93894c517b
Critical security fix addressing CWE-312/315/359 (Cleartext Storage/Cookie Storage/Privacy Exposure) where CrowdSec bouncer API keys were logged in cleartext. Implemented maskAPIKey() utility to show only first 4 and last 4 characters, protecting sensitive credentials in production logs. Enhanced CrowdSec configuration import validation with: - Zip bomb protection via 100x compression ratio limit - Format validation rejecting zip archives (only tar.gz allowed) - CrowdSec-specific YAML structure validation - Rollback mechanism on validation failures UX improvement: moved CrowdSec API key display from Security Dashboard to CrowdSec Config page for better logical organization. Comprehensive E2E test coverage: - Created 10 test scenarios including valid import, missing files, invalid YAML, zip bombs, wrong formats, and corrupted archives - 87/108 E2E tests passing (81% pass rate, 0 regressions) Security validation: - CodeQL: 0 CWE-312/315/359 findings (vulnerability fully resolved) - Docker Image: 7 HIGH base image CVEs documented (non-blocking, Debian upstream) - Pre-commit hooks: 13/13 passing (fixed 23 total linting issues) Backend coverage: 82.2% (+1.1%) Frontend coverage: 84.19% (+0.3%)
Implementation Documentation Archive
This directory contains archived implementation documentation and historical records of feature development in Charon.
Purpose
These documents serve as historical references for:
- Feature implementation details and decisions
- Migration summaries and upgrade paths
- Investigation reports and debugging sessions
- Phase completion records
Document Index
Documents will be organized here after migration from the project root:
| Document | Description |
|---|---|
AGENT_SKILLS_MIGRATION_SUMMARY.md |
Agent skills system migration details |
BULK_ACL_FEATURE.md |
Bulk ACL feature implementation |
gorm_security_scanner_complete.md |
GORM Security Scanner implementation and usage |
I18N_IMPLEMENTATION_SUMMARY.md |
Internationalization implementation |
IMPLEMENTATION_SUMMARY.md |
General implementation summary |
INVESTIGATION_SUMMARY.md |
Investigation and debugging records |
ISSUE_16_ACL_IMPLEMENTATION.md |
Issue #16 ACL implementation details |
PHASE_*_COMPLETE.md |
Phase completion documentation |
QA_*.md |
QA audit and verification reports |
SECURITY_*.md |
Security implementation records |
WEBSOCKET_FIX_SUMMARY.md |
WebSocket fix implementation |
Note
These are historical implementation records. For current documentation, refer to:
/docs/- Main documentation/README.md- Project overview/CONTRIBUTING.md- Contribution guidelines/CHANGELOG.md- Version history