Charon/docs/reports/qa_report_pr754.md

# QA Report — PR #754: Enable and Test Gotify and Custom Webhook Notifications

**Branch:** `feature/beta-release`
**Date:** 2026-02-25
**Auditor:** QA Security Agent

---

## Summary

| # | Check | Result | Details |
|---|-------|--------|---------|
| 1 | Local Patch Coverage Preflight | **WARN** | 79.5% overall (threshold 90%), 78.3% backend (threshold 85%) — advisory only |
| 2 | Backend Coverage ≥ 85% | **PASS** | 87.0% statement / 87.3% line (threshold 87%) |
| 3 | Frontend Coverage ≥ 85% | **PASS** | 88.21% statement / 88.97% line (threshold 85%) |
| 4 | TypeScript Type Check | **PASS** | Zero errors |
| 5 | Pre-commit Hooks | **PASS** | All 15 hooks passed |
| 6a | Trivy Filesystem Scan | **PASS** | 0 CRITICAL/HIGH in project code (findings only in Go module cache) |
| 6b | Docker Image Scan | **WARN** | 1 HIGH in Caddy transitive dep (CVE-2026-25793, nebula v1.9.7 → fixed 1.10.3) |
| 6c | CodeQL (Go + JavaScript) | **PASS** | 0 errors, 0 warnings across both languages |
| 7 | GORM Security Scan | **PASS** | 0 CRITICAL/HIGH (2 INFO suggestions: missing indexes on UserPermittedHost) |
| 8 | Go Vulnerability Check | **PASS** | No vulnerabilities found |

---

## Detailed Findings

### 1. Local Patch Coverage Preflight

- **Status:** WARN (advisory, not blocking per policy)
- Overall patch coverage: **79.5%** (threshold: 90%)
- Backend patch coverage: **78.3%** (threshold: 85%)
- Artifacts generated but `test-results/` directory was not persisted at repo root
- **Action:** Consider adding targeted tests for uncovered changed lines in notification service/handler

### 2. Backend Unit Test Coverage

- **Status:** PASS
- Statement coverage: **87.0%**
- Line coverage: **87.3%**
- All tests passed (0 failures)

### 3. Frontend Unit Test Coverage

- **Status:** PASS
- Statement coverage: **88.21%**
- Branch coverage: **80.58%**
- Function coverage: **85.20%**
- Line coverage: **88.97%**
- All tests passed (0 failures)
- Coverage files generated: `lcov.info`, `coverage-summary.json`, `coverage-final.json`

### 4. TypeScript Type Check

- **Status:** PASS
- `tsc --noEmit` completed with zero errors

### 5. Pre-commit Hooks

- **Status:** PASS
- All hooks passed:
  - fix end of files
  - trim trailing whitespace
  - check yaml
  - check for added large files
  - shellcheck
  - actionlint (GitHub Actions)
  - dockerfile validation
  - Go Vet
  - golangci-lint (Fast Linters - BLOCKING)
  - Check .version matches latest Git tag
  - Prevent large files not tracked by LFS
  - Prevent committing CodeQL DB artifacts
  - Prevent committing data/backups files
  - Frontend TypeScript Check
  - Frontend Lint (Fix)

### 6a. Trivy Filesystem Scan

- **Status:** PASS
- Scanned `backend/` and `frontend/` directories: **0 CRITICAL, 0 HIGH**
- Full workspace scan found 3 CRITICAL + 14 HIGH across Go module cache dependencies (not project code)
- Trivy misconfig scanner crashed (known Trivy bug in ansible parser — nil pointer dereference in `discovery.go:82`). Vuln scanner completed successfully.

### 6b. Docker Image Scan

- **Status:** WARN (not blocking — upstream dependency)
- Image: `charon:local`
- **1 HIGH finding:**
  - **CVE-2026-25793** — `github.com/slackhq/nebula` v1.9.7 (in `usr/bin/caddy` binary)
  - Description: Blocklist evasion via ECDSA Signature Malleability
  - Fixed in: v1.10.3
  - Impact: Caddy transitive dependency, not Charon code
- **Remediation:** Upgrade Caddy to a version that pulls nebula ≥ 1.10.3 when available

### 6c. CodeQL Scans

- **Status:** PASS
- **Go:** 0 errors, 0 warnings
- **JavaScript:** 0 errors, 0 warnings (347/347 files scanned)
- SARIF outputs: `codeql-results-go.sarif`, `codeql-results-javascript.sarif`

### 7. GORM Security Scan

- **Status:** PASS
- Scanned: 41 Go files (2207 lines), 2 seconds
- **0 CRITICAL, 0 HIGH, 0 MEDIUM**
- 2 INFO suggestions:
  - `backend/internal/models/user.go:109` — `UserPermittedHost.UserID` missing index
  - `backend/internal/models/user.go:110` — `UserPermittedHost.ProxyHostID` missing index

### 8. Go Vulnerability Check

- **Status:** PASS
- `govulncheck ./...` — No vulnerabilities found

---

## Gotify Token Security Review

- No Gotify tokens found in logs, test artifacts, or API examples
- No tokenized URL query parameters exposed in diagnostics or output
- Token handling follows `json:"-"` pattern (verified via `HasToken` computed field approach in PR)

---

## Recommendation

### GO / NO-GO: **GO** (conditional)

All blocking gates pass. Two advisory warnings exist:

1. **Patch coverage** (79.5% overall, 78.3% backend) is below advisory thresholds but not a blocking gate per current policy
2. **Docker image** has 1 HIGH CVE in Caddy's transitive dependency (nebula) — upstream fix required, not actionable in Charon code

**Conditions:**
- Track nebula CVE-2026-25793 remediation as a follow-up issue when a Caddy update incorporates the fix
- Consider adding targeted tests for uncovered changed lines in notification service/handler to improve patch coverage