gabriel / musehub public
BREAKING docs/app-security-reviewed #1 / 1
AI Agent gabriel · 4 hours ago · Sep 7, 2026 · Diff

docs+fix: resolve Section 14 app-security gaps with real code review (#162)

Verified SSRF protection is actually wired in (webhook dispatcher + model field validation), confirmed CSRF is genuinely N/A (zero cookie usage anywhere), confirmed MCP/SSE auth correctly uses the same MSign mechanism with per-privileged-action enforcement.

Real finding: MSign's per-request signing only enforces a 30s freshness window, not true single-use replay protection - no nonce/dedup tracking exists for it, unlike the separate auth-challenge and MPay flows that do have single-use nonces. Corrected the docstring's misleading 'replay protection' framing to describe what it actually does. Not fixing the underlying gap in this pass - the real fix (a dedup cache) needs careful design given the performance cost of a check on every authenticated request and the blue/green instance topology.

sha256:a507bd1b3380da1a4a55da9d4e9166d200a8ec4101b9ce3d9ebe9e6aa73d6d36 sha
sha256:6e8e45f349e424f02c46c12222c7863c61021e7a4081182b4cb154a400c07361 parent
+9 ~1 −4 symbols
2 changed · 1060 in snapshot files
sha256:cfe5f4892c1a984029b969868d003283d0890c8949060fd7e35ad6c94cd9a0f6 snapshot
+9
symbols added
~1
symbol modified
−4
symbols removed
2
files changed
1060
files in snapshot
0
dead code introduced
Semantic Changes 14 symbols
+ .vscode/
+ alembic/
+ alembic/versions/
+ deploy/
+ deploy/load-tests/
+ docs/
+ docs/architecture/
+ docs/guides/
+ docs/issues/
+ docs/issues/assets/
+ docs/legal/
+ docs/mists/
+ docs/production-readiness/
+ docs/reference/
+ docs/releases/
+ docs/roadmaps/
+ musehub/
+ musehub/api/
+ musehub/api/routes/
+ musehub/api/routes/api/
+ musehub/api/routes/musehub/
+ musehub/auth/
+ musehub/core/
+ musehub/crypto/
+ musehub/db/
+ musehub/debug/
+ musehub/graph/
+ musehub/maintenance/
+ musehub/mcp/
+ musehub/mcp/tools/
+ musehub/mcp/write_tools/
+ musehub/middleware/
+ musehub/models/
+ musehub/muse_cli/
+ musehub/proposals/
+ musehub/protocol/
+ musehub/security/
+ musehub/services/
+ musehub/storage/
+ musehub/templates/
+ musehub/templates/mcp/
+ musehub/templates/musehub/
+ musehub/templates/musehub/fragments/
+ musehub/templates/musehub/macros/
+ musehub/templates/musehub/opengraph/
+ musehub/templates/musehub/pages/
+ musehub/templates/musehub/partials/
+ musehub/templates/musehub/static/
+ musehub/templates/musehub/static/vendor/
+ musehub/types/
+ scripts/
+ src/
+ src/scss/
+ src/scss/components/
+ src/scss/pages/
+ src/scss/patterns/
+ src/scss/theme/
+ src/ts/
+ src/ts/pages/
+ tests/
+ tests/unit/
+ tools/
+ workflows/
~ docs/production-readiness/14-application-security.md .md 9 symbols added, 4 symbols removed, 1 symbol modified
− Gaps / not reviewed in this pass section Gaps / not reviewed in this pass L46–63
− The actual work items here section The actual work items here L63–71
− What's already solid — confirmed by code review section What's already solid — confirmed by code review L13–46
− ✅ Fixed — /_debug/memory was exposed unconditionally in production section ✅ Fixed — /_debug/memory was exposed unconditionally in production L5–13
+ Still open — genuinely needs Gabriel or a dedicated pass, not code-checkable from here section Still open — genuinely needs Gabriel or a dedicated pass, not code-checkable from here L78–88
+ Update (2026-09-07) — remaining gaps reviewed with real code inspection section Update (2026-09-07) — remaining gaps reviewed with real code inspection L5–78
+ Account/data deletion — a mechanism exists section Account/data deletion — a mechanism exists L71–78
+ CSRF review — resolved, genuinely N/A section CSRF review — resolved, genuinely N/A L23–30
+ MSign replay protection — real finding: it's freshness-only, not true replay prevention section MSign replay protection — real finding: it's freshness-only, not true replay prevention L41–71
+ code[python] variable variable code[python] L45–49
+ SSRF review — resolved, and it's solid section SSRF review — resolved, and it's solid L10–23
+ WebSocket/SSE authentication — resolved, correctly implemented section WebSocket/SSE authentication — resolved, correctly implemented L30–41
+ What's already solid — confirmed by code review (from the original pass, still true) section What's already solid — confirmed by code review (from the original pass, still true) L88–100
~ Section 14 — Application Security
~ musehub/auth/request_signing.py .py
Files Changed
~2
1060 in snapshot
~ docs/production-readiness/14-application-security.md .md
~ musehub/auth/request_signing.py .py
← Older Oldest on docs/app-security-reviewed
All commits
Newer → Latest on docs/app-security-reviewed

0 comments

No comments yet. Be the first to start the discussion.

To add a comment, use the Muse CLI: muse hub commit comment sha256:a507bd1b3380da1a4a55da9d4e9166d200a8ec4101b9ce3d9ebe9e6aa73d6d36 --body "your comment"