[VS-NfD] Maintain the residual-risk list #231
Labels
No Label
area:auth
area:docs
area:export
area:ops
area:storage
area:supply-chain
auth
backend
blocked
collab
deployment
docs
effort:L
effort:M
effort:S
frontend
plugins
qa
vs-nfd
vs-nfd:blocker
No Milestone
No project
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies
No dependencies set.
Reference: stwaidele/dorfteich#231
Loading…
Reference in New Issue
Block a user
No description provided.
Delete Branch "%!s()"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
Plan reference:
20-massnahmenplan.md-> Phase 5ADR: ADR 0019
Effort: S (1 AT)
Depends on: #226
Context
Naming what is deliberately left open is a credibility instrument. An
assessor who finds an undocumented gap distrusts the whole submission; one
who finds it already listed does not.
Current state
today (external search engine, signup admin approval, plugin network
allowlist); items already identified in this entwurf that belong on the
list: attachment content carries no internal marking (#212), plugin
hash pinning deferred (#232), and whether the local-auth switch is
runtime-flippable (#216).
10-ist-aufnahme.md: the IndexedDB copy on endpoints (I-25,apps/web/src/editor/use-collab-provider.ts:76— survives a browsercrash and for unsynced offline edits), page titles in digest mails
(I-23), and the
page_links.target_slugresidue if #235 decides to keepit (I-24).
Acceptance criteria
control, and who decided.
present.
10-ist-aufnahme.mdI-23, I-24 and I-25 are present.whenever an issue closes with a knowingly open remainder.
Out of scope
Formal risk scoring, and the customer's own risk acceptance.
One-time git-history secret check (issue #198, 2026-07-30) — for the residual-risk list:
.envfiles ever tracked in history: none — the only path matching.env*across all commits (git log --all --name-only) isdeploy/compose/.env.example.git log --all -p): 0 hits for private-key blocks (-----BEGIN ... PRIVATE KEY-----), AWS access keys (AKIA...), GitHub tokens (ghp_...), GitLab tokens (glpat-...), Slack tokens (xox[baprs]-...).Result: none found — no secret rotation required from repository history. Going forward the CI step 'No tracked .env files or secret material' (checks job, PR for #198) keeps both invariants.
Caveat for the list: the pattern set covers structured token formats; unstructured passwords committed as plain strings would not match a generic pattern and remain covered by review discipline.
Residual-risk entries from M24 (#234, #235):
Digest mails carry page titles and actor names (decided in #234, PR #255): ACCEPTED for now. Rationale: there is no per-page classification marking yet to key a suppression on - that lands with ADR 0022 / M32 (#243-#246) and is revisited there; the copy is bounded since #234 (mail.outboxRetentionDays, default 30, daily mail-outbox-retention job deletes SENT and permanently FAILED rows); a VS-NfD reference configuration (#227) can leave SMTP unconfigured entirely, which suppresses all mail including digests.
page_links rows whose target_slug points at a purged page (decided in #235, PR #256): KEPT as accepted residue. Rationale: the row is only the index of a wikilink whose text (slug = title) remains visible in the linking page's own content either way - content, content cache and the linking page's search index all keep the text, governed by that page's permissions and written by an author who could read the target at the time. Deleting the index row would remove nothing the system still shows while breaking the deliberate phantom-link re-resolution. Full reasoning: operations.md, purge section.
Residual risk from #212 (attachment marking), to be carried into the residual-risk register:
Attachment content carries no internal marking. The application marks attachment downloads externally - filename prefix VS-NfD_ and companion/.zip manifest - because writing markings into arbitrary binary formats would require rewriting those formats (ruled out by ADR 0019/0022). Consequence: a user who renames a downloaded file (or strips the companion) holds a classified binary with no visible marking. Mitigations in place: the web/PDF/office/ZIP channels all mark their representations internally (#206-#211); the download prefix and companion mark the egress moment; the upload warning/block (#213) makes the consequence explicit at intake. Accepted as documented residual risk (operations.md, section Classified attachment downloads).
Done in commit
87c1c5e(PR #276, CI run 582 green, fast-forward merged on Stefan's standing merge instruction).Evidence: docs/vs-nfd/90-restrisiken.md - nine entries, each with risk / why accepted / compensating control / decider: R-01 unmarked attachment content (#212), R-02 local auth not yet switchable incl. the open runtime-flippability question (#216), R-03 deferred plugin hash pinning (#232), R-04 the one-time git-history secret check with its pattern caveat (#198, protocol in the comments here), R-05 digest-mail titles (I-23, revisit M32), R-06 page_links slug residue (I-24), R-07 IndexedDB endpoint copy (I-25), R-08 deliberately unscheduled features, R-09 Site-Admin read bypass. Binding same-PR maintenance rule stated; referenced from the delimitation statement and consumed by the Grundschutz mapping.