[VS-NfD] Maintain the residual-risk list #231

Closed
opened 2026-07-30 01:43:59 +02:00 by fable-5 · 4 comments
Collaborator

Plan reference: 20-massnahmenplan.md -> Phase 5
ADR: ADR 0019
Effort: S (1 AT)
Depends on: #226

Context

Naming what is deliberately left open is a credibility instrument. An
assessor who finds an undocumented gap distrusts the whole submission; one
who finds it already listed does not.

Current state

  • Deliberately unscheduled items are recorded in project documentation
    today (external search engine, signup admin approval, plugin network
    allowlist); items already identified in this entwurf that belong on the
    list: attachment content carries no internal marking (#212), plugin
    hash pinning deferred (#232), and whether the local-auth switch is
    runtime-flippable (#216).
  • From 10-ist-aufnahme.md: the IndexedDB copy on endpoints (I-25,
    apps/web/src/editor/use-collab-provider.ts:76 — survives a browser
    crash and for unsynced offline edits), page titles in digest mails
    (I-23), and the page_links.target_slug residue if #235 decides to keep
    it (I-24).

Acceptance criteria

  • Each entry states: the risk, why it is accepted, its compensating
    control, and who decided.
  • Entries from #212, #216, #232 and the git-history check in #198 are
    present.
  • Entries from 10-ist-aufnahme.md I-23, I-24 and I-25 are present.
  • The list is referenced from #226 and #230, and updated in the same PR
    whenever an issue closes with a knowingly open remainder.

Out of scope

Formal risk scoring, and the customer's own risk acceptance.

**Plan reference:** `20-massnahmenplan.md` -> Phase 5 **ADR:** ADR 0019 **Effort:** S (1 AT) **Depends on:** #226 ## Context Naming what is deliberately left open is a credibility instrument. An assessor who finds an undocumented gap distrusts the whole submission; one who finds it already listed does not. ## Current state - Deliberately unscheduled items are recorded in project documentation today (external search engine, signup admin approval, plugin network allowlist); items already identified in this entwurf that belong on the list: attachment content carries no internal marking (#212), plugin hash pinning deferred (#232), and whether the local-auth switch is runtime-flippable (#216). - From `10-ist-aufnahme.md`: the IndexedDB copy on endpoints (I-25, `apps/web/src/editor/use-collab-provider.ts:76` — survives a browser crash and for unsynced offline edits), page titles in digest mails (I-23), and the `page_links.target_slug` residue if #235 decides to keep it (I-24). ## Acceptance criteria - [ ] Each entry states: the risk, why it is accepted, its compensating control, and who decided. - [ ] Entries from #212, #216, #232 and the git-history check in #198 are present. - [ ] Entries from `10-ist-aufnahme.md` I-23, I-24 and I-25 are present. - [ ] The list is referenced from #226 and #230, and updated in the same PR whenever an issue closes with a knowingly open remainder. ## Out of scope Formal risk scoring, and the customer's own risk acceptance.
fable-5 added this to the M30 — VS-NfD: compliance documentation milestone 2026-07-30 01:43:59 +02:00
fable-5 added the
effort:S
area:docs
vs-nfd
labels 2026-07-30 01:43:59 +02:00
Author
Collaborator

One-time git-history secret check (issue #198, 2026-07-30) — for the residual-risk list:

  • .env files ever tracked in history: none — the only path matching .env* across all commits (git log --all --name-only) is deploy/compose/.env.example.
  • Obvious secret patterns across all lines ever added in history (git log --all -p): 0 hits for private-key blocks (-----BEGIN ... PRIVATE KEY-----), AWS access keys (AKIA...), GitHub tokens (ghp_...), GitLab tokens (glpat-...), Slack tokens (xox[baprs]-...).

Result: none found — no secret rotation required from repository history. Going forward the CI step 'No tracked .env files or secret material' (checks job, PR for #198) keeps both invariants.

Caveat for the list: the pattern set covers structured token formats; unstructured passwords committed as plain strings would not match a generic pattern and remain covered by review discipline.

**One-time git-history secret check (issue #198, 2026-07-30) — for the residual-risk list:** - `.env` files ever tracked in history: **none** — the only path matching `.env*` across all commits (`git log --all --name-only`) is `deploy/compose/.env.example`. - Obvious secret patterns across all lines ever added in history (`git log --all -p`): **0 hits** for private-key blocks (`-----BEGIN ... PRIVATE KEY-----`), AWS access keys (`AKIA...`), GitHub tokens (`ghp_...`), GitLab tokens (`glpat-...`), Slack tokens (`xox[baprs]-...`). Result: **none found** — no secret rotation required from repository history. Going forward the CI step 'No tracked .env files or secret material' (checks job, PR for #198) keeps both invariants. Caveat for the list: the pattern set covers structured token formats; unstructured passwords committed as plain strings would not match a generic pattern and remain covered by review discipline.
Author
Collaborator

Residual-risk entries from M24 (#234, #235):

  1. Digest mails carry page titles and actor names (decided in #234, PR #255): ACCEPTED for now. Rationale: there is no per-page classification marking yet to key a suppression on - that lands with ADR 0022 / M32 (#243-#246) and is revisited there; the copy is bounded since #234 (mail.outboxRetentionDays, default 30, daily mail-outbox-retention job deletes SENT and permanently FAILED rows); a VS-NfD reference configuration (#227) can leave SMTP unconfigured entirely, which suppresses all mail including digests.

  2. page_links rows whose target_slug points at a purged page (decided in #235, PR #256): KEPT as accepted residue. Rationale: the row is only the index of a wikilink whose text (slug = title) remains visible in the linking page's own content either way - content, content cache and the linking page's search index all keep the text, governed by that page's permissions and written by an author who could read the target at the time. Deleting the index row would remove nothing the system still shows while breaking the deliberate phantom-link re-resolution. Full reasoning: operations.md, purge section.

Residual-risk entries from M24 (#234, #235): 1. Digest mails carry page titles and actor names (decided in #234, PR #255): ACCEPTED for now. Rationale: there is no per-page classification marking yet to key a suppression on - that lands with ADR 0022 / M32 (#243-#246) and is revisited there; the copy is bounded since #234 (mail.outboxRetentionDays, default 30, daily mail-outbox-retention job deletes SENT and permanently FAILED rows); a VS-NfD reference configuration (#227) can leave SMTP unconfigured entirely, which suppresses all mail including digests. 2. page_links rows whose target_slug points at a purged page (decided in #235, PR #256): KEPT as accepted residue. Rationale: the row is only the index of a wikilink whose text (slug = title) remains visible in the linking page's own content either way - content, content cache and the linking page's search index all keep the text, governed by that page's permissions and written by an author who could read the target at the time. Deleting the index row would remove nothing the system still shows while breaking the deliberate phantom-link re-resolution. Full reasoning: operations.md, purge section.
Author
Collaborator

Residual risk from #212 (attachment marking), to be carried into the residual-risk register:

Attachment content carries no internal marking. The application marks attachment downloads externally - filename prefix VS-NfD_ and companion/.zip manifest - because writing markings into arbitrary binary formats would require rewriting those formats (ruled out by ADR 0019/0022). Consequence: a user who renames a downloaded file (or strips the companion) holds a classified binary with no visible marking. Mitigations in place: the web/PDF/office/ZIP channels all mark their representations internally (#206-#211); the download prefix and companion mark the egress moment; the upload warning/block (#213) makes the consequence explicit at intake. Accepted as documented residual risk (operations.md, section Classified attachment downloads).

Residual risk from #212 (attachment marking), to be carried into the residual-risk register: **Attachment content carries no internal marking.** The application marks attachment downloads externally - filename prefix VS-NfD_ and companion/.zip manifest - because writing markings into arbitrary binary formats would require rewriting those formats (ruled out by ADR 0019/0022). Consequence: a user who renames a downloaded file (or strips the companion) holds a classified binary with no visible marking. Mitigations in place: the web/PDF/office/ZIP channels all mark their representations internally (#206-#211); the download prefix and companion mark the egress moment; the upload warning/block (#213) makes the consequence explicit at intake. Accepted as documented residual risk (operations.md, section Classified attachment downloads).
fable-5 referenced this issue from a commit 2026-07-31 10:01:14 +02:00
fable-5 referenced this issue from a commit 2026-07-31 10:35:39 +02:00
Author
Collaborator

Done in commit 87c1c5e (PR #276, CI run 582 green, fast-forward merged on Stefan's standing merge instruction).

Evidence: docs/vs-nfd/90-restrisiken.md - nine entries, each with risk / why accepted / compensating control / decider: R-01 unmarked attachment content (#212), R-02 local auth not yet switchable incl. the open runtime-flippability question (#216), R-03 deferred plugin hash pinning (#232), R-04 the one-time git-history secret check with its pattern caveat (#198, protocol in the comments here), R-05 digest-mail titles (I-23, revisit M32), R-06 page_links slug residue (I-24), R-07 IndexedDB endpoint copy (I-25), R-08 deliberately unscheduled features, R-09 Site-Admin read bypass. Binding same-PR maintenance rule stated; referenced from the delimitation statement and consumed by the Grundschutz mapping.

Done in commit 87c1c5e (PR #276, CI run 582 green, fast-forward merged on Stefan's standing merge instruction). Evidence: docs/vs-nfd/90-restrisiken.md - nine entries, each with risk / why accepted / compensating control / decider: R-01 unmarked attachment content (#212), R-02 local auth not yet switchable incl. the open runtime-flippability question (#216), R-03 deferred plugin hash pinning (#232), R-04 the one-time git-history secret check with its pattern caveat (#198, protocol in the comments here), R-05 digest-mail titles (I-23, revisit M32), R-06 page_links slug residue (I-24), R-07 IndexedDB endpoint copy (I-25), R-08 deliberately unscheduled features, R-09 Site-Admin read bypass. Binding same-PR maintenance rule stated; referenced from the delimitation statement and consumed by the Grundschutz mapping.
Sign in to join this conversation.
No project
No Assignees
1 Participants
Notifications
Due Date
The due date is invalid or out of range. Please use the format 'yyyy-mm-dd'.

No due date set.

Dependencies

No dependencies set.

Reference: stwaidele/dorfteich#231
No description provided.