risk: report embedded backup WebDAV credential

Assistant: codex
Assistant-Model: gpt-5.6-sol
Assistant-Session: 01a02669-87ee-7a31-b111-edc95a16e0fa

REGISTER.md

@@ -1,20 +1,21 @@
 # Register
 
-Generated by `tools/register_index.py` from `findings/`. Do not edit by hand. Last built 2026-08-21.
+Generated by `tools/register_index.py` from `findings/`. Do not edit by hand. Last built 2026-08-23.
 
-7 live of 9 findings; 3 notes below the floor.
+8 live of 10 findings; 3 notes below the floor.
 
 ## Findings
 
 | ID | Finding | System | Severity | Disclosure | Escalation | Fix owner | Status | Cadence | Next check |
 | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- |
+| [RISK-F-0010](findings/RISK-F-0010-embedded-backup-webdav-credential.md) | Forgejo backup source embeds a WebDAV credential default | railiance-platform | unset | unset | unset | railiance-platform | open | instant (0) | — |
 | [RISK-F-0009](findings/RISK-F-0009-openbao-deny-set-covers-a-third-of-high-risk-lanes.md) | agent-high-risk-boundary denies 6 of 17 high-risk lanes; the direct bao path is unprotected for the rest | railiance-platform | **high** | embargoed | none | railiance-platform | open | instant (0) | **due** |
 | [RISK-F-0008](findings/RISK-F-0008-audit-retention-legal-basis-assumed.md) | The legal basis for retaining audit facts against an erasure request has been assumed, never established | audit-core | medium | public | **answered** (t2, answered) | risk-nexus | accepted | instant (0) | **due** |
-| [RISK-F-0007](findings/RISK-F-0007-unverified-tenant-boundary.md) | No consumer's tenant boundary is verified anywhere | estate | **high** | embargoed | **answered** (t4, assigned) | per-consumer, on request | accepted | 1h (1) | 2026-08-21 08:32Z |
+| [RISK-F-0007](findings/RISK-F-0007-unverified-tenant-boundary.md) | No consumer's tenant boundary is verified anywhere | estate | **high** | embargoed | **answered** (t4, assigned) | per-consumer, on request | accepted | 1h (1) | **due** |
 | [RISK-F-0006](findings/RISK-F-0006-apps-pg-no-backup-configured.md) | apps-pg has no backup configured at all: R0 means no recovery | railiance-platform | **high** | public | **answered** (t3, answered) | railiance-platform | fixed | instant (0) | **due** |
 | [RISK-F-0005](findings/RISK-F-0005-audit-core-unfiltered-read-path.md) | audit-core read path applies no tenant filter; the bound is deployment, not code | audit-core | medium | public | none | audit-core | mitigated | instant (0) | **due** |
 | [RISK-F-0004](findings/RISK-F-0004-tenant-engine-unfiltered-event-read.md) | tenant-engine events() returns the entire event log unfiltered | tenant-engine | medium | embargoed | none | tenant-engine | open | instant (0) | **due** |
-| [RISK-F-0003](findings/RISK-F-0003-ops-warden-read-boundary-ungraded-lanes.md) | ops-warden agent read-boundary does not fire on ungraded catalog lanes | ops-warden | medium | embargoed | none | ops-warden | mitigated | 8h (2) | 2026-08-21 14:32Z |
+| [RISK-F-0003](findings/RISK-F-0003-ops-warden-read-boundary-ungraded-lanes.md) | ops-warden agent read-boundary does not fire on ungraded catalog lanes | ops-warden | medium | embargoed | none | ops-warden | mitigated | 8h (2) | **due** |
 | [RISK-F-0002](findings/RISK-F-0002-ops-warden-sign-ungated.md) | ops-warden signs SSH certificates with no authorization decision, and its unblock is now unsafe | ops-warden | medium | embargoed | **withdrawn** (t6, withdrawn-hazard-window-closed) | ops-warden | open | instant (0) | **due** |
 | [RISK-F-0001](findings/RISK-F-0001-flex-auth-unauthenticated-check.md) | flex-auth /v1/check authenticates no caller | flex-auth | **high** | public | **withdrawn** (t1, withdrawn-before-sending) | flex-auth | fixed | instant (0) | **due** |
 

findings/RISK-F-0010-embedded-backup-webdav-credential.md

@@ -0,0 +1,60 @@
+---
+id: RISK-F-0010
+type: finding
+title: "Forgejo backup source embeds a WebDAV credential default"
+status: open
+reported_by: railiance-platform
+reported_via: railiance-platform
+date_reported: "2026-08-23"
+system: railiance-platform
+environment: production
+fix_owner: railiance-platform
+fix_tracking: unset
+---
+
+# RISK-F-0010 — Forgejo backup source embeds a WebDAV credential default
+
+## What is true, as reported
+
+`railiance-platform/tools/cmd/forgejo-backup` line 13 assigns a literal default
+to `RAILIANCE_BACKUP_NC_TOKEN`. The credential value is deliberately omitted
+from this finding, along with any fingerprint, length, or copy.
+
+The literal is in repository history and can be recovered by anyone with access
+to affected clones or history. It was also surfaced in captured agent command
+output during an attended review on 2026-08-23, which expands the set of places
+that must be treated as potentially exposed.
+
+The value was not used in that operation and its current validity was not
+tested. The configured Nextcloud endpoint was independently observed to be a
+write-only file drop: metadata listing and reads were denied while the approved
+OpenBao-sourced credential could upload ciphertext. Therefore, the established
+risk is an embedded credential and possible unauthorized write or storage
+injection if it remains live; read access to existing backups is not
+established. The age recovery private key is separate and was not found in the
+script.
+
+## How it was found
+
+Found by source inspection while selecting the approved encrypted off-host
+snapshot lane for preparation-only scenario
+`WARDEN-WP-0027-T02-DRILL-20260822-01`. No attempt was made to authenticate
+with or probe the embedded value.
+
+## Suggested direction
+
+Suggestion, owned by `railiance-platform`:
+
+1. Revoke and regenerate the Nextcloud file-drop credential at the provider.
+2. Write the replacement only to the governed OpenBao lane
+   `platform/workloads/railiance/backup/offsite-lane` through a mode-0600 input
+   file, then securely remove the input.
+3. Remove the source-code default so backup execution fails closed unless the
+   value arrives through OpenBao or an explicit sanctioned environment.
+4. Review reachable Git history, CI and agent logs, and clones under the
+   applicable retention policy; do not reproduce the credential while doing so.
+5. Verify a ciphertext upload and restore after rotation, then clear any
+   exposure taint only with evidence.
+
+Risk Nexus owns severity, disclosure, escalation, and review cadence. This
+report intentionally does not assign them.