2.0 KiB
Audit tenant, authentication, and request security boundaries
Type: research Status: resolved
Question
Can any current HTTP, Feishu, filesystem, agent, or database path cross an Organization boundary, bypass the intended platform/org/project authorization seams, expose secrets, or accept unbounded hostile input in the initial production topology?
Answer
Yes. Basic org-admin HTTP/Prisma scoping is correctly enforced and its 28 targeted integration tests pass, but the agent inherits service secrets and can read sibling files, MCP file/context tools accept real targets outside the run objects, queued/card actions do not consistently bind or reauthorize their target, non-ACTIVE tenants can still trigger agents, and Feishu/provider credentials remain global instead of ADR-0021 org-scoped encrypted secrets. Current Node and Rust dependency audits also fail on high/vulnerability/unsound advisories.
The complete contract mapping, reproductions, positive evidence, advisory inventory, and required release proofs are in the tenant, authentication, and request security audit.
The newly-clear implementation and decision frontier is:
- Confine the agent runtime and protect service credentials
- Close MCP context and file-delivery escape paths
- Bind and reauthorize deferred and card actions
- Design the org-scoped secret and connection control plane
- Design the production browser and session boundary
- Clear dependency advisories and gate releases
- Enforce Organization status at the shared authorization seam
Inbound Feishu file count/size/MIME and request-rate policy remain owned by Define initial abuse and capacity controls rather than being guessed in this audit.