📦
Histórico de auditoria
basin - 1 auditoria
Versão da auditoria 1 Mais recente
9 de out. de 2026, 14:53
All 70 static matches are false positives involving documentation links, placeholder URLs, legitimate service requests, SQL identifiers, and TypeScript strings. Four semantic risks concern unauthenticated ingestion, an unprotected analytics endpoint, ineffective IP redaction, and a command that prints an API token. No evidence found of prompt injection, malicious exfiltration, or covert code execution in the reviewed files.
16
Arquivos analisados
1,104
Linhas analisadas
7
Itens de revisão
0
Falsos positivos ignorados
Preocupações de segurança confirmadas (4)
Alto
Dashboard Worker Exposes Analytics Without Caller Authorization
The Worker matches "/api/analytics", queries with its server-side token, and returns result.rows without checking caller identity or permissions. A public deployment without external protection could disclose analytics and permit repeated billable queries.
The complete handler performs only a pathname check before returning authenticated query results. No caller authentication is shown; external deployment controls could reduce exposure.
Médio
HTTP Ingestion Templates Disable Authentication
The REST example sets "authentication": false, and Terraform also sets authentication = false for HTTP ingestion. If deployed, unauthenticated senders could inject events, corrupt analytics, and increase storage or processing costs.
Both executable configuration examples explicitly disable authentication without requiring an upstream access boundary. Exploitation depends on deploying these examples and accessing the ingest endpoint.
Médio
Claimed IP Redaction Retains Raw Client Addresses
The Logpush transform selects ClientIP alongside sha256(ClientIP) AS hashed_ip while claiming "redact PII at ingest". The stored output retains the original address, so following this example does not achieve the stated redaction.
The same SELECT explicitly includes both the raw ClientIP column and its hash. The misleading redaction comment directly contradicts the output projection.
Médio
Troubleshooting Command Prints Authentication Secret
The checklist recommends "echo $WRANGLER_BASIN_SQL_AUTH_TOKEN" to test token presence. This reveals the complete credential in terminal output and can expose it through captured logs or assistant transcripts.
The command explicitly expands and prints the authentication token rather than checking whether it exists. Further disclosure depends on how terminal output is recorded.
Fatores de risco
🌐 Acesso à rede (26)
references/catalog/api.md:22 references/pipelines/api.md:14 references/pipelines/api.md:29 references/pipelines/api.md:36 references/pipelines/api.md:41 references/pipelines/api.md:109 references/pipelines/api.md:114 references/pipelines/patterns.md:9 references/pipelines/patterns.md:48 references/pipelines/patterns.md:48 references/pipelines/patterns.md:93 references/pipelines/README.md:51 references/sql/api.md:8 references/sql/configuration.md:36 references/sql/patterns.md:52 references/sql/patterns.md:62 references/sql/patterns.md:26 references/sql/patterns.md:22 references/sql/patterns.md:38 references/sql/patterns.md:51 SKILL.md:8 SKILL.md:12 SKILL.md:18 SKILL.md:19 SKILL.md:20 SKILL.md:22
📁 Acesso ao sistema de arquivos (19)
references/catalog/api.md:30 references/catalog/patterns.md:10 references/catalog/patterns.md:11 references/catalog/README.md:16 references/pipelines/api.md:124 references/pipelines/gotchas.md:45 references/pipelines/patterns.md:122 references/pipelines/patterns.md:125 references/pipelines/patterns.md:130 references/pipelines/README.md:88 references/pipelines/README.md:89 references/sql/api.md:3 references/sql/api.md:96 references/sql/configuration.md:7 references/sql/patterns.md:109 references/sql/patterns.md:114 references/sql/patterns.md:118 references/sql/README.md:63 references/sql/README.md:64
Auditado por: codex