Add security hardening plan document - #34
Open
slamanna212 wants to merge 1 commit into
Open
Conversation
Documents an execution plan for seven security findings from a review of the app at b267cb4: 1. Xtream credentials leak into the log file and on-screen errors via unredacted mpv stderr 2. mpv's default ytdl_hook passes the credential-bearing stream URL to yt-dlp on its command line, exposing it via /proc 3. mpv_set_property/mpv_get_property forward any property name to mpv, giving webview JS an arbitrary-file-write primitive 4. The mpv IPC socket sits at a predictable path in shared /tmp, racy on multi-user machines 5. No webview navigation guard; external links are also broken today because the opener capability is scoped to last.fm only 6. CI runs unpinned actions and third-party npm lifecycle scripts on the self-hosted runner pool that holds the release signing key 7. Notification artwork fetches follow redirects to private addresses without revalidation Findings 1, 2 and 3 were reproduced against the bundled mpv rather than inferred from reading the code. Records deferred items and the current clean dependency-audit baseline. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_015cFCmHviL5A4owWLhxFRei
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Add a comprehensive security hardening plan documenting seven findings from a security review of Apogee at commit
b267cb4. This document serves as an execution roadmap for addressing credential leaks, privilege boundary violations, supply-chain risks, and other security concerns identified in the review.Changes
docs/security-hardening-plan.md— A detailed 610-line security hardening plan covering:mpv_set_property/mpv_get_propertyto prevent arbitrary file writes/tmp(medium severity) — Close race condition on multi-user systemsImplementation Details
The plan includes:
Each finding is self-contained and can be implemented independently. The document emphasizes verification at each step and includes unit-test requirements where applicable.
https://claude.ai/code/session_015cFCmHviL5A4owWLhxFRei