Charon/docs/reports/qa_report.md

QA/Security DoD Audit Report — Issue #929

Date: 2026-04-20 Repository: /projects/Charon Branch: feature/beta-release Scope assessed: tests/a11y/a11y-baseline.ts, tests/a11y/dns-providers.a11y.spec.ts, tests/a11y/README.md

Final Recommendation

FAIL

Reason: The Trivy filesystem gate reports one HIGH vulnerability (CVE-2026-34040) and is still outstanding.

Gate Summary

#	DoD Gate	Status	Notes
1	Playwright E2E first	PASS (with flake observed)	Initial run had 1 timeout failure; targeted rerun passed fully
2	GORM security scan (conditional)	N/A	Not triggered; touched files are a11y tests/docs only, no backend model/DB scope
3a	Backend coverage task/script	PASS	92.8% coverage vs 85% minimum
3b	Frontend coverage task/script	PASS	90.4% lines vs 87% configured minimum
4	Local patch coverage report after coverage artifacts	PASS	Required artifacts generated; report indicates 0 changed lines / 100% patch coverage
5	Frontend type check	PASS	No TypeScript errors
6	Pre-commit hooks (fast set)	PASS	Lefthook pre-commit checks passed
7a	Trivy filesystem scan	FAIL	1 HIGH finding (CVE-2026-34040)
7b	Docker image scan (mandatory)	PASS	Grype image scan shows Medium-only findings, no High/Critical
7c	CodeQL Go + JS (CI-aligned)	PASS	0 error-level findings
8	Linting and required quality checks	PASS	lint-fast passed, frontend lint passed (warnings only), backend/frontend build passed

Detailed Evidence

1) Playwright E2E first

Environment rebuild decision:

• Rebuild skipped because charon-e2e container was already healthy and health endpoint returned HTTP 200.

Execution evidence:

• Command: PLAYWRIGHT_HTML_OPEN=never npx playwright test tests/a11y --project=firefox
• Result: 27 passed, 1 failed
• Failure evidence: tests/a11y/security.a11y.spec.ts timed out at makeAxeBuilder().analyze() with test timeout 90000ms.

Revalidation:

• Command: PLAYWRIGHT_HTML_OPEN=never npx playwright test tests/a11y/security.a11y.spec.ts --project=firefox
• Result: 9 passed, 0 failed
• Disposition: treated as flaky timeout, currently passing.

Artifacts:

• playwright-report/
• test-results/

2) GORM scan (conditional)

Trigger check:

• Changed files are under tests/a11y and docs only.
• No changes under backend/internal/models, GORM services, or migrations.

Disposition:

• Gate not applicable for this scope.

3) Coverage tests

Backend coverage:

• Command: .github/skills/scripts/skill-runner.sh test-backend-coverage
• Result: PASS
• Coverage: 92.8% (minimum required 85%)
• Artifact: backend/coverage.txt

Frontend coverage:

• Command: .github/skills/scripts/skill-runner.sh test-frontend-coverage
• Result: PASS
• Summary: 182 test files passed, 5 skipped; 2163 tests passed, 90 skipped
• Coverage: Statements 89.51%, Branches 82.09%, Functions 87.18%, Lines 90.4%
• Gate evaluation: PASS (lines 90.4% vs minimum 87%)
• Artifacts:
  • frontend/coverage/lcov.info
  • frontend/coverage/coverage-summary.json
  • frontend/coverage/index.html

4) Local patch coverage report (post-coverage)

Execution:

• Command: bash scripts/local-patch-report.sh
• Result: PASS

Required artifacts confirmed:

• test-results/local-patch-report.md
• test-results/local-patch-report.json

Report outcome:

• 0 changed lines, 100% patch coverage, no files below 90% patch threshold.

5) Frontend type check

Execution:

• Command: cd frontend && npm run type-check
• Result: PASS

6) Pre-commit hooks (fast set)

Execution:

• Command: lefthook run pre-commit
• Result: PASS
• Passing hooks include check-yaml, actionlint, end-of-file-fixer, trailing-whitespace, dockerfile-check, shellcheck.

7) Security scans

7a. Trivy filesystem scan:

• Command: .github/skills/scripts/skill-runner.sh security-scan-trivy
• Result: FAIL (exit code 2)
• Finding:
  • CVE-2026-34040 (HIGH)
  • Package: github.com/docker/docker
  • Installed: v28.5.2+incompatible
  • Fixed: 29.3.1
• Disposition: Outstanding blocker.

7b. Docker image scan (mandatory):

• Command: .github/skills/scripts/skill-runner.sh security-scan-docker-image
• Validation command: jq severity counts from grype-results.json
• Result: PASS
• Severity counts: {"Medium": 4}
• High/Critical list: none

Artifacts:

• sbom-generated.json
• sbom.cyclonedx.json
• grype-results.json
• grype-results.sarif

7c. CodeQL (CI-aligned Go + JS):

• Command: .github/skills/scripts/skill-runner.sh security-scan-codeql all summary
• Result: PASS (exit code 0)

SARIF summary:

• codeql-results-go.sarif: 0 errors, 1 warning, 0 notes
• codeql-results-javascript.sarif: 0 errors, 0 warnings, 0 notes
• codeql-results-js.sarif: 0 errors, 0 warnings, 0 notes

Error-level findings:

• None

8) Linting and required quality checks

Fast lint:

• Command: make -C /projects/Charon lint-fast
• Result: PASS (0 issues)

Frontend lint:

• Command: cd frontend && npm run lint
• Result: PASS with warnings
• Summary: 0 errors, 937 warnings

Build checks:

• Command: cd /projects/Charon/backend && go build ./...
• Result: PASS
• Command: cd /projects/Charon/frontend && npm run build
• Result: PASS

Additional Security Validation

Gotify token exposure check:

• Command: rg -n --hidden -S "token=|gotify.*token|?token=" test-results docs/reports *.json *.sarif
• Result: no matches in scanned QA/security artifacts.

Blockers

1. Trivy filesystem scan reports HIGH CVE-2026-34040 in github.com/docker/docker v28.5.2+incompatible.

Decision

Overall DoD decision for Issue #929: FAIL until the Trivy HIGH finding is remediated or explicitly accepted per project security policy.

---

CHARON-2025-001 — CrowdSec Go Stdlib CVE Cluster (RESOLVED)

Field	Value
Previous Severity	High
Aliases	CVE-2025-58183, CVE-2025-58186, CVE-2025-58187, CVE-2025-61729, CVE-2026-25679, CVE-2025-61732, CVE-2026-27142, CVE-2026-27139
Resolution	CrowdSec binaries now compiled with Go 1.26.1
Verified	None of the aliased CVEs detected in Grype scan

---

CVE-2026-27171 — zlib CPU Exhaustion (RESOLVED)

Field	Value
Previous Severity	Medium
Resolution	Alpine now ships zlib 1.3.2-r0 (fix threshold: 1.3.2)
Verified	Not detected in Grype scan; zlib 1.3.2-r0 confirmed in SBOM

---

CVE-2026-33186 — gRPC-Go Authorization Bypass (RESOLVED)

Field	Value
Previous Severity	Critical
Packages	google.golang.org/grpc v1.74.2 (CrowdSec), v1.79.1 (Caddy)
Resolution	Upstream releases now include patched gRPC (>= v1.79.3)
Verified	Not detected in Grype scan; ignore rule present but no match

---

GHSA-69x3-g4r3-p962 / CVE-2026-25793 — Nebula ECDSA Malleability (RESOLVED)

Field	Value
Previous Severity	High
Package	github.com/slackhq/nebula v1.9.7 in Caddy
Resolution	Caddy now ships with nebula >= v1.10.3
Verified	Not detected in Grype scan; Trivy image report from Feb 25 had this but current build does not

Note

: The stale Trivy image report (trivy-image-report.json, dated 2026-02-25) still shows CVE-2026-25793. This report predates the current build and should be regenerated.

---

GHSA-479m-364c-43vc — goxmldsig XML Signature Bypass (RESOLVED)

Field	Value
Previous Severity	High
Package	github.com/russellhaering/goxmldsig v1.5.0 in Caddy
Resolution	Caddy now ships with goxmldsig >= v1.6.0
Verified	Not detected in Grype scan; ignore rule present but no match

---

CodeQL Analysis

go/cookie-secure-not-set — FALSE POSITIVE

Field	Value
Severity	Medium (CodeQL)
File	backend/internal/api/handlers/auth_handler.go:152
Classification	FALSE POSITIVE (stale SARIF)

Finding: CodeQL reports "Cookie does not set Secure attribute to true" at line 152.

Verification: The setSecureCookie function at line 148-156 calls c.SetCookie() with secure: true (6th positional argument). The Secure attribute IS set correctly. This SARIF was generated from a previous code version and does not reflect the current source. The CodeQL SARIF files should be regenerated.

JavaScript / JS

No findings. Both codeql-results-javascript.sarif and codeql-results-js.sarif contain 0 results.

---

GORM Security Scanner

Metric	Value
Result	PASSED
Files	43 Go files (2,396 lines)
Critical	0
High	0
Medium	0
Info	2 (missing indexes on foreign keys in UserPermittedHost)

The 2 informational suggestions (UserID and ProxyHostID missing gorm:"index" in backend/internal/models/user.go:130-131) are performance recommendations, not security issues. They do not block this audit.

---

CI vs Local Scan Discrepancy

The CI reported 3 Critical, 5 High, 1 Medium. The local scan on the freshly built image reports 0 Critical, 0 High, 4 Medium, 2 Low (active) plus 4 High (ignored).

Root causes for the discrepancy:

1. Resolved vulnerabilities: 3 Critical and 4 High findings were resolved by Go 1.26.1 compilation and upstream Caddy/CrowdSec dependency updates since the CI image was built.
2. Grype ignore rules: The local scan applies documented risk acceptance rules that suppress 4 High findings in third-party binaries. CI (Trivy) does not use these rules.
3. Stale CI artifacts: The trivy-image-report.json dates from 2026-02-25 and does not reflect the current image state. The codeql-results-go.sarif references code that has since been fixed.

---

Recommended Actions

Immediate (This Sprint)

1. Update SECURITY.md: Move CVE-2025-68121, CHARON-2025-001, and CVE-2026-27171 to a "Patched Vulnerabilities" section. Add CVE-2025-60876 and CVE-2026-26958 as new known vulnerabilities.

2. Regenerate stale scan artifacts: Re-run Trivy image scan and CodeQL analysis to produce current SARIF/JSON files. The existing files predate fixes and produce misleading CI results.

3. Clean up Grype ignore rules: Remove ignore entries for vulnerabilities that are no longer detected (CVE-2026-33186, GHSA-69x3-g4r3-p962, GHSA-479m-364c-43vc). Stale ignore rules obscure the actual security posture.

Next Release

4. Monitor Alpine APK updates: Watch for patched busybox (CVE-2025-60876) and openssl (CVE-2026-2673) packages in Alpine 3.23.

5. Monitor CrowdSec releases: Watch for CrowdSec builds with updated filippo.io/edwards25519 >= v1.1.1, buger/jsonparser >= v1.1.2, and pgx/v5 migration (replacing pgproto3/v2).

6. Monitor Go 1.26.2-alpine: When available, bump GO_VERSION to pick up any remaining stdlib patches.

Informational (Non-Blocking)

7. GORM indexes: Consider adding gorm:"index" to UserID and ProxyHostID in UserPermittedHost for query performance.

---

Gotify Token Review

Verified: No Gotify application tokens appear in scan output, log artifacts, test results, API examples, or URL query parameters. All diagnostic output is clean.

---

Conclusion

The Charon container image security posture has materially improved. Six previously known vulnerabilities are now resolved through Go toolchain and dependency updates. The remaining active findings are medium/low severity, reside in Alpine base packages and CrowdSec third-party binaries, and have no available fixes. No vulnerabilities exist in Charon's own application code. GORM and CodeQL scans confirm the backend code is clean.