9ad3afbd22
- Updated Definition of Done report with detailed checks and results for backend and frontend tests. - Documented issues related to race conditions and test failures in QA reports. - Improved security scan notes and code cleanup status in QA reports. - Added summaries for rate limit integration test fixes, including root causes and resolutions. - Introduced new debug and integration scripts for rate limit testing. - Updated security documentation to reflect changes in configuration and troubleshooting steps. - Enhanced troubleshooting guides for CrowdSec and Go language server (gopls) errors. - Improved frontend and scripts README files for clarity and usage instructions.
2.1 KiB
2.1 KiB
Additional Security Threats to Consider
1. Supply Chain Attacks
- Threat: Compromised Docker images, npm packages, Go modules
- Current Protection: ❌ None
- Recommendation: Add Trivy scanning (already in CI) + SBOM generation
2. DNS Hijacking / Cache Poisoning
- Threat: Attacker redirects DNS queries to malicious servers
- Current Protection: ❌ None (relies on system DNS resolver)
- Recommendation: Document use of encrypted DNS (DoH/DoT) in deployment guide
3. TLS Downgrade Attacks
- Threat: Force clients to use weak TLS versions
- Current Protection: ✅ Caddy enforces TLS 1.2+ by default
- Recommendation: Document minimum TLS version in security.md
4. Certificate Transparency (CT) Log Poisoning
- Threat: Attacker registers fraudulent certs for your domains
- Current Protection: ❌ None
- Recommendation: Add CT log monitoring (future feature)
5. Privilege Escalation (Container Escape)
- Threat: Attacker escapes Docker container to host OS
- Current Protection: ⚠️ Partial (Docker security best practices)
- Recommendation: Document running with least-privilege, read-only root filesystem
6. Session Hijacking / Cookie Theft
- Threat: Steal user session tokens via XSS or network sniffing
- Current Protection: ✅ HTTPOnly cookies, Secure flag, SameSite (verify implementation)
- Recommendation: Add CSP (Content Security Policy) headers
7. Timing Attacks (Cryptographic Side-Channel)
- Threat: Infer secrets by measuring response times
- Current Protection: ❌ Unknown (need bcrypt timing audit)
- Recommendation: Use constant-time comparison for tokens
Enterprise-Level Security Gaps:
- Missing: Security Incident Response Plan (SIRP)
- Missing: Automated security update notifications
- Missing: Multi-factor authentication (MFA) for admin accounts (Use Authentik via built in. No extra external containers. Consider adding SSO as well just for Charon. These are not meant to pass auth to Proxy Hosts. Charon is a reverse proxy, not a secure dashboard.)
- Missing: Audit logging for compliance (GDPR, SOC 2)