|
| 1 | +# Pre-Public Audit (Phase 3.1) |
| 2 | + |
| 3 | +**Date:** 2026-05-18 |
| 4 | +**Commit at audit time:** `f9ba6c6` (HEAD of `main`) |
| 5 | +**Tracked files swept:** 564 (`git ls-files | wc -l`) |
| 6 | +**Audit role:** Phase 3.1 of [`docs/PUBLIC_RELEASE_PLAN.md`](PUBLIC_RELEASE_PLAN.md) — read every file from an outsider's perspective; flag anything sensitive or unprofessional before the Phase 3.4 public flip. |
| 7 | + |
| 8 | +This document is the durable record of the sweep. Phase 3.4 (private→public) |
| 9 | +must not flip until every CRITICAL/HIGH finding here is **Resolved**. |
| 10 | + |
| 11 | +--- |
| 12 | + |
| 13 | +## Methodology |
| 14 | + |
| 15 | +For each file class I asked: *would a hostile outsider (competitor, |
| 16 | +adversary, journalist, future legal review) find anything here |
| 17 | +embarrassing, sensitive, contradictory, or unprofessional?* |
| 18 | + |
| 19 | +Concrete checks performed: |
| 20 | + |
| 21 | +1. **PII / personal content** — `git ls-files` enumerated against |
| 22 | + keywords `point72|firecrawl|hedge|career|resume|cv|personal|todo|notes`; |
| 23 | + gmail/yahoo/outlook/protonmail/icloud regex over all tracked |
| 24 | + markdown/code/config files (excluding `.venv-appinspect/` which is |
| 25 | + gitignored). |
| 26 | +2. **Credentials** — grep for hardcoded passwords beyond the documented |
| 27 | + `Chang3d!` dev-container default (which is allowlisted in |
| 28 | + [`.gitleaks.toml`](../.gitleaks.toml)). |
| 29 | +3. **Internal infrastructure** — RFC1918 IP regex over tracked source |
| 30 | + and docs (excluding test fixtures, sample CSVs, demo seed data, and |
| 31 | + API documentation example payloads). |
| 32 | +4. **Code red flags** — `TODO|FIXME|XXX|HACK` in `bin/`, `appserver/static/`. |
| 33 | +5. **Debug statements** — `console.log|console.debug|debugger;` in |
| 34 | + tracked source. |
| 35 | +6. **License consistency** — every `LICENSE`/`MIT`/`Apache` mention |
| 36 | + across `README.md`, `docs/index.md`, `mkdocs.yml`, `app.manifest`, |
| 37 | + `sbom.cdx.json`, `NOTICE`, and `CONTRIBUTING.md`. |
| 38 | +7. **Identity consistency** — `wildleo91` / `communicate.oleh@gmail.com` |
| 39 | + / `Security Engineering` mentions checked against D5 + D15 + |
| 40 | + D17 locked decisions. |
| 41 | +8. **Top-level inventory** — every file/dir at repo root reviewed. |
| 42 | + |
| 43 | +--- |
| 44 | + |
| 45 | +## Findings |
| 46 | + |
| 47 | +### CRITICAL — fixed in-turn |
| 48 | + |
| 49 | +**F-C1: `.firecrawl/point72-*.md` (3 files) — personal job-search research tracked in repo.** |
| 50 | + |
| 51 | +Files: |
| 52 | + |
| 53 | +- `.firecrawl/point72-about.md` (404-page scrape, 121 B) |
| 54 | +- `.firecrawl/point72-home.md` (Point72 home-page scrape, 6.2 KB) |
| 55 | +- `.firecrawl/point72-splunk-security-engineer.md` (Point72 job posting, 5.2 KB) |
| 56 | + |
| 57 | +These are page-scrape artifacts from a research session unrelated to |
| 58 | +wl_manager (likely employer-research). On Phase 3.4 public flip they |
| 59 | +would be visible to anyone with the repo URL. Phase 0.10 secret-scan |
| 60 | +did not flag them because they contain no credentials, but the |
| 61 | +outsider-perspective lens immediately surfaces them. |
| 62 | + |
| 63 | +**Resolution:** removed in commit landing this audit. Also added |
| 64 | +`.firecrawl/` to `.gitignore` so the directory cannot be re-tracked |
| 65 | +by accident. |
| 66 | + |
| 67 | +**Residual risk:** files remain in `git log`/blame history. If the |
| 68 | +user wants them removed from history entirely before the public flip, |
| 69 | +that requires either: |
| 70 | +(a) a `git filter-repo` history rewrite — invalidates any existing |
| 71 | +clones / forks. Acceptable here because the repo is still private and |
| 72 | +has no external collaborators. |
| 73 | +(b) accept the history retains them — they are findable by anyone who |
| 74 | +clones and runs `git log -p`. For 3 page-scrape files of public |
| 75 | +content, the practical privacy cost is low (the content was already |
| 76 | +public on point72.com; the only signal is "the maintainer once |
| 77 | +researched this employer"). |
| 78 | + |
| 79 | +**Decision needed from user before Phase 3.4** — see |
| 80 | +"Open Questions" below. |
| 81 | + |
| 82 | +--- |
| 83 | + |
| 84 | +### HIGH — fixed in-turn |
| 85 | + |
| 86 | +**F-H1: License inconsistency — LICENSE/NOTICE say Apache 2.0; README, mkdocs.yml, docs/index.md, app.manifest, sbom.cdx.json claimed MIT.** |
| 87 | + |
| 88 | +Phase 0.6 (2026-05-15, commit `e55e9ab`) deliberately switched the |
| 89 | +project license from MIT to Apache 2.0 per locked decision D1 |
| 90 | +(rationale: explicit patent grant matters for a security tool; |
| 91 | +matches `splunk/*` official repos; enterprise procurement allow-lists |
| 92 | +Apache more often than MIT). The `LICENSE` and `NOTICE` files were |
| 93 | +updated to Apache 2.0 text. Five downstream sites were missed: |
| 94 | + |
| 95 | +| File | Old claim | New value | |
| 96 | +|------|-----------|-----------| |
| 97 | +| `README.md` (badge) | `License-MIT` | `License-Apache_2.0` | |
| 98 | +| `README.md` (License section) | "MIT License" | "Apache License 2.0" + NOTICE pointer | |
| 99 | +| `docs/index.md` (License section) | "MIT — see LICENSE" | "Apache License 2.0 — see LICENSE and NOTICE" | |
| 100 | +| `mkdocs.yml` (copyright) | "released under the MIT License" | "released under the Apache License, Version 2.0" | |
| 101 | +| `app.manifest` (`license.name`) | `"MIT"` | `"Apache-2.0"` | |
| 102 | +| `sbom.cdx.json` (`licenses.id`) | `MIT` | `Apache-2.0` | |
| 103 | +| `sbom.cdx.json` (`publisher`) | `"Security Engineering"` (placeholder) | `"Oleh Bezsonov"` (per D5) | |
| 104 | + |
| 105 | +Two intentional MIT mentions are preserved (correctly): |
| 106 | + |
| 107 | +- `NOTICE` lines 31–32 — jQuery and Bootstrap are MIT-licensed third |
| 108 | + parties, bundled with Splunk Enterprise, consumed via the runtime |
| 109 | + platform; not the wl_manager project license. |
| 110 | +- `docs/PUBLIC_RELEASE_PLAN.md` lines 28 and 77 — historical record of |
| 111 | + the D1 locked decision and the Phase 0.6 closure. Must not be |
| 112 | + edited (it's the audit trail of the switch). |
| 113 | + |
| 114 | +**Why this would have been a real problem in public:** a user reading |
| 115 | +the MIT badge in the README might rely on MIT's terms (no explicit |
| 116 | +patent grant, simpler attribution requirements). Apache 2.0 actually |
| 117 | +applies. Court precedent on "which license controls when files |
| 118 | +disagree" is inconsistent — the conservative reading is that the |
| 119 | +LICENSE file controls, but having the README contradict it is the |
| 120 | +kind of fact pattern that produces avoidable legal ambiguity. |
| 121 | + |
| 122 | +**Resolution:** all 6 sites updated to Apache-2.0 in this audit's |
| 123 | +commit. |
| 124 | + |
| 125 | +--- |
| 126 | + |
| 127 | +### LOW — fixed in-turn |
| 128 | + |
| 129 | +**F-L1: `test_py.py` at repo root — 1-line `print(123)` dev cruft.** |
| 130 | + |
| 131 | +A single-file Python script (`print(123)`, 11 bytes) was tracked at |
| 132 | +the repo root. Origin unclear; presumably a dev sanity-check from an |
| 133 | +early session. Adds nothing; confuses an outsider reading the tree |
| 134 | +("what is this script for?"). |
| 135 | + |
| 136 | +**Resolution:** removed in this audit's commit. |
| 137 | + |
| 138 | +--- |
| 139 | + |
| 140 | +### LOW — flagged for user decision (not auto-fixed) |
| 141 | + |
| 142 | +**F-L2: `docs/superpowers/` — internal planning docs visible to outsiders.** |
| 143 | + |
| 144 | +Two markdown files under `docs/superpowers/{plans,specs}/` document |
| 145 | +the Wave-3 entry-point-rewrite plan written for an "agentic worker" |
| 146 | +audience, with references to internal tooling (`superpowers:subagent-driven-development`, |
| 147 | +`superpowers:executing-plans`) and per-step checkboxes for an |
| 148 | +implementing agent. The content is not embarrassing, but the *framing* |
| 149 | +(internal-tooling jargon, agentic-worker reader assumption) is |
| 150 | +confusing for a human contributor reading the repo for the first time. |
| 151 | + |
| 152 | +`mkdocs.yml` already excludes `superpowers/plans/*.md` and |
| 153 | +`superpowers/specs/*.md` from the MkDocs site nav, so they don't |
| 154 | +appear on the hosted docs. But they remain visible via GitHub's |
| 155 | +file-tree browse after the public flip. |
| 156 | + |
| 157 | +**Options:** |
| 158 | + |
| 159 | +a. **Leave as-is** — transparency about development methodology; |
| 160 | + contributors who care can read them. |
| 161 | +b. **Move to `.planning/superpowers/`** — colocates with other |
| 162 | + internal-planning artifacts that are still tracked but |
| 163 | + contextualized as planning history. |
| 164 | +c. **Remove entirely** — they served their purpose; the Wave-3 |
| 165 | + refactor is shipped and documented in CHANGELOG. |
| 166 | + |
| 167 | +Recommendation: (b) — preserves the planning history (which is |
| 168 | +genuinely valuable as an example of how the codebase was modularized) |
| 169 | +while making clear that it's internal-process material, not |
| 170 | +end-user documentation. |
| 171 | + |
| 172 | +**Needs user decision before Phase 3.4.** |
| 173 | + |
| 174 | +**F-L3: `.mcp.json.example` contains Windows-specific paths.** |
| 175 | + |
| 176 | +The committed example points at `C:\Users\PC\AppData\Local\Microsoft\WindowsApps\python.exe` |
| 177 | +and `C:/Users/PC/wl_manager` as MCP server paths. A Mac or Linux |
| 178 | +contributor copying this to `.mcp.json` will need to substitute |
| 179 | +those manually. |
| 180 | + |
| 181 | +**Options:** |
| 182 | + |
| 183 | +a. **Leave as-is** — comments explain the substitution; not |
| 184 | + load-bearing for public release. |
| 185 | +b. **Genericize to `<path-to-python>` / `<path-to-repo>` placeholders** |
| 186 | + — slightly cleaner onboarding, more contributor-friendly. |
| 187 | + |
| 188 | +Recommendation: (b), but **NOT** blocking Phase 3.4 — the comments |
| 189 | +in the file already explain that contributors must substitute their |
| 190 | +own paths. Park as a v1.1 polish item. |
| 191 | + |
| 192 | +--- |
| 193 | + |
| 194 | +## Items checked and PASSED (no finding) |
| 195 | + |
| 196 | +### Personal identity |
| 197 | + |
| 198 | +- `communicate.oleh@gmail.com` appears in `docs/DECISION_LOG.md`, |
| 199 | + `docs/PUBLIC_RELEASE_PLAN.md`, `docs/RUNBOOKS.md` — intentional per |
| 200 | + locked decision D15 (Splunkbase publisher email is publicly visible |
| 201 | + on every Splunkbase listing; trade-off accepted). |
| 202 | +- `wildleo91@gmail.com` appears only in `docs/PUBLIC_RELEASE_PLAN.md` |
| 203 | + D17 historical entry documenting the identity switch away from this |
| 204 | + handle — no current attribution. Acceptable. |
| 205 | +- All committer emails on commits since D17 (2026-05-17) map to |
| 206 | + `20013626+RelativisticJet@users.noreply.github.com` — GitHub's |
| 207 | + noreply alias, which is correct for a public repo. |
| 208 | + |
| 209 | +### Credentials |
| 210 | + |
| 211 | +- `Chang3d!` is the documented Splunk dev-container default, allowlisted |
| 212 | + in `.gitleaks.toml` line 33. No other hardcoded passwords found in |
| 213 | + `bin/`, `appserver/static/`, `tests/`, `scripts/`. |
| 214 | + |
| 215 | +### Network references |
| 216 | + |
| 217 | +- All RFC1918 IPs (`10.x.x.x`, `172.16-31.x.x`, `192.168.x.x`) trace |
| 218 | + to demo seed data (`demo/demo.sh`), example API payloads |
| 219 | + (`docs/api/README.md`, `docs/api/openapi.yaml`), or sample whitelist |
| 220 | + CSVs (`lookups/DR*.csv`). No real internal infrastructure |
| 221 | + referenced. |
| 222 | +- Hostnames like `dmz.local`, `prod.internal` appear in sample CSVs |
| 223 | + only — clearly synthetic. |
| 224 | + |
| 225 | +### Code hygiene |
| 226 | + |
| 227 | +- Zero `TODO|FIXME|XXX|HACK` markers in production code under `bin/` |
| 228 | + and `appserver/static/`. (CLAUDE.md global instruction "Default to |
| 229 | + writing no comments" is respected throughout.) |
| 230 | +- Only `console.log` mention in production XML is `default/data/ui/views/test_runner.xml` |
| 231 | + — a hidden QUnit test-runner dashboard explicitly marked "Not |
| 232 | + visible in UI." Acceptable. |
| 233 | + |
| 234 | +### Required files |
| 235 | + |
| 236 | +- `LICENSE` — Apache 2.0 boilerplate from apache.org, with "How to |
| 237 | + apply" appendix carrying `Copyright 2026 Oleh Bezsonov` (matches D5). |
| 238 | +- `NOTICE` — present, Apache 2.0 conventions, Splunk trademark |
| 239 | + disclaimer, third-party content statement. |
| 240 | +- `README.md` — present, screenshots embedded, badges, docs callout |
| 241 | + (post-2.10). |
| 242 | +- `CONTRIBUTING.md` — present, response-SLA section (post-2.4), |
| 243 | + security-CI section, full PR/issue workflow. |
| 244 | +- `CODE_OF_CONDUCT.md` — present (Contributor Covenant per locked |
| 245 | + decision 2.5). |
| 246 | +- `SECURITY.md` — present, "Coordinated Disclosure Timeline" section |
| 247 | + per locked decision D16. |
| 248 | +- `CHANGELOG.md` — present, Keep-a-Changelog format, status header |
| 249 | + records security-hardening-track closure. |
| 250 | +- `docs/screenshots/` — 4 PNG screenshots referenced from |
| 251 | + `README.md` and `docs/Whitelist_Manager_Documentation.md`; all |
| 252 | + present. |
| 253 | + |
| 254 | +### CI workflows |
| 255 | + |
| 256 | +- All 11 workflows (`appinspect`, `appinspect-api`, `ci`, `codeql`, |
| 257 | + `docs`, `e2e-full`, `e2e-smoke`, `integration-tests`, `pip-audit`, |
| 258 | + `release`, `scorecard`, `secret-scan`, `semgrep`, |
| 259 | + `validate-and-package`, `a11y-audit`) reviewed for sensitive |
| 260 | + hardcoded values. CodeQL, Scorecard, and Docs all carry the |
| 261 | + `github.event.repository.private == false` guard for the deploy |
| 262 | + steps — they will activate at Phase 3.4 flip. |
| 263 | + |
| 264 | +### `.planning/` directory |
| 265 | + |
| 266 | +The `.planning/` directory (40+ tracked files) is intentionally |
| 267 | +public-facing per the project convention. Reviewed: contains |
| 268 | +roadmaps, requirements, project-state, AppInspect run records, and |
| 269 | +phase-by-phase planning artifacts. No PII or sensitive content |
| 270 | +beyond the intentional D15 publisher email. |
| 271 | + |
| 272 | +--- |
| 273 | + |
| 274 | +## Open questions for user |
| 275 | + |
| 276 | +These three items need a decision before Phase 3.4 (`repo private → |
| 277 | +public`) can fire. None block the **Phase 3.2** release-tag cut |
| 278 | +itself — they can be addressed during the Phase 3.3 verification or |
| 279 | +right before 3.4. |
| 280 | + |
| 281 | +1. **`.firecrawl/point72-*.md` git history retention** (from F-C1). |
| 282 | + The files are removed from the working tree and gitignored, but |
| 283 | + they still exist in `git log -p` history. Three options: |
| 284 | + - **(a)** Accept — repo is still private, no external clones exist |
| 285 | + yet, the page content was already public on point72.com so the |
| 286 | + practical privacy cost is low. Phase 3.4 ships with the history |
| 287 | + intact. |
| 288 | + - **(b)** History rewrite via `git filter-repo` before Phase 3.4 |
| 289 | + — produces a clean history but invalidates any existing |
| 290 | + clones/forks (currently zero, so cost is trivial). |
| 291 | + - **(c)** Same as (b) but coordinated with a force-push to GitHub |
| 292 | + after Phase 3.4 — more risky, redundant. |
| 293 | + Recommendation: **(a)** unless the user has a specific reason to |
| 294 | + sanitize the history (e.g., the page scrapes contain anything |
| 295 | + they'd rather not be tied to publicly). |
| 296 | + |
| 297 | +2. **`docs/superpowers/` disposition** (from F-L2). Leave, move to |
| 298 | + `.planning/`, or remove? |
| 299 | + |
| 300 | +3. **`.mcp.json.example` Windows path genericization** (from F-L3). |
| 301 | + Fix now or defer to v1.1? |
| 302 | + |
| 303 | +--- |
| 304 | + |
| 305 | +## Revision log |
| 306 | + |
| 307 | +| Date | Auditor | Notes | |
| 308 | +|------|---------|-------| |
| 309 | +| 2026-05-18 | claude-opus-4-7 (Phase 3.1) | Initial audit. 1 CRITICAL + 1 HIGH fixed in-turn; 1 LOW fixed in-turn; 2 LOW + 1 git-history question surfaced for user decision. | |
0 commit comments