Description
Close every validated finding from the repository-wide Codex Security scan of revision df3b51fe58b8c540e7d18b38b3319ae08f41ef5c while preserving legitimate chart, receiver, exporter, console, capture, and telemetry behavior.
Acceptance Criteria
- #1 All 20 validated scan findings are either fixed with regression coverage or proven already safe from current repository evidence.
- #2 Resource-amplification paths enforce defensible byte, count, concurrency, and time budgets before expensive work or retention.
- #3 Authentication, admission, transport, redirect, file-permission, and chart-serialization boundaries are enforced consistently across all affected entry points.
- #4 Original malicious triggers no longer reproduce and legitimate controls continue to work.
- #5 Relevant focused tests, repository gates, CodeRabbit review, and the required independent security review pass.
Definition of Done
- #1 make lint
- #2 make test
- #3 make check-public-ips
- #4 make docs-check
- #5 make grafana-check
Implementation Plan
- Harden Helm argv serialization and API capture body/file boundaries.
- Bound NetFlow decode/template/correlator/log amplification.
- Bound capture, metric-label, response-cache, and GeoIP retained work.
- Enforce Zenarmor/syslog transport, connection, and write admission.
- Bound console/auth/device-fetch work and make the sensitive console opt-in.
- Reject OTLP redirects and regenerate affected documentation.
- Run CodeRabbit, independent bypass review, repository gates, write the scan fix report, finalize, commit, and push.
Implementation Notes
Implemented all 20 scan remediations across chart serialization, protocol/resource budgets, admission controls, secure capture I/O, cache bounds, OTLP redirect/TLS handling, and private-by-default console configuration. Added focused regressions for malicious triggers and legitimate controls. Fresh boundary and bypass reviews completed; all blocking observations and actionable lower-severity gaps were fixed. The optional short-TTL console cache suggestion was not needed because the opt-in route now has hard concurrency, response-size, and write-time bounds. CodeRabbit completed under the repository organisation plan and all findings were fixed. Verification passed: make lint (0 issues), make test, make check-public-ips (21 self-tests; 1312 files), make docs-check, make grafana-check (1046/1046 metrics; 80 manifests), plus explicit vendored exporter-toolkit web tests.
Final Summary
Fixed and regression-tested all 20 validated Codex Security findings. Wrote the canonical scan fix report to the scan artifact directory, passed all repository and review gates, and preserved documented compatibility overrides and ordinary valid traffic.