A risk management service.
tegwick
97762a4be0
First finding, and it establishes the record format by being one. Kept minimal on purpose - inventing a schema before there is a second finding to test it against would be designing in the dark. The substance: POST /v1/check and /v1/batch_check authenticate no caller, so any workload with network reach can assert any subject and any tenant and receive an authoritative allow from the estate's authorization oracle. Self-reported by flex-auth during their Tenancy Posture review, and their own note says they did not know they were carrying it. Severity, disclosure and escalation are left unset. Per INTENT this repo owns those and the reporter does not, and filling them in as the routing party would collapse the separation on the first record. Two things stated rather than assumed. Exposure depends on whether a default-deny NetworkPolicy fronts the service; flex-auth did not say, and I did not check, because that would be reporting on a system I do not own. And the disclosure question is genuinely live here - build mode is public-by-default, this is a live authorization bypass, and the controlled-disclosure mechanism this repo anticipates does not exist yet, so the choice today is publish or hold with nothing in between. Three related defects from the same review round are recorded as visible but not filed, since filing them was not asked for. All four were found by repos reading their own code against a ladder within a day of each other, and none was found by monitoring - which is itself a fact worth carrying into triage. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> |
||
|---|---|---|
| findings | ||
| INTENT.md | ||
| README.md | ||
risk-nexus
Risk register and regulatory intake for the estate. Serves
risk.coulomb.social. Owned by the-custodian.
Holds findings — security, architecture, operational, compliance — with a severity, an owner and a date; decides whether and when each is published; and decides which must reach the operator personally rather than sitting in a register.
It does not fix things: findings route to the repo that owns the defect. It
does not host: policy-nexus is the publication surface.
- Intent:
INTENT.md