oceans2alaska
610a3bb447
- Add privacy projection (core/privacy.py), private report storage, bounded
process capture; omit identities, free text and unapproved paths
- Mask remote peer IPs: only loopback/host/wildcard stay numeric, others are
reduced to remote_scope private/public (schema + scoring updated)
- Map ss TCP states to canonical names; ASCII-only numeric fields; fix
"Microsoft Visual C++" product matching (Python and PowerShell)
- Merge 7fed3b9: -Diagnostic switch, serialization exit code 3, PS7 module
path, UI error detail; keep hardened task/certificate collectors
- Add audit docs, privacy docs and regression tests
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
4.7 KiB
Security remediation status — 2026-10-30
This is an implementation follow-up to the unchanged historical audit/ documents.
It is not a new comprehensive audit, vulnerability scan or production approval.
| Audit finding | Implemented change | Remaining acceptance requirement |
|---|---|---|
| S01 — PHI-capable free text | Explicit projection, opaque labels/canonical products, exact reviewed allowlists before UI/history/export; stale findings discarded | CHS approves retained fields/roots/IPs; metadata can enter source/import memory; no PHI-free assurance |
| S02 — Broad provider objects | No default certificates/open files; task fields narrowed; service account/descriptions and disk labels no longer requested | Windows CIM/provider behavior and permissions must be lab-tested; provider internals not established |
| S03 — Raw retention | No raw sidecar; JSON minimized; bounded session history and clear action | Review legacy artifacts, retention/deletion, memory dumps, encrypted storage and endpoint backups |
| S04 — Output boundaries | Configured private local root, no overwrite, mode 0700/0600, Windows DACL gate, remote/link rejection | Windows ACL/race tests; CHS-approved root/backup/sync policy; unusual backing storage remains unverified |
| S05 — Temporary stdout | Bounded in-memory pipe, sanitized failure codes, discard stderr, terminate/reap owned process | OS swap/dumps/cache/log policy and native-child behavior review; memory is not secure-erased |
| S06 — Environment/registry | Small child environment allowlist; registry DoNotExpandEnvironmentNames; no stored credentials | Trusted interpreter/runtime deployment, inherited indispensable environment and native module behavior review |
| S07 — Supply chain | Minimal Qt Essentials; direct version pins and observed transitive constraints | Hash/platform locks, complete native SBOM, authorized advisory scan and signed reproducible release still outstanding |
| S08 — Contracts | Closed nested schema, bounded rows/strings/depth, independent timestamp validation, repeated export projection | Fuzzing/resource stress and untrusted file race review; legacy input still read before reduction |
| S09 — Egress | No first-party upload added; reject common remote import/output paths before filesystem probes | Monitored Windows/native egress tests, enterprise firewall and approved storage controls |
| S10 — Read-only/least privilege | Collection remains read/query operations; no elevation/remoting/configuration added; output writes isolated | Native read side effects, standard-user filtering, each supported Server OS, CHS least-privilege approval |
Test evidence
QT_QPA_PLATFORM=offscreen .venv/bin/python -m unittest discover -s tests -v
discovered 71 tests on the Linux development host: 70 passed and one native
PowerShell test was skipped. Python, synthetic regression, GUI and report tests
passed. Native PowerShell AST/mocked collector tests are skipped because no PowerShell
runtime exists here. No real Windows collection, installation/update, vulnerability
lookup, production access or network transmission was performed.
New regression cases verify canary removal across major free-text surfaces and old findings, schema/marker bypass rejection, exact-root approval excluding descendants, private/exclusive output, memory capture limits and cleanup, and bounded/cleared UI history. Seven workload scenarios retain scores 0/0/70/70/95/80/0 after projection. The 80-point file-server case uses imported synthetic historical aggregates; the new live default collector does not query SMB open-file activity and cannot create that evidence itself.
Release gates
- Review the actual release provenance. The workspace has no usable
.gitcheckout; the historical bundle is not updated by these source edits. Earlier upstream7fed3b9cannot be verified as included without an authorized source reconciliation. - Obtain native Windows lab results, including revised task-CIM queries, registry read-only behavior, service/role projection, cancellation and output permissions.
- Build clean target environments with verified dependencies, hash locks, native SBOM, advisory results and release signing. Existing broad Qt installations are not changed by editing requirements.
- CHS security/privacy owners approve the reduced dataset and document residual PHI possibilities, dedicated least-privilege access, encryption/storage, egress, retention, audit logging and incident response. HIPAA status is an organizational determination, not an application-generated pass/fail badge.
No source fix alone clears these gates. See the deployment guide for exact configuration, manual output-folder provisioning and authorized lab checks.