fix(security): harden saved-credential, proxy egress, and keyless-mint paths from the release audit by waleedlatif1 · Pull Request #9865 · simstudioai/sim

waleedlatif1 · 2026-11-10T23:41:06Z

Summary

Verified fixes from the audit of the current staging→main release, scoped to the items this PR owns.

Security

POST /api/auth/oauth/token refuses session callers resolving a saved service-account credential (403 SERVICE_ACCOUNT_SESSION_FORBIDDEN). Saved secrets resolve only in-process (internal JWT). OAuth, managed OAuth, and internal-JWT callers are unchanged; the only callers are the route and resolveExecutorCredentialToken (always INTERNAL_JWT)
Egress through HTTP(S)_PROXY: a hostname is refused when any resolved record is blocked (requireEveryAddress), since the proxy re-resolves and may dial the blocked one. IP literals and NO_PROXY hosts are unchanged
mintWorkloadIdentityToken refuses a subject that does not belong to the minting owner (assertWorkloadIdentitySubjectOwner), covering AWS and Databricks in one place
Twilio list calls: recordings URLs must resolve on https://api.twilio.com (saved Basic auth rides along); per-call recordings fetches are bounded to 10 in flight
refuseUnsafeTypedUrl refuses the single-slash https:/host form, like normalizeHttpBaseUrl; Dynatrace /api/v1|v2 suffix strips are case-insensitive

Correctness

sim-setup reset refuses when Docker is installed but unreachable, instead of archiving env files while the volumes survive

Cleanups

deployments.ts uses the shared requireMutableWorkflow

Docs

sim-setup README: dev-mode loopback binding and how to rebind older containers, no port 5432 requirement for Compose, reset order
Helm: writable emptyDir mounts for read-only root (/tmp, .next/cache, .next/server/route-cache)
Networking: AWS proxy row (STS inherits, SSO does not); every-address refusal under a proxy
GitLab permission CSV describe names the 10 MiB request body limit (OpenAPI regenerated)

The crawl-depth and proxied response-cap fixes (and the CONTRIBUTING update) landed in #9860. #9859 owns the Databricks response caps, #9858 the workflow middleware and route-policies cleanups, and #9862 Firecrawl search.

Type of Change

Bug fix
Security fix
Documentation

Testing

Each security regression test was run against the code with its guard removed and failed, then passed with the guard restored:

app/api/auth/oauth/token/route.test.ts: a session caller with a service-account credential gets 403 and no secret; internal-JWT resolution and session OAuth still return tokens
lib/core/network/environment-proxy.server.test.ts: a name resolving to 93.184.216.34 + 169.254.169.254 is refused with zero proxy tunnels, while all-public records still tunnel
lib/credentials/workload-identity/issuer.test.ts: minting for another workspace, an organization, or a lookalike id (ws-10) throws
lib/credentials/token-service-accounts/validators/http.test.ts: refuseUnsafeTypedUrl('https:/evil.com') throws
tools/twilio_voice/list_calls.test.ts: @evil.test/x and absolute off-origin paths never fetch off Twilio; concurrency peaks at 10
packages/sim-setup/src/lifecycle.test.ts: with Docker unreachable, reset rejects and leaves the env file unarchived

Also ran the other touched test files (268 tests), bun run lint, check:source-conventions, check:comment-hygiene, check:test-patterns, check:utils, check:api-validation:strict, check:boundaries, check:explicit-any (baseline regenerated), check:openapi, check:cli-api, check:mcp-operations, check:cli-docs, check:v2-route-table, check:docs, check:tool-metadata, and the pre-push type-check.

Checklist

Code follows project style guidelines
Self-reviewed my changes
Tests added/updated and passing (new tests pass the test-audit authoring gate)
No new warnings introduced
I confirm that I have read and agree to the terms outlined in the Contributor License Agreement (CLA)

…p paths from the release audit - Refuse session callers resolving saved service-account secrets on POST /api/auth/oauth/token - Refuse a proxied hostname when any resolved record is blocked (the proxy re-resolves) - Apply the response cap to every body, not only decoded ones (undici's http proxy wrapper ignores maxResponseSize) - Bind workload-identity subjects to their owner at mint time - Bound Databricks token/identity JSON reads; refuse single-slash https:/ in typed URLs; case-insensitive Dynatrace /api/vN strip - Twilio recordings: stay on the Twilio API origin and bound fetch concurrency - Firecrawl: count crawl maxDepth below the start URL; stop sending unused search sources - sim-setup reset refuses when Docker is installed but unreachable - Remove the dead requireDeployment branch from workflow access middleware; reuse requireMutableWorkflow; move a misplaced TSDoc - Docs: CONTRIBUTING setup via sim-setup, sim-setup README, Helm read-only-root mounts, proxy and NO_PROXY behavior, GitLab CSV body limit

vercel · 2026-11-10T23:41:11Z

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
docs	Ready	Preview	Nov 11, 2026 12:12am UTC

greptile-apps · 2026-11-10T23:44:44Z

Confidence Score: 5/5

[High impact] The PR appears safe to merge; no new actionable issues were found.

Summary

This PR tightens saved-secret access, proxy destination checks, workload-identity subjects, and Twilio recordings requests.

Session callers cannot resolve saved service-account secrets.
Proxied requests require every DNS answer to pass the egress check.
Workload tokens are minted only for the matching credential owner.
Twilio recording lookups stay on Twilio and run ten at a time.
Typed service-account URLs reject single-slash HTTP schemes.
Dynatrace URL cleanup recognizes uppercase API suffixes.
sim-setup reset stops when Docker is installed but unreachable.
Setup docs explain loopback-only dev ports and older container rebinding.
Helm read-only-root guidance names the writable Next.js cache paths.
GitLab permission docs state the combined 10 MiB request-body limit.
Workflow deployments reuse the shared mutability check.

_{Reviews (3) · Last reviewed commit: "fix(security): stop queued Twilio record..." · Reviewed by Greptile}

cubic-dev-ai

1 issue found across 39 files

Confidence score: 3/5

lifecycle.ts can archive environment files when Docker is unavailable, leaving volumes behind with unusable credentials. Block reset whenever Docker is unreachable.

Prompt for AI agents (unresolved issues)


Check if these issues are valid — if so, understand the root cause of each and fix them. When an issue isn't valid or won't be fixed in this PR, reply in its thread with the reason and then resolve the thread. If appropriate, use sub-agents to investigate and fix each issue separately.


<file name="packages/sim-setup/src/lifecycle.ts">

<violation number="1" location="packages/sim-setup/src/lifecycle.ts:597">
P2: This guard still archives environment files when the Docker CLI is absent, because `executableExists('docker')` is false; block reset whenever Docker is unreachable so volumes cannot be left behind with unusable credentials.</violation>
</file>

_{Turn on auto-fix | Re-trigger cubic}

Drops the response cap and crawl depth (landed in #9860), CONTRIBUTING (#9860), Firecrawl search sources (on hold), Databricks JSON caps (#9859), and the workflow middleware and route-policies cleanups (#9858). Drops the NO_PROXY entry-syntax docs line (owned by a separate NO_PROXY change). Generated files regenerated on current staging.

waleedlatif1 · 2026-11-10T23:50:17Z

Release-audit coordination note for this PR's owner (from the session that owns #9864, which dropped its networking.mdx edits in favor of this PR):

Please consider adding one sentence to "Proxying guarded requests" in apps/docs/content/docs/platform/self-hosting/networking.mdx: the proxy's own egress policy must refuse private, loopback, and link-local ranges (including 169.254.169.254) and internal DNS zones. A proxied request can't keep the app's IP pinning, because the proxy re-resolves the hostname (a short-TTL rebind or split-horizon DNS). requireEveryAddress narrows this but doesn't remove it. The NO_PROXY doc line belongs to sim-9c's branch per the shared owner table.

waleedlatif1 · 2026-11-10T23:51:48Z

@greptile

waleedlatif1 · 2026-11-10T23:51:49Z

@cubic-dev-ai review this PR

cubic-dev-ai · 2026-11-10T23:51:54Z

@cubic-dev-ai review this PR

@waleedlatif1 I have started the AI code review. It will take a few minutes to complete.

cubic-dev-ai

All reported issues were addressed across 24 files

_{Requires human review: Auto-approval blocked because this review re-detected 1 unresolved issue already reported by Cubic.

Turn on auto-fix | Re-trigger cubic}

…hardening

…token-route auth mocks, bump chart - Twilio list calls takes the run's signal: queued recordings requests stop once it aborts, and fetch receives it - Token route tests type the hybrid-auth mock through the real AuthResult and pass a route context - Chart version 1.11.13 for the README and helper comment changes

waleedlatif1 · 2026-11-11T00:08:09Z

@greptile

waleedlatif1 · 2026-11-11T00:08:10Z

@cubic-dev-ai review this PR

cubic-dev-ai · 2026-11-11T00:08:16Z

@cubic-dev-ai review this PR

@waleedlatif1 I have started the AI code review. It will take a few minutes to complete.

cubic-dev-ai

No issues found across 25 files

Confidence score: 5/5

Automated review surfaced no issues in the provided summaries.
No files require special attention.

_{Turn on auto-fix | Re-trigger cubic}

greptile-apps Bot reviewed Nov 10, 2026

View reviewed changes

Comment thread apps/sim/tools/twilio_voice/list_calls.ts Resolved

vercel Bot deployed to Preview November 10, 2026 23:45

View deployment

waleedlatif1 mentioned this pull request Nov 10, 2026

fix(release): redact deploy keys, check operation-backed tools in the saved-credential contract, and drop SDK copy #9864

Merged

6 tasks done

cubic-dev-ai Bot reviewed Nov 10, 2026

View reviewed changes

Comment thread apps/sim/tools/firecrawl/crawl.ts Resolved

Comment thread packages/sim-setup/src/lifecycle.ts Resolved

Comment thread apps/sim/tools/twilio_voice/list_calls.ts Resolved

waleedlatif1 changed the title ~~fix(security): harden saved-credential, proxy egress, and response-cap paths from the release audit~~ fix(security): harden saved-credential, proxy egress, and keyless-mint paths from the release audit Nov 10, 2026

cubic-dev-ai Bot reviewed Nov 10, 2026

View reviewed changes

vercel Bot deployed to Preview November 10, 2026 23:57

View deployment

waleedlatif1 mentioned this pull request Nov 11, 2026

fix(release): keyless subject uniqueness, NO_PROXY IPv6/CIDR, proxied boot secret, and remaining audit follow-ups #9866

Merged

7 tasks done

waleedlatif1 added 2 commits November 10, 2026 16:04

Merge remote-tracking branch 'origin/staging' into fix/release-audit-…

52680e2

…hardening

cubic-dev-ai Bot reviewed Nov 11, 2026

View reviewed changes

vercel Bot deployed to Preview November 11, 2026 00:12

View deployment

waleedlatif1 merged commit 411cc9c into staging Nov 11, 2026
89 checks passed

waleedlatif1 deleted the fix/release-audit-hardening branch November 11, 2026 00:28

waleedlatif1 mentioned this pull request Nov 11, 2026

v0.9.53: saved credentials with keyless AWS and Databricks OIDC, read-only API keys, workspace members endpoint, trigger health and pinned versions, proxy support, search source permissions #9871

Merged

Conversation

waleedlatif1 commented Nov 10, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Type of Change

Testing

Checklist

Uh oh!

vercel Bot commented Nov 10, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

greptile-apps Bot commented Nov 10, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Confidence Score: 5/5

Summary

Uh oh!

Uh oh!

cubic-dev-ai Bot left a comment • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

waleedlatif1 commented Nov 10, 2026

Uh oh!

waleedlatif1 commented Nov 10, 2026

Uh oh!

waleedlatif1 commented Nov 10, 2026

Uh oh!

cubic-dev-ai Bot commented Nov 10, 2026

Uh oh!

cubic-dev-ai Bot left a comment • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

waleedlatif1 commented Nov 11, 2026

Uh oh!

waleedlatif1 commented Nov 11, 2026

Uh oh!

cubic-dev-ai Bot commented Nov 11, 2026

Uh oh!

cubic-dev-ai Bot left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

This branch was successfully deployed

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

waleedlatif1 commented Nov 10, 2026 •

edited

Loading

vercel Bot commented Nov 10, 2026 •

edited

Loading

greptile-apps Bot commented Nov 10, 2026 •

edited

Loading

cubic-dev-ai Bot left a comment •

edited

Loading

cubic-dev-ai Bot left a comment •

edited

Loading