[danoszz]

Fixes the findings of the second independent review: all highs and mediums, plus all of the lows except the few listed at the end. Most of these also affect 1.7.0, so this is written to ship as a patch release if the maintainer decides to. No version bump and no tag.

Every high and medium has a regression test that failed before the fix and passes after it. Hostile fixtures (archives, git configs, repos, servers) are built at runtime in temp dirs, so no exploit file is committed.

Findings → fix → test

ID	Sev	Fix	Test
H1	high	npm and Python packages with any unread code (a file over the cap, or more files than the reader takes) are unscanned, and install holds them. Caps are raised to the tarball reader's own (64 MB/file, 50k files) so real bundles like typescript.js (9 MB) are scanned in full	deps.test.js › "a code file too large to scan makes the package unscanned, not clean", "a package with more files than the source lists is unscanned, not clean", "scans a 9 MB index.js to the end…", "scans every file of a 5,001-file package…"; install.test.js › "holds packages whose code is padded, spread over 5,001 files, or too large to scan"
H2	high	Zip reader caps on inflated bytes, checks sizes against the data, and throws on anomalies. New Python unscanned state (high "could not be scanned" finding, held by install)	deps-python.test.js › "a forged central-directory size makes the wheel unscanned…", "throws on structural anomalies rather than stopping early", "a source with an anomaly, no files, or more files than listed is unscanned", "scanDeps reports a pinned wheel that cannot be read…"
H3	high	Git runner: signing and signer programs off, core.attributesFile → null device, --attr-source=<empty tree> (git ≥ 2.40), every configured filter driver emptied. Writes are refused if the repo's config sets filter.*/gpg.*/include*, or on git < 2.31	git-safety.test.js › "filters, signing and include.path in .git/config: reads neutralised, the loop refuses to write", "ssh signing's defaultKeyCommand…", "commit, add, checkout and status never run a filter or signer…", "git 2.31-2.39…" (×2), "refuses to write with a git too old…"
H4	high	status --porcelain=v1 -z; dirty state re-checked before each write and commit; revert restores pre-fix bytes only while the file still holds penthera's write (otherwise conflict); commit --only	git-safety.test.js › "(A) --allow-dirty with a dirty non-ASCII file…", "(B) …saved while the prompt was open…", "(C) …a failing fix is not reverted over it", "(C) …a passing fix is not committed with it"
H5	high	Hook reads blobs by object id from diff --cached --raw -z; includes type changes; scans files with NUL bytes; a file over 16 MB blocks (or warns with largeFiles: "warn")	hook.test.js › "staged secrets cannot slip past the hook" (5 cases), "a file over the size limit blocks by default and only warns when the policy says so"
M1	med	GIT_LITERAL_PATHSPECS=1	git-safety.test.js › "a fix to pages/api/[id].js commits and reverts only that file…"
M2	med	Plans touching untracked or ignored files are skipped; revert from saved bytes, and every step runs, with failures reported	git-safety.test.js › "never edits a git-ignored file…"; fix.test.js › "restoreFiles restores what still holds the fix…"
M3	med	Token in the URL fragment, exchanged for a per-tab session sent as Authorization: Bearer; event stream read with fetch; no cookie	ui.test.js › "a valid session in a cookie is refused: only the Authorization header counts"
M4	med	A symlinked default reports/ is refused at startup; every write re-checks that the folder still resolves to it	ui.test.js › "refuses a default reports folder that is a symlink…", "refuses every write once reports/ … no longer resolves…"
M5	med	Diffs carry truncated/fullLength; approval needs the sha256 of the diff shown, plus an acknowledgement when cut; the client shows a "Diff cut" marker	ui.test.js › "a 70,000-character diff says it is cut, and cannot be approved without the matching hash and an acknowledgement"
M6	med	Control characters shown as escapes in prompts; added lines with C0/C1 controls refused by applyDiff (and so the model dry run)	fix.test.js › "refuses added lines with control characters…", "shows control characters as escapes in diffs, titles and paths"
M7	med	Secret scan checks every match per rule and skips placeholders one by one	ai-secrets.test.js › "a placeholder does not hide a real secret of the same rule later in the text"; hook.test.js › "a placeholder of the same rule earlier in the file"
M8	med	Shared readBody with a decoded-size cap and a deadline covering the body; every body reader goes through it, including registry, tarball and local-model reads	http-limits.test.js › "an endless body ends at the request timeout", "a gzip bomb stops at the decoded size cap", …; fix.test.js › "stops reading a model response that never ends"
M9	med	Agent-config exec patterns match in linear time; same matches as before (fuzz-checked)	agents-linear.test.js › "1 MB of "curl "…", "reports the same match text and line as before"
M10	med	Regex guard decides every choice in repeated groups, and $ counts as mandatory	rule-packs.test.js › "rejects /…/" for 8 new must-refuse patterns
M11	med	Already fixed on main (6cf41d6); inside now resolves the root and compares with relative(); unit-tested with path.win32	onboarding.test.js › "accepts a Windows root in git's forward-slash spelling, refuses escapes"
M12	med	prepack removed (publish.yml still runs npm test)	packaging.test.js › "package.json has no pack or install lifecycle scripts"
L1	low	applyDiff is all-or-nothing: duplicate and prefix paths refused, rollback on error	fix.test.js › "refuses a diff that writes one path twice…", "puts back every file it wrote when a later write fails"
L2	low	Per-run nextSeq for event ids	ui.test.js › "event ids keep counting past the 5,000-event buffer…"
L3	low	Write via temp file + rename (never through a hard link); fstat/lstat dev/ino and realpath checks	fix.test.js › "replaces a hard-linked file instead of writing through it"
L4	low	Segments containing : and gitmod~N refused	fix.test.js › "refuses NTFS alternate data stream names and the 8.3 alias of .gitmodules"
L5	low	Pax g records that set size/path/linkpath refused	deps.test.js › "refuses a pax global header that sets size, path or linkpath"
L6	low	Evidence bundles built privately and renamed; O_EXCL|O_NOFOLLOW; verify lstats every component, caps reads, dedupes case-insensitively	evidence.test.js › "never reads through a symlinked folder…", "caps how much it reads…", "builds the bundle in a private temp folder…"
L7	low	FIFO/non-regular files never read; iterative canonicalJson; per-file errors become findings; TOML depth cap	ai-secrets.test.js › "does not read a FIFO named .env…"; agents-linear.test.js › "penthera agents completes on a 200,000-deep .mcp.json…"; deps-python.test.js › "a deeply nested lockfile is a parse error…"
L8	low	Community templates use the rule-pack checkRegex	code-scanning.test.js › "refuses alternation and rescanning shapes too…"
L9	low	hook install lstats, treats a symlink as foreign (backs it up), writes with wx	hook.test.js › "moves a symlinked pre-commit aside instead of writing through it"
L10	low	--offline compares host and port; cross-origin hops drop credentials and don't replay bodies	http-limits.test.js › "compares the port…", "drops Authorization and Cookie on a cross-origin hop", "does not replay a 307 body…"
L11	low	(a) Object.hasOwn; (c) request/idle timeouts, finished-run pruning, stream cap; (d) 413; (e) --open uses a 0600 launcher file instead of a token on the command line. (b) is in PR #63's client, see below	ui.test.js › "prototype keys are not answers", "bounds request time and idle sockets…", "keeps a bounded number of finished runs", "caps open run streams", "answers 413…", "writes a launcher page only this user can read…"
L12	low	Linear fixHint and agents rules (AUTO_APPROVE, preview, Python pin)	hook.test.js › "fixHint stays linear…"; agents-linear.test.js › 3 cases
L13	low	Done: model context stays in the repo; persist-credentials: false; real pin in the example workflow	fix.test.js › "never sends a file outside the repo, via package.json main or a symlink"

Lows not done, with reasons

• L13 memory-lock race: unverified, and it fails closed (memory reports "broken"). A follow-up.
• L13 wizard defaults on empty stdin: this is a product decision (whether init < /dev/null should install the hook), not a bug fix. It needs the maintainer.
• L13 pre-existing node_modules and Windows shell: true: both unverified; they need a Windows or planted-tree repro first.
• L13 publish.yml npm ci in the id-token job and install.sh from unpinned main: release-process changes, so they belong with the release work.
• M7 value-bound suppression ids: not done. Changing fingerprints would mark every existing secret finding "new" once, which breaks --baseline gates on upgrade. The match-by-match fix covers the scanning side.
• L3 race: narrowed (realpath and dev/ino checks right before the rename), not closed; there is no race test.

Behaviour changes to know about

• Fix-loop writes are refused when a repo's own .git/config sets gpg.*, filter.* or include.*, which includes legitimate per-repo signing setups. Global config is unaffected.
• A staged file over 16 MB now blocks the commit by default ("largeFiles": "warn" to relax). The old cap was a silent 2 MB.
• Dashboard: sessions are per tab, since the token now arrives in the URL fragment, not a cookie. Static assets no longer need a session; /api still does. Server (1d7ba83) and client (afcf4ad) must land together.
• Two detection fixtures are newly reported by the stricter secret scan and were added to audit/baseline.json with reasons.

PR #63

PR #63 rewrites the dashboard client. The server, evidence and test commits cherry-pick onto it, apart from one test about serving static files without a session. The client commit does not. An equivalent client change for #63's files, including L11b (Apply no longer auto-focused, no global y key), is on branch sec2/ui-for-pr63. Whichever of the two merges second needs that commit.

Checks

• npm test: 1,010 passed, 21 skipped.
• npm run audit:internal: all gates pass (packed 667 KB, unpacked 1,772 KB, 185 files).

🤖 Generated with Claude Code

[github-actions]

Dependency capability diff

Compared against 6a6e4c6e5cac061ec7e97ba4c9059a9b9459f910: 0 added · 0 changed · 0 removed.

No package gained capabilities, and no new package can reach shell, network or install-time code.

_{penthera deps v1.7.0: offline static analysis, no telemetry. Capabilities are what code can do, not a verdict.}

Checked by Penthera, open-source security for the apps and AI systems you ship · https://github.com/danoszz/penthera

_{Updated for commit 17a90af · workflow run. This comment is edited in place on every push.}