derive it server-side or disable the user-files plugin outside Telegram.
• telegram-session-state-unbound-delivery-destination - Bind sandbox file delivery to the authenticated Telegram chat, topic, and sender. Verify cross-session destination substitution is rejected.
• telegram/authorize-update/access-code-off-group-bypass - Keep group and forum-topic authorization enforced even when the access code is empty. Add a regression test for unauthorized group updates.
• deployment:unauthenticated-dashboard-bind-policy - Confirm the effective production bind address, port mapping, reverse proxy, host firewall, and Tailscale ACL restrict dashboard and API routes to intended operators.

Agent, tool, and delegated-action boundaries

• telegram/reminder/replayed-as-authoritative-user-turn - Treat scheduled reminder content as untrusted data, not a fresh authoritative user turn. Require fresh authorization for side-effecting tools and test with a harmless mocked tool.
• tools/search:indirect-side-effect - Ensure search-result text cannot cause an unrequested reminder or other mutation. Run a deterministic offline model/tool fixture with instruction-like search results.
• src/blacki/tools/zepto.py:remote-manifest-capability-boundary - Do not trust a remote MCP manifest to define capabilities. Allowlist tool names and schemas, and verify confirmation semantics with a dummy manifest.
• src/blacki/zepto/client.py:unlocked-npx-bridge-resolution - Remove or strictly constrain the unlocked npx fallback; use a pinned, digest-verified bridge. Verify production authentication cannot resolve an unpinned package.
• src/blacki/tools/sandbox.py:raw-sdk-error-propagation - Redact SDK exception details before returning them to the model or logs. Inject dummy exceptions containing a canary and assert that the canary is absent.

Data lifecycle, privacy, and concurrency

• health/delete-connection-stale-work - Fence queued and in-flight health work after disconnect. Verify stale workers cannot recreate exports or call the provider after revocation.
• health/nutrition-export/due-without-lease - Add a durable lease or idempotency mechanism for due nutrition exports. Test two worker instances against shared dummy storage.
• health/sync-generation-fence-after-revocation - Add a generation or revocation fence so an in-flight sync cannot repopulate summaries after disconnect or account replacement.
• user-files/passive-expiry-not-cascaded - Confirm the R2 lifecycle rule actually deletes expired objects for the configured prefix, or add explicit deletion and a retention test.
• privacy-logging:unclassified-content-to-unauthenticated-dashboard:configuration-gated-redaction - Make private-content logging redaction unconditional at the boundary. Verify lifecycle callbacks, local logs, OTLP sinks, and dashboard log access using synthetic data.
• sandbox/images:multimodal-bytes-enter-debug-lifecycle-logs - Verify image bytes or equivalent encoded data cannot enter debug lifecycle logs. Test multimodal callbacks with a synthetic image and inspect only a predeclared local artifact.

Resource bounds and availability

• memory/list-page-size-client-fetch-amplification - Enforce finite server-side and client-side page-size limits before calling Mem0/Qdrant. Test zero, negative, very large, and deep-page inputs.
• memory/search/agent-limit-unbounded-qdrant-materialization - Cap search limits and response materialization, with timeouts and tenant quotas. Test oversized limits against a deterministic dummy client.
• reminders/scheduler/unbounded-pending-queue - Add per-user and global pending-reminder quotas plus fair scheduling. Test one tenant's finite backlog against an independent reminder.
• telegram/albums/media-turn-backlog - Bound or supersede queued media-album turns and verify unrelated conversations are not starved.
• telegram/cloudflare-transcription/unbounded-provider-response-buffer - Add a response-size limit before full buffering and enforce downstream transcript limits. Test progressively larger dummy responses.
• telegram/media/download-buffer-before-limit - Enforce attachment limits during streaming or before materializing the full response. Test a response without Content-Length that exceeds the configured limit.

CI, supply chain, and deployment

• ci/docs-pages-dispatch-privileged-build - Restrict manual Pages dispatch to protected refs and verify that selected refs cannot inherit privileged tokens, OIDC identity, or deployment permissions.
• ci/floating-third-party-actions-in-secret-jobs - Pin third-party Actions to immutable commit SHAs and verify publisher provenance and organization policy.
• ci/pull-request-secret-bearing-quality-job - Ensure fork and untrusted pull-request jobs cannot access CODECOV_TOKEN or other secrets; verify checkout ref and token permissions.
• deployment:root-executed-mutable-docker-installer - Replace the root-executed mutable Docker installer with a pinned and integrity-verified artifact. Verify the host fails closed on identity mismatch.
• deployment:ssh-host-authentication-disabled - Pin or CA-verify the production SSH host identity before transferring deployment secrets. Confirm Tailscale routing and ACLs do not substitute for host authentication.
• supply-chain:unbound-docker-and-uv-inputs - Pin base images, apt inputs, and uv artifacts by digest/checksum; verify registry provenance, attestation, and promotion policy.

Evidence to record

For every item, record: affected path and commit, attacker or lower-trust boundary, exact reproduction input, observed result, deployment assumptions, remediation, regression test, and final status. Do not include real credentials, provider data, or live-service secrets.

The complete audit artifacts were generated separately: REPORT.md, NEEDS-VALIDATION.md, FINDINGS-DETAIL.md, findings.json, and coverage-ledger.json.