What five Strix security scans found, and what we did about it
Five scans on 28 October produced 63 distinct findings, 2 of them critical. Most are fixed in code; one is contained rather than solved, and a re-scan is next.
Sicherheitshärtung im Hintergrund. Nichts zu tun; ein Missbrauch von aussen wurde nicht festgestellt.
On 28 October we ran five Strix security scans, one against the code and four partly against the infrastructure. The raw reports held 108 findings. 63 were distinct: 2 critical, 4 high, 38 medium and 19 low.
Text version
Five scans, 63 distinct findings, fixed in code between 28 and 30 October, one contained, re-scan to follow.
The serious findings
Critical: a read-only member of a shared workspace could write to it through the command-line sync, and one design interface did not check who owned the chat it worked in. High: snapshot restore could follow shortcuts out of the workspace, the Docker export built customer bundles on the app host, derived tokens had a fallback key, and the editor proxy shared the app origin.
Was anything exploited?
We found no use from outside. No shared members existed on the live system, so the sync flaw had no victims. The foreign design runs in the logs came from one account inside the scan window. We attribute them to the scanner from timing and account; that is not proof.
Fixed and not yet fixed
The sync fix went live on 28 October around 14:00, the critical and high fixes around 15:50, and every other code fix on 30 October after 667 test suites passed. Tokens now carry a version per account, so each can be revoked alone. Keycloak client secrets were rotated on 2 November.
One finding is contained: the editor proxy sends stricter headers until it gets its own cookie-free origin. The Docker export is fixed: its probe build runs in an isolated gVisor sandbox on a worker, with no Docker socket, and the export is back on since 30 October. Host hardening is being finished. Next come mandatory MFA for admin accounts and a re-scan.