COMPANION-APP-PHASE-2-LOOPBACK-SECURITY.md symbol-level

Companion App — Phase 2: Loopback Endpoint Security Core insert hotspot 💥 blast

1×

aaronrene · Jun 10, 2026

sha256:0

#	Commit	Op	Message	Author	When
1	sha256:0d530f9ef27b	insert	reconcile: import GitHub-direct RBAC/OAuth/companion and ho…	aaronrene	2026-06-10

View symbol detail ↗

Companion App — Phase 2: Loopback Endpoint Security Core.1. Adversarial threat model insert hotspot 💥 blast

1×

aaronrene · Jun 10, 2026

sha256:0

#	Commit	Op	Message	Author	When
1	sha256:0d530f9ef27b	insert	reconcile: import GitHub-direct RBAC/OAuth/companion and ho…	aaronrene	2026-06-10

View symbol detail ↗

Companion App — Phase 2: Loopback Endpoint Security Core.1. Adversarial threat model.Attacker A — malicious web page in the user's browser (cross-origin) insert hotspot 💥 blast

1×

aaronrene · Jun 10, 2026

sha256:0

#	Commit	Op	Message	Author	When
1	sha256:0d530f9ef27b	insert	reconcile: import GitHub-direct RBAC/OAuth/companion and ho…	aaronrene	2026-06-10

View symbol detail ↗

Companion App — Phase 2: Loopback Endpoint Security Core.1. Adversarial threat model.Attacker B — DNS-rebinding (make a remote origin appear to target loopback) insert hotspot 💥 blast

1×

aaronrene · Jun 10, 2026

sha256:0

#	Commit	Op	Message	Author	When
1	sha256:0d530f9ef27b	insert	reconcile: import GitHub-direct RBAC/OAuth/companion and ho…	aaronrene	2026-06-10

View symbol detail ↗

Companion App — Phase 2: Loopback Endpoint Security Core.1. Adversarial threat model.Attacker C — a local non-browser process insert hotspot 💥 blast

1×

aaronrene · Jun 10, 2026

sha256:0

#	Commit	Op	Message	Author	When
1	sha256:0d530f9ef27b	insert	reconcile: import GitHub-direct RBAC/OAuth/companion and ho…	aaronrene	2026-06-10

View symbol detail ↗

Companion App — Phase 2: Loopback Endpoint Security Core.1. Adversarial threat model.Attacker D — prompt-injection payload inside a note body insert hotspot 💥 blast

1×

aaronrene · Jun 10, 2026

sha256:0

#	Commit	Op	Message	Author	When
1	sha256:0d530f9ef27b	insert	reconcile: import GitHub-direct RBAC/OAuth/companion and ho…	aaronrene	2026-06-10

View symbol detail ↗

Companion App — Phase 2: Loopback Endpoint Security Core.2. Guard contract — lib/companion-loopback-guard.mjs insert hotspot 💥 blast

1×

aaronrene · Jun 10, 2026

sha256:0

#	Commit	Op	Message	Author	When
1	sha256:0d530f9ef27b	insert	reconcile: import GitHub-direct RBAC/OAuth/companion and ho…	aaronrene	2026-06-10

View symbol detail ↗

Companion App — Phase 2: Loopback Endpoint Security Core.2. Guard contract — lib/companion-loopback-guard.mjs.2.1 verifyLoopbackRequest(params) → LoopbackVerdict insert hotspot 💥 blast

1×

aaronrene · Jun 10, 2026

sha256:0

#	Commit	Op	Message	Author	When
1	sha256:0d530f9ef27b	insert	reconcile: import GitHub-direct RBAC/OAuth/companion and ho…	aaronrene	2026-06-10

View symbol detail ↗

Companion App — Phase 2: Loopback Endpoint Security Core.2. Guard contract — lib/companion-loopback-guard.mjs.2.1 verifyLoopbackRequest(params) → LoopbackVerdict.code[js] insert hotspot 💥 blast

1×

aaronrene · Jun 10, 2026

sha256:0

#	Commit	Op	Message	Author	When
1	sha256:0d530f9ef27b	insert	reconcile: import GitHub-direct RBAC/OAuth/companion and ho…	aaronrene	2026-06-10

View symbol detail ↗

Companion App — Phase 2: Loopback Endpoint Security Core.2. Guard contract — lib/companion-loopback-guard.mjs.2.1 verifyLoopbackRequest(params) → LoopbackVerdict.table@L152 insert

1×

aaronrene · Jun 10, 2026

sha256:0

#	Commit	Op	Message	Author	When
1	sha256:0d530f9ef27b	insert	reconcile: import GitHub-direct RBAC/OAuth/companion and ho…	aaronrene	2026-06-10

View symbol detail ↗

Companion App — Phase 2: Loopback Endpoint Security Core.2. Guard contract — lib/companion-loopback-guard.mjs.2.1 verifyLoopbackRequest(params) → LoopbackVerdict.table@L165 insert

1×

aaronrene · Jun 10, 2026

sha256:0

#	Commit	Op	Message	Author	When
1	sha256:0d530f9ef27b	insert	reconcile: import GitHub-direct RBAC/OAuth/companion and ho…	aaronrene	2026-06-10

View symbol detail ↗

Companion App — Phase 2: Loopback Endpoint Security Core.2. Guard contract — lib/companion-loopback-guard.mjs.2.2 Rate-limit helpers insert

1×

aaronrene · Jun 10, 2026

sha256:0

#	Commit	Op	Message	Author	When
1	sha256:0d530f9ef27b	insert	reconcile: import GitHub-direct RBAC/OAuth/companion and ho…	aaronrene	2026-06-10

View symbol detail ↗

Companion App — Phase 2: Loopback Endpoint Security Core.2. Guard contract — lib/companion-loopback-guard.mjs.2.3 Why the Origin allowlist is the loopback origin only insert

1×

aaronrene · Jun 10, 2026

sha256:0

#	Commit	Op	Message	Author	When
1	sha256:0d530f9ef27b	insert	reconcile: import GitHub-direct RBAC/OAuth/companion and ho…	aaronrene	2026-06-10

View symbol detail ↗

Companion App — Phase 2: Loopback Endpoint Security Core.3. Evaluation order (and why) insert

1×

aaronrene · Jun 10, 2026

sha256:0

#	Commit	Op	Message	Author	When
1	sha256:0d530f9ef27b	insert	reconcile: import GitHub-direct RBAC/OAuth/companion and ho…	aaronrene	2026-06-10

View symbol detail ↗

Companion App — Phase 2: Loopback Endpoint Security Core.3. Evaluation order (and why).code insert

1×

aaronrene · Jun 10, 2026

sha256:0

#	Commit	Op	Message	Author	When
1	sha256:0d530f9ef27b	insert	reconcile: import GitHub-direct RBAC/OAuth/companion and ho…	aaronrene	2026-06-10

View symbol detail ↗

Companion App — Phase 2: Loopback Endpoint Security Core.4. The rate-limit recording contract insert

1×

aaronrene · Jun 10, 2026

sha256:0

#	Commit	Op	Message	Author	When
1	sha256:0d530f9ef27b	insert	reconcile: import GitHub-direct RBAC/OAuth/companion and ho…	aaronrene	2026-06-10

View symbol detail ↗

Companion App — Phase 2: Loopback Endpoint Security Core.4. The rate-limit recording contract.code[js] insert

1×

aaronrene · Jun 10, 2026

sha256:0

#	Commit	Op	Message	Author	When
1	sha256:0d530f9ef27b	insert	reconcile: import GitHub-direct RBAC/OAuth/companion and ho…	aaronrene	2026-06-10

View symbol detail ↗

Companion App — Phase 2: Loopback Endpoint Security Core.5. Mapping: gate §4 controls → Phase 2 enforcement insert

1×

aaronrene · Jun 10, 2026

sha256:0

#	Commit	Op	Message	Author	When
1	sha256:0d530f9ef27b	insert	reconcile: import GitHub-direct RBAC/OAuth/companion and ho…	aaronrene	2026-06-10

View symbol detail ↗

Companion App — Phase 2: Loopback Endpoint Security Core.5. Mapping: gate §4 controls → Phase 2 enforcement.table insert

1×

aaronrene · Jun 10, 2026

sha256:0

#	Commit	Op	Message	Author	When
1	sha256:0d530f9ef27b	insert	reconcile: import GitHub-direct RBAC/OAuth/companion and ho…	aaronrene	2026-06-10

View symbol detail ↗

Companion App — Phase 2: Loopback Endpoint Security Core.6. What Phase 5 must do to bind the socket safely insert

1×

aaronrene · Jun 10, 2026

sha256:0

#	Commit	Op	Message	Author	When
1	sha256:0d530f9ef27b	insert	reconcile: import GitHub-direct RBAC/OAuth/companion and ho…	aaronrene	2026-06-10

View symbol detail ↗

Companion App — Phase 2: Loopback Endpoint Security Core.7. Test obligations satisfied (gate §10, 7 tiers) insert

1×

aaronrene · Jun 10, 2026

sha256:0

#	Commit	Op	Message	Author	When
1	sha256:0d530f9ef27b	insert	reconcile: import GitHub-direct RBAC/OAuth/companion and ho…	aaronrene	2026-06-10

View symbol detail ↗

Companion App — Phase 2: Loopback Endpoint Security Core.7. Test obligations satisfied (gate §10, 7 tiers).table insert

1×

aaronrene · Jun 10, 2026

sha256:0

#	Commit	Op	Message	Author	When
1	sha256:0d530f9ef27b	insert	reconcile: import GitHub-direct RBAC/OAuth/companion and ho…	aaronrene	2026-06-10

View symbol detail ↗

Companion App — Phase 2: Loopback Endpoint Security Core.8. Deferred (explicitly not Phase 2) insert

1×

aaronrene · Jun 10, 2026

sha256:0

#	Commit	Op	Message	Author	When
1	sha256:0d530f9ef27b	insert	reconcile: import GitHub-direct RBAC/OAuth/companion and ho…	aaronrene	2026-06-10

View symbol detail ↗

Companion App — Phase 2: Loopback Endpoint Security Core.Simple summary insert

1×

aaronrene · Jun 10, 2026

sha256:0

#	Commit	Op	Message	Author	When
1	sha256:0d530f9ef27b	insert	reconcile: import GitHub-direct RBAC/OAuth/companion and ho…	aaronrene	2026-06-10

View symbol detail ↗

Companion App — Phase 2: Loopback Endpoint Security Core.Technical summary insert

1×

aaronrene · Jun 10, 2026

sha256:0

#	Commit	Op	Message	Author	When
1	sha256:0d530f9ef27b	insert	reconcile: import GitHub-direct RBAC/OAuth/companion and ho…	aaronrene	2026-06-10

View symbol detail ↗