diff options
Diffstat (limited to 'SECURITY_CHECKLIST.md')
| -rw-r--r-- | SECURITY_CHECKLIST.md | 59 |
1 files changed, 18 insertions, 41 deletions
diff --git a/SECURITY_CHECKLIST.md b/SECURITY_CHECKLIST.md index 4e63174..46b8cea 100644 --- a/SECURITY_CHECKLIST.md +++ b/SECURITY_CHECKLIST.md @@ -2,14 +2,8 @@ ## Critical Security Issues (Must Fix Before Production) -### Authentication & Authorization -- [ ] **Timing Attack in AI Auth** (15 min) - - File: `internal/middleware/ai_auth.go:31` - - Change: Use `crypto/subtle.ConstantTimeCompare()` instead of `!=` - - Impact: Prevents token brute-forcing - ### Database Security -- [ ] **SQL Injection in GetNotes()** (15 min) +- [x] **SQL Injection in GetNotes()** (15 min) - File: `internal/store/sqlite.go:208` - Change: Use parameterized query for LIMIT clause - Impact: Prevents SQL injection attacks @@ -30,11 +24,6 @@ - Change: Validate paths stay within vault, skip symlinks - Impact: Prevents arbitrary file read attacks -- [ ] **JSON Injection in Error Responses** (15 min) - - File: `internal/middleware/ai_auth.go:42-45` - - Change: Use `json.Encoder` instead of string concatenation - - Impact: Prevents JSON structure manipulation - ### Network Security - [ ] **HTTPS Support** (1 hour) - File: `cmd/dashboard/main.go:86-94` @@ -119,16 +108,6 @@ - Impact: Protection against malicious API servers ### Testing -- [ ] **Add AI Handler Tests** (2 hours) - - File: `internal/handlers/ai_handlers_test.go` (new) - - Tests: Task categorization, meal grouping, response size - - Impact: Better test coverage - -- [ ] **Add Middleware Tests** (1 hour) - - File: `internal/middleware/ai_auth_test.go` (new) - - Tests: Valid/invalid tokens, missing headers - - Impact: Better test coverage - - [ ] **Add Edge Case Tests** (2 hours) - Files: Various test files - Tests: Empty responses, malformed JSON, network errors @@ -202,22 +181,22 @@ | Priority | Count | Estimated Time | |----------|-------|----------------| -| Critical | 6 items | ~4 hours | +| Critical | 4 items | ~2.5 hours | | High | 7 items | ~6.5 hours | -| Medium | 11 items | ~13.5 hours | +| Medium | 8 items | ~9.5 hours | | Low | 8 items | ~14 hours | -| **Total** | **32 items** | **~38 hours** | +| **Total** | **27 items** | **~32.5 hours** | ### Recommended Sprint 1 (Critical + High Priority) - **Duration**: 1-2 weeks part-time -- **Items**: 13 items -- **Time**: ~10.5 hours +- **Items**: 11 items +- **Time**: ~9 hours - **Focus**: Security hardening and performance ### Recommended Sprint 2 (Medium Priority) - **Duration**: 1-2 weeks part-time -- **Items**: 11 items -- **Time**: ~13.5 hours +- **Items**: 8 items +- **Time**: ~9.5 hours - **Focus**: Code quality and testing --- @@ -226,18 +205,16 @@ These can be done in small chunks: -1. ✓ Timing attack fix (15 min) -2. ✓ SQL injection fix (15 min) -3. ✓ JSON injection fix (15 min) -4. ✓ Database permissions (15 min) -5. ✓ Health check endpoint (15 min) -6. ✓ Security headers middleware (30 min) -7. ✓ Database ping check (15 min) -8. ✓ Check JSON unmarshal errors (30 min) -9. ✓ Extract constants (30 min) -10. ✓ Config validation (30 min) - -**Total Quick Wins**: ~4 hours, addresses 10 issues +1. ✓ SQL injection fix (15 min) +2. ✓ Database permissions (15 min) +3. ✓ Health check endpoint (15 min) +4. ✓ Security headers middleware (30 min) +5. ✓ Database ping check (15 min) +6. ✓ Check JSON unmarshal errors (30 min) +7. ✓ Extract constants (30 min) +8. ✓ Config validation (30 min) + +**Total Quick Wins**: ~3.5 hours, addresses 8 issues --- |