25 lines
788 B
JSON
25 lines
788 B
JSON
{
|
|
"feature_id": "F-055",
|
|
"stage": "security_gate",
|
|
"agent": "security",
|
|
"ts": "2026-08-19T11:48:40Z",
|
|
"verdict": "APPROVED",
|
|
"checks": [
|
|
{
|
|
"name": "no_path_traversal_in_static",
|
|
"status": "PASS",
|
|
"detail": "static files served from public/uploads/<size>/<filename>; UUID-based filenames cannot escape"
|
|
},
|
|
{
|
|
"name": "no_secrets_in_thumbnails",
|
|
"status": "PASS",
|
|
"detail": "Thumbnails are pure image data, no metadata preserved"
|
|
},
|
|
{
|
|
"name": "sharp_processing_isolated",
|
|
"status": "PASS",
|
|
"detail": "sharp only reads image bytes and writes under thumbs/<width>/; no FS traversal beyond input filename"
|
|
}
|
|
],
|
|
"notes": "Static serving preserves the existing security model. No new attack surface."
|
|
} |