T2 remediation: unsubscribe/delete-my-data ownership proof landed (4ee6c34) — DEPLOY BLOCKED on VPS checkout drift + SUBSCRIBE_HMAC_SECRET wiring #3
Loading…
Add table
Add a link
Reference in a new issue
No description provided.
Delete branch "%!s()"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
Context
Cold audit loop 2026-10-02 (
siteops-web-draftstrategy-io-t1-20261002T173327) ended DIRTY after 6/6 iterations — every iteration re-found the same HIGH because the loop's fix stage is advisory-only (iteration 1's fix "suggestion" asked for file contents instead of applying anything; no fix was ever applied). T2 remediation (jobsiteops-fantasy-draft-t2-20261002T174754) verified each finding against code and fixed what was verifiable.Fixed and pushed (main @
4ee6c34)DELETE /api/delete-my-dataandGET /api/unsubscribe(api/routes/subscribe.py): anyone could wipe any subscriber's PII or unsubscribe any address by knowing their email.delete-my-datanow requires a session Bearer token (ownership proof); deletes the session user's email only.unsubscribenow requirest=HMAC-SHA256 token;api/mailer.pysigns{{unsubscribe_url}}with new envSUBSCRIBE_HMAC_SECRET(fails closed if unset;_validate_envwarns).hmac.compare_digest).APP_ENV=development(api/api.py)./api/draft/loadtestremoved from FREE_PATHS (route was already APP_ENV-gated; defense in depth).n_simscap 50,000 → 10,000 (now matchesmodels.pycontract).\bsuffix regex (never fired).api/tests/test_subscribe_verification.py(5 tests). Full suite: 100 passed.# pii:allowon the alg:none forged-JWT test fixture, and a credit_card regex fix in~/.git-templates/hooks/pii-shield.sh(dot-adjacent digit runs excluded —.is never a card separator). No hook bypass used.⚠️ NOT YET DEPLOYED — live API still runs the vulnerable code
fantasy-draft-apion the VPS was built 10h ago from/opt/fantasy-draft, whose git tree has diverged from origin/main by 432 files (HEAD1d6b79d, mixed rsync-drift + live hotfixes inapi/api.py,api/middleware.py,api/routes/draft.py,api/routes/payments.py). Blind pull/reset risks wiping live hotfixes — needs manual reconciliation first.Deploy runbook (order matters — unsubscribe fails closed without the secret):
/opt/fantasy-draft: diff drifted files vs origin/main, port or commit the live hotfixes, get to cleangit pullat4ee6c34.SUBSCRIBE_HMAC_SECRET(e.g.openssl rand -hex 32), add as a field to Vaultwarden item fantasy-draft-secrets, then run~/bin/fantasy-draft-secrets.shto pushvault.secretsto VPS.docker compose build fantasy-api && docker compose up -d fantasy-apiat/opt/fantasy-draft.GET /api/unsubscribe?email_addr=x@example.com→ 401; a fresh emailed link → 200;GET /api/health→ 200.Deferred findings (not fixed this round)
request.client.host; behind Traefik all users share one bucket. Needs--proxy-headers --forwarded-allow-ipsin the api Dockerfile CMD + collapsing the duplicate per-route limiter inrankings.py. Infra-touching — verify Traefik hop before changing.trade_calc.pyP10/P50/P90 is a hardcoded ±20–25% multiplier presented as bootstrap CIs (paid feature).dynasty/signal_engine.py_estimate_market_delta=ppg_trend * 0.5heuristic.api/mc_kernel-*.whl— no build provenance recorded.db.pyswallows migrationOperationalErrors silently..backups/draftsimulator.orphan.bak/(untracked, gitignored) contains fabricated stats + fake aggregateRating — recommend deleting to prevent accidental resurrection..pytest_cache/v/cache/lastfailedreferences deletedtests/test_form_engine.py— stale cache, not a failing test (verified: file gone, suite green).APP_ENV=development.