risk: report embedded backup WebDAV credential

Assistant: codex
Assistant-Model: gpt-5.6-sol
Assistant-Session: 01a02669-87ee-7a31-b111-edc95a16e0fa

findings/RISK-F-0010-embedded-backup-webdav-credential.md

@@ -0,0 +1,60 @@
+---
+id: RISK-F-0010
+type: finding
+title: "Forgejo backup source embeds a WebDAV credential default"
+status: open
+reported_by: railiance-platform
+reported_via: railiance-platform
+date_reported: "2026-08-23"
+system: railiance-platform
+environment: production
+fix_owner: railiance-platform
+fix_tracking: unset
+---
+
+# RISK-F-0010 — Forgejo backup source embeds a WebDAV credential default
+
+## What is true, as reported
+
+`railiance-platform/tools/cmd/forgejo-backup` line 13 assigns a literal default
+to `RAILIANCE_BACKUP_NC_TOKEN`. The credential value is deliberately omitted
+from this finding, along with any fingerprint, length, or copy.
+
+The literal is in repository history and can be recovered by anyone with access
+to affected clones or history. It was also surfaced in captured agent command
+output during an attended review on 2026-08-23, which expands the set of places
+that must be treated as potentially exposed.
+
+The value was not used in that operation and its current validity was not
+tested. The configured Nextcloud endpoint was independently observed to be a
+write-only file drop: metadata listing and reads were denied while the approved
+OpenBao-sourced credential could upload ciphertext. Therefore, the established
+risk is an embedded credential and possible unauthorized write or storage
+injection if it remains live; read access to existing backups is not
+established. The age recovery private key is separate and was not found in the
+script.
+
+## How it was found
+
+Found by source inspection while selecting the approved encrypted off-host
+snapshot lane for preparation-only scenario
+`WARDEN-WP-0027-T02-DRILL-20260822-01`. No attempt was made to authenticate
+with or probe the embedded value.
+
+## Suggested direction
+
+Suggestion, owned by `railiance-platform`:
+
+1. Revoke and regenerate the Nextcloud file-drop credential at the provider.
+2. Write the replacement only to the governed OpenBao lane
+   `platform/workloads/railiance/backup/offsite-lane` through a mode-0600 input
+   file, then securely remove the input.
+3. Remove the source-code default so backup execution fails closed unless the
+   value arrives through OpenBao or an explicit sanctioned environment.
+4. Review reachable Git history, CI and agent logs, and clones under the
+   applicable retention policy; do not reproduce the credential while doing so.
+5. Verify a ciphertext upload and restore after rotation, then clear any
+   exposure taint only with evidence.
+
+Risk Nexus owns severity, disclosure, escalation, and review cadence. This
+report intentionally does not assign them.