Security and technical risk register
Remediation execution
Section titled “Remediation execution”The complete remediation plan is the canonical execution and evidence plan for every finding below except SEC-01 and POT-01. Those two findings remain open but are deliberately outside that plan by user direction; the exclusion is neither remediation nor risk acceptance.
Confirmed risks
Section titled “Confirmed risks”The proposed open-source release plan tracks SEC-01/POT-01 in OSS1 as a separate publication prerequisite. It does not change their state, authorize rotation/history rewriting by itself, or remove the explicit exclusion from the historical remediation plan.1
| ID | Severity | State | Risk | Required outcome |
|---|---|---|---|---|
| SEC-01 | Critical | Open | Credentials committed in .env.example |
Rotate, replace, scan and clean history after rotation |
| SEC-02 | Critical | Implemented; local evidence | Cross-tenant analytics and screenshot exposure | Independent review and canary required for closure |
| SEC-03 | Critical | Implemented; local evidence | OAuth login CSRF/token theft and deep-link token injection | Live proxy/multi-replica exercise required for closure |
| SEC-04 | Critical | Implemented; local evidence | Stale memberships and indefinitely renewable admin claims | Revocation canary required for closure |
| SEC-05 | High | Implemented; local evidence | Inconsistent resource authorization | Independent route-matrix review required for closure |
| REL-01 | High | Implemented; local evidence | OAuth state lost/split across replicas | Live cross-pod exercise required for closure |
| REL-02 | High | Implemented; local evidence | Import work lost on restart | Production worker-kill exercise required for closure |
| REL-03 | High | Implemented; local evidence | Plaintext and non-idempotent desktop retry queue | Signed desktop platform smoke required for closure |
| REL-04 | High | Implemented | Buffered desktop update can OOM backend | Constrained-pod maximum-artifact test required for verification |
| DATA-01 | High | Implemented; local evidence | Multiple concurrent running timers | Independent review required for closure |
| DEP-01 | High | Implemented; locally verified | Vulnerable runtime/toolchain dependencies | Protected-branch audit gate must run remotely |
| QA-01 | High | Implemented; locally verified | No tests and incomplete CI gates | Protected-branch and release workflow evidence required |
Conditional risks
Section titled “Conditional risks”| ID | Potential severity | Validation needed |
|---|---|---|
| POT-01 | High | Determine whether previously committed credentials remain valid or privileged |
| POT-02 | High | Validate import OAuth redirect reconstruction behind the real ingress/proxy |
| POT-03 | Medium/High | Confirm legal/privacy retention and AI-provider processing policy |
| POT-04 | Medium | Assess admin CSP/security headers and XSS exposure |
| POT-05 | Medium | Exercise Tauri webview navigation, monstaff:// deep-link and core loopback-protocol attack paths |
| POT-06 | Low/Medium | Verify BigInt serialization behavior at values above JavaScript safe integer |
2026-08-29 evidence note
Section titled “2026-08-29 evidence note”The in-scope rows above moved from Open to Implemented because repository controls and local regression evidence now exist.2 None is marked closed: the plan deliberately requires independent review, rollout or operational evidence that this local task cannot self-certify. SEC-01 and POT-01 are unchanged and remain outside the remediation implementation boundary.
Update rule
Section titled “Update rule”Risk state changes require evidence in the body or linked plan. Do not mark an item closed because code was merely proposed. Completed mitigations remain visible with date, commit and residual risk.