ilia/stork
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Audit hardening: P0–P2 (readonly demo, limits, session) #10

Merged
ilia merged 1 commits from feat/audit-hardening into main 2026-08-07 19:57:47 -05:00
Conversation 0 Commits 1 Files Changed 10
+414 -105
ilia commented 2026-08-07 19:55:01 -05:00
Owner
Copy Link
Copy Source

Summary

  • Read-only demo boards via `STORK_READONLY_BOARD_IDS`
  • Per-IP rate limits on board create / session / uploads
  • Opaque voter required (no display-name-only header auth)
  • `DELETE /api/session`, landing no auto-resume, Leave + Continue
  • Upload magic-byte sniff + recording path containment
  • `/v1` redirects home; link-risk + help copy

Test plan

  • `make test` / `make lint` (29 tests)
  • Demo mutations 403 after deploy with readonly env
  • Family board still writable
  • Burst board create → 429
## Summary - Read-only demo boards via \`STORK_READONLY_BOARD_IDS\` - Per-IP rate limits on board create / session / uploads - Opaque voter required (no display-name-only header auth) - \`DELETE /api/session\`, landing no auto-resume, Leave + Continue - Upload magic-byte sniff + recording path containment - \`/v1\` redirects home; link-risk + help copy ## Test plan - [x] \`make test\` / \`make lint\` (29 tests) - [ ] Demo mutations 403 after deploy with readonly env - [ ] Family board still writable - [ ] Burst board create → 429
ilia added 1 commit 2026-08-07 19:55:01 -05:00
Harden Stork for public demo and family durability
CI / python-ci (pull_request) Successful in 1m8s
Details
CI / secret-scan (pull_request) Successful in 33s
Details
480e5b6ce6 
Read-only demo boards, per-IP rate limits, opaque voter sessions,
session leave, upload sniffing, path containment, and retire /v1.
ilia scheduled this pull request to auto merge when all checks succeed 2026-08-07 19:55:44 -05:00
ilia merged commit 8eb289c991 into main 2026-08-07 19:57:47 -05:00
ilia deleted branch feat/audit-hardening 2026-08-07 19:57:47 -05:00
Sign in to join this conversation.
Reviewers
No Reviewers
Labels
No items
No labels
Milestone
No items
No Milestone
Projects
Clear projects
No projects
Assignees
Clear assignees
ilia (Ilia)
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: ilia/stork#10