docs(security): scope zero-egress claim and add MDS072 SSRF caveat - #771
Draft
jeduden wants to merge 4 commits into
Draft
docs(security): scope zero-egress claim and add MDS072 SSRF caveat#771jeduden wants to merge 4 commits into
jeduden wants to merge 4 commits into
Conversation
Closes plan/2607242011 (security-hardening-batch-2026-07-24, S003). docs/reference/telemetry.md: qualify the "zero outbound network calls" and air-gapped CI claims to the default configuration. Add an "Opt-in network access" section naming MDS072 external-link-check as the one opt-in exception, explaining its HEAD/GET probe behaviour, and documenting the SSRF risk along with the links.external-skip mitigation. internal/rules/MDS072-external-link-check/README.md: add a Security section documenting the SSRF risk — attacker-controlled URLs from document content, redirect following, internal host reachability — and the links.external-skip mitigation. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01XBKmFebGPtNYQSFZdy9Ffb
Codecov Report✅ All modified and coverable lines are covered by tests. Additional details and impacted files
☔ View full report in Codecov by Harness. 🚀 New features to boost your workflow:
|
…SSRF list; mark plan done Round 1 review findings: - telemetry.md: qualify "mdsmith lsp ... No network" with same opt-in note as mdsmith check; qualify "never calls an external service at runtime" in the Claude Code plugin section to "in the default configuration"; qualify the "How to verify" closing claim to "In the default configuration" - MDS072 README Security section: add "link-local addresses" to the SSRF host list (was present in telemetry.md but missing here) - PLAN.md: regenerate catalog to reflect plan 2607242011 status ✅ Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01XBKmFebGPtNYQSFZdy9Ffb
Qualify "running it makes no network calls" in the install-time section to say "In the default configuration, running it makes no outbound network calls." — consistent with the runtime section wording introduced in the previous commit. Remove the [mds072-readme] reference link definition (and its two usages) that pointed to ../../internal/rules/MDS072-external-link- check/README.md. That path does not exist in the website content tree, causing MDS027 failures in the "Build and lint website content tree" CI job. The rule name is already self-documenting in context. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01XBKmFebGPtNYQSFZdy9Ffb
Two review fixes: 1. `mdsmith fix` also runs enabled rules (including MDS072 when opt-in) as part of its pre/post check pass, so the "What runs offline" bullet was wrong to say "No network from mdsmith itself" without qualification. Align it with the check and lsp bullets: "No network by default. (Same opt-in exception as mdsmith check.)" 2. The SSRF paragraph in the new MDS072 section omitted redirect- following as a threat vector. `links.external-skip` on the initial URL does not block a redirect to an internal host (Go's default http.Client follows up to 10 redirects). Add a sentence covering this so the mitigation guidance is accurate. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01XBKmFebGPtNYQSFZdy9Ffb
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Closes plan/2607242011 (security-hardening-batch-2026-07-24, finding S003 from the 2026-07-24 post-audit diff review).
MDS072
external-link-checkmakes outbound HTTP calls when enabled, butdocs/reference/telemetry.mdclaimed unconditional zero egress andmdsmith check .would run in air-gapped CI with no exceptions. This PR corrects both claims and adds SSRF documentation.docs/reference/telemetry.md:external-link-checkis the one opt-in exceptionlinks.external-skipmitigationinternal/rules/MDS072-external-link-check/README.md:## Securitysection documenting the SSRF risk (attacker-controlled URLs, redirect following to internal hosts) and thelinks.external-skipmitigationTest plan
mdsmith fixpasses on all changed docs files (0 unfixed)mdsmith check .passes on the full workspace (567 files, 0 failures)Generated by Claude Code