Repository navigation
feat!: v0.2 hardening from the security and design reviews - #5
Merged
Merged
Conversation
Limits no manifest can raise: - run.maxCallsPerSecond at most 1000 (NaN and Inf rejected), run.interval at most 24h, 10,000 calls per pass, 1,000 distinct gRPC targets. - Manifests over 16 MiB are an error (stdin and files), never truncated. - Identical calls are made once; duplicates are listed as refused. - -max-in-flight (default 64): a call beyond the cap is skipped and reported, never queued and never counted as unanswered. Input hardening: - Route paths with dot segments, //, percent-encoding, ?, #, backslash, spaces or control characters are rejected. - baseURL with credentials or a query string is rejected; the error never echoes the credentials. - gRPC targets must be host:port (no resolver schemes). - Deny rules fail closed on a bad glob. Egress guard: connections to link-local and cloud metadata addresses are refused after DNS resolution, for HTTP and gRPC; -allow-link-local overrides. Results: - 401 and 403 count as answered and are flagged needsAuth. - detail is truncated to 512 bytes. - -once exits 3 when interrupted; pass lines carry skipped and interrupted. - -once paces at the rate limit with jitter; -spread spreads a single pass across the interval. - -insecure with headers is refused unless the endpoint is loopback (-allow-insecure-headers overrides). - Defense in depth: the prober refuses any method but GET and HEAD. BREAKING CHANGE: manifests that previously parsed may now be rejected (credentials or a query in baseURL, unsafe route paths, gRPC targets that are not host:port, rates above 1000, intervals above 24h); a 401 or 403 now counts as answered; an interrupted -once exits 3, not 0. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
TestUnauthorizedAndForbiddenAreAnsweredAndNeedAuth failed once at 1.06s against a 1s call budget when every package ran in parallel on Windows and a first local connection was slow; it passes in under 10ms alone. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
ETWOYA
approved these changes
Oct 11, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
v0.2: the fixes from the security code review and the design review (SYN-SP-001). No new features.
Limits no manifest can raise
run.maxCallsPerSecondat most 1000 (NaN and Inf rejected),run.intervalat most 24h, 10,000 calls per pass, 1,000 distinct gRPC targets-max-in-flight(default 64): a call beyond the cap is skipped and reported, never queued and never counted as unansweredInput hardening
../.segments,//, percent-encoding,?,#, backslash, spaces or control characters are rejected (they could evade deny rules)baseURLwith credentials or a query string is rejected; the error never echoes the credentialshost:port(nounix:ordns://resolver schemes)Egress guard: link-local and cloud metadata addresses are refused after DNS resolution, for HTTP and gRPC;
-allow-link-localoverrides. The test never dials a metadata address (GitHub runners have a live one).Results and exit codes
needsAuth(founder ruling 2026-10-08)detailtruncated to 512 bytes; call lines gainneedsAuth,skipped; pass lines gainskipped,interrupted-onceexits 3 when interrupted (previously could exit 0)-oncepaces with jitter;-spreadspreads a single pass across the interval (the mode the worker will use)-insecurewith headers is refused unless the endpoint is loopback (-allow-insecure-headersoverrides)Docs: README and DOCKERHUB.md updated for every behaviour change; the README results sample is regenerated from this build. The Docker Hub Overview needs re-pasting after merge.
BREAKING: manifests that parsed before can now be rejected (see input hardening); a 401/403 now counts as answered; an interrupted
-onceexits 3.Tests: new tests for every behaviour above; full suite green 3 runs in a row locally (Windows), runner coverage 84% to 92%. The second commit widens three probe-test timeouts after one parallel-suite flake (1.06s against a 1s budget).
🤖 Generated with Claude Code