From 710567cbda4bc1be2326f3189a2d78221bbdffec Mon Sep 17 00:00:00 2001 From: tegwick Date: Mon, 12 Oct 2026 18:15:43 +0200 Subject: [PATCH] security: record native forge receive-hook baseline Assistant: codex Assistant-Model: gpt-6-astra Assistant-Session: 01a12d13-27f2-7163-b8c0-f682af02772c --- workplans/RMGR-WP-0021-secret-detection-controls.md | 12 +++++++++++- 1 file changed, 11 insertions(+), 1 deletion(-) diff --git a/workplans/RMGR-WP-0021-secret-detection-controls.md b/workplans/RMGR-WP-0021-secret-detection-controls.md index e22b4b5..7222864 100644 --- a/workplans/RMGR-WP-0021-secret-detection-controls.md +++ b/workplans/RMGR-WP-0021-secret-detection-controls.md @@ -75,7 +75,7 @@ T03/T04 remain open; local hooks remain bypassable. ```task id: RMGR-WP-0021-T03 -status: todo +status: progress priority: high state_hub_task_id: "0ab44bd9-00d8-5470-ad45-7350e7868d0a" ``` @@ -87,6 +87,16 @@ history/merge cases and bypasses, missing scanner, malformed input and scanner failure. Record actual rejected/accepted push or required-check receipts. Local hook success is insufficient and this staged adapter alone does not scan history. +2026-10-12 read-only native baseline: railiance01 runs Forgejo 11.0.3. +All 22 reviewed repositories have only the upstream-generated receive-hook files, +matched by SHA256 to the v11.0.3 templates; no custom scanner hook is installed at +that boundary. Storage contains 165 repository directories, which still need +classification before being an admitted production denominator. Independent +Actions/branch-protection coverage and push acceptance remain unverified. Do not +replace generated dispatchers or enable arbitrary user hook editing to add the +control. Receipt: Custodian `forge-secret-detection-baseline.json`. No live +server mutation, credential access or synthetic push was performed. + ## Verify private finding-to-response handling ```task