[Security Review] Daily Security Review — 2026-06-05

[github-actions[bot]]

Context

• Date: 2026-06-05 | Reviewer: Copilot Security Agent (claude-sonnet-4.6)
• Escape test: "Secret Digger (Copilot)" run 24273493151 concluded success with a noop — agent ran fully but found no secrets to exfiltrate. Credential isolation held. ✅

---

📊 Executive Summary

Security posture is strong overall. The layered defense-in-depth architecture (iptables DNAT + Squid ACL + capability separation + seccomp + one-shot-token) is working as intended. No critical vulnerabilities found. Four medium and four low findings identified.

Severity	Count
Critical	0
High	1 (opt-in --enable-dind only)
Medium	4
Low	4
npm CVEs	1 moderate

---

🔍 Escape Test Findings

The Secret Digger agent had full AI inference access (GH_AW_INFERENCE_ACCESS_ERROR: false) and executed successfully, yet emitted only a noop — confirming:

• unset_sensitive_tokens() (entrypoint.sh:369) + one-shot-token LD_PRELOAD successfully cleared ANTHROPIC_API_KEY, GITHUB_TOKEN, etc. from /proc/self/environ
• The tmpfs overlay on workDir prevented reading docker-compose.yml secrets
• Network exfiltration via blocked domains was prevented by Squid ACLs

---

🛡️ Architecture Security Analysis

Network Security ✅ Strong

• Two-layer filtering: iptables DNAT (port redirect to Squid) + Squid domain ACLs (dstdomain/dstdom_regex). Proxy-unaware tools still caught by DNAT fallback.
• IP-literal blocking: acl dst_ipv4/dst_ipv6 dstdom_regex blocks direct IP connections (config-generator.ts:124-127).
• IPv6 disabled: sysctl net.ipv6.conf.all.disable_ipv6=1 prevents Happy Eyeballs proxy bypass (setup-iptables.sh:47).
• Host DOCKER-USER chain: Only Squid IP has unrestricted egress; all other container traffic is blocked.

Container Security ✅ Strong with caveats

• NET_ADMIN isolation: Agent container never holds NET_ADMIN. The awf-iptables-init sidecar (shares network namespace) holds it temporarily, then exits.
• Capability drop: SYS_CHROOT + SYS_ADMIN dropped via capsh before user code runs (entrypoint.sh:357).
• Seccomp default-deny: ptrace, process_vm_readv, process_vm_writev, kexec_load, init_module, add_key all blocked.
• ⚠️ AppArmor unconfined (agent-service.ts:109) — needed for procfs mount, removes LSM layer.
• ⚠️ unshare + mount allowed in seccomp — see Finding M2.

Domain Validation ✅ Strong

• validateDomainOrPattern() rejects [\s\0"';#\]` — prevents Squid config injection.
• Wildcard * → [a-zA-Z0-9.-]* (character class) — ReDoS-safe.
• Overly broad patterns (*, *.*) explicitly rejected.

---

⚠️ Threat Model (Selected Findings)

#	Category	Threat	Severity
H1	Info Disclosure / EoP	--enable-dind mounts Docker socket — full host escape	High (opt-in)
M1	Tampering	Audit JSONL log injection: %{Host}>h and %ru not JSON-escaped in config-generator.ts:97	Medium
M2	EoP	unshare allowed in seccomp; unprivileged user namespaces may re-acquire NET_ADMIN	Medium
M3	EoP	AppArmor unconfined on agent; mount syscall also allowed in seccomp	Medium
M4	DoS	brace-expansion CVE GHSA-jxxr-4gwj-5jf2 (CVSS 6.5, CWE-400)	Medium
L1	Tampering	Log dirs api-proxy-logs/, cli-proxy-logs/, mcp-logs/ created with 0o777 (config-writer.ts:120-144)	Low
L2	Bypass	IPv6 sysctl disable is non-fatal (`
L3	Defense gap	Dangerous port list misses: Elasticsearch 9200/9300, Kafka 9092, etcd 2379, LDAP 389	Low
L4	Info Disclosure	One-shot-token LD_PRELOAD bypassed by static binaries (Go/Rust); interaction with env unset undocumented	Low

---

✅ Recommendations

🟠 High

H1 — Gate --enable-dind with explicit security acknowledgment
Docker socket mount (agent-volumes/docker-socket.ts:27) provides full container escape. Add a runtime warning and consider requiring --i-understand-dind-is-unsafe flag.

🟡 Medium

M1 — Fix audit JSONL injection (config-generator.ts:97)
%{Host}>h and %ru are embedded in JSON without escaping. Post-process JSONL with a sanitizer or switch to a format that's injection-safe. The code comment acknowledges this risk for User-Agent but applies equally to Host/URL.

M2 — Review unshare in seccomp (seccomp-profile.json)
Block unshare or verify kernel.unprivileged_userns_clone=0 on all deployment hosts. Unprivileged user namespaces + unshare can re-acquire NET_ADMIN in a new network namespace.

M3 — Create minimal AppArmor profile (agent-service.ts:107)
Replace apparmor:unconfined with a profile that allows only mount -t proc and denies raw sockets, arbitrary device access, and capability manipulation.

M4 — Update brace-expansion
Run npm audit fix to upgrade past 5.0.6.

🔵 Low

L1 — Reduce log dir permissions from 0o777 to 0o755; use Docker volume ownership for container write access.
L2 — Make IPv6 sysctl disable fatal when ip6tables is also unavailable.
L3 — Add Elasticsearch (9200/9300), Kafka (9092), etcd (2379/2380), LDAP (389/636) to DANGEROUS_PORTS.
L4 — Document one-shot-token + env unset layering in docs/environment.md to prevent future regression.

---

📈 Security Metrics

Metric	Value
Total lines analyzed	~71,733
Security-critical lines	2,780 (6 files)
Attack surfaces mapped	10
STRIDE threats modeled	13
Escape test result	✅ No secrets found/exfiltrated
npm vulnerabilities	1 moderate

Generated by Daily Security Review and Threat Modeling · sonnet46 2.8M · ◷

• expires on Jun 12, 2026, 1:29 PM UTC

[github-actions[bot]]

🔮 The ancient spirits stir, and the smoke test agent has passed through this discussion, leaving a brief omen of presence.

Warning

Firewall blocked 1 domain

The following domain was blocked by the firewall during workflow execution:

• registry.npmjs.org

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "registry.npmjs.org"

See Network Configuration for more information.

🔮 The oracle has spoken through Smoke Codex

[github-actions[bot]]

This discussion was automatically closed because it expired on 2026-06-12T13:29:48.338Z.

Closed by Workflow