Follow-up from the review of #7. Spec-affecting: needs an OpenSpec change with a delta on gh-auth-proxy → Request filtering policy, plus README edits.
1. Document the blind spots (most important)
The docs describe the policy layer without stating its structural limits, so a reader can over-trust it. Caddy matchers are method+path only, therefore the policy cannot see:
- GraphQL mutations — everything is
POST /graphql; reads and writes are indistinguishable by path.
- git write operations —
push/force-push traverse github.com as git-receive-pack POSTs, not matchable REST paths.
- request bodies — no body inspection at all.
2. Extend the default-deny set
Today the only default rule is DELETE /repos/{owner}/{repo}. Higher-value assume-breach targets are open, notably persistence endpoints that survive token revocation:
POST /user/keys (attacker adds their own SSH key)POST /user/gpg_keysPOST /repos/{owner}/{repo}/keys (deploy keys)
3. Expand the compromise checklist
The threat-model IR guidance says to review what the session did, but doesn't enumerate a persistence hunt. Add: check for added SSH/GPG/deploy keys, new OAuth grants, and .github/workflows/* diffs.
Minor
A user-supplied CLAUDE_DOCKER_GH_POLICY snippet is imported inside the token-bearing api.github.com site block, so it could reference {env.GH_PROXY_BEARER}. No boundary is crossed (it's the user's own file, and they already hold the token on the host), but it deserves a one-line doc note.
Follow-up from the review of #7. Spec-affecting: needs an OpenSpec change with a delta on
gh-auth-proxy→ Request filtering policy, plus README edits.1. Document the blind spots (most important)
The docs describe the policy layer without stating its structural limits, so a reader can over-trust it. Caddy matchers are method+path only, therefore the policy cannot see:
POST /graphql; reads and writes are indistinguishable by path.push/force-push traversegithub.comasgit-receive-packPOSTs, not matchable REST paths.2. Extend the default-deny set
Today the only default rule is
DELETE /repos/{owner}/{repo}. Higher-value assume-breach targets are open, notably persistence endpoints that survive token revocation:POST /user/keys(attacker adds their own SSH key)POST /user/gpg_keysPOST /repos/{owner}/{repo}/keys(deploy keys)3. Expand the compromise checklist
The threat-model IR guidance says to review what the session did, but doesn't enumerate a persistence hunt. Add: check for added SSH/GPG/deploy keys, new OAuth grants, and
.github/workflows/*diffs.Minor
A user-supplied
CLAUDE_DOCKER_GH_POLICYsnippet is imported inside the token-bearingapi.github.comsite block, so it could reference{env.GH_PROXY_BEARER}. No boundary is crossed (it's the user's own file, and they already hold the token on the host), but it deserves a one-line doc note.