# Session 0030.0 — Transcript > Date: 2026-05-28 > Start: 2026-05-28T16-12 (PST implied) > End: 2026-05-28T17-39 (PST implied) > Subject: Security-audit-0026 remediation — flotilla-owned fixes + live GCP/VM hardening > Status: **FINALIZED.** > Sanitization note: this transcript is published to the public > `wiggleverse/ohm-session-history`. Because several audit findings were > still **live and unpatched** on production at session end (they belong to > a parallel, not-yet-deployed branch — see "Coordination" below), this > record deliberately references findings by **ID and general category > only** and contains **no exploit sketches or step-by-step reproduction**. > The full-detail audit (`SECURITY-AUDIT-0026-2026-05-28.md`) lives locally > in `~/git/ohm-infra`, which is not a git repository, and was never > published. No secret bytes appear here (§3 invariant 1). --- ## Launch prompt > full remediation of security report at ~/git/ohm-infra The "security report" is `SECURITY-AUDIT-0026-2026-05-28.md` (produced by the parallel audit session 0026): 1 Critical, 1 High, 5 Medium, 9 Low, 6 Info findings spanning three surfaces — the **rfc-app** codebase, the **flotilla** CLI (this repo), and the **live GCP/VM** deployment. --- ## What this session settled Session 0030 took the **flotilla-owned findings** and the **live GCP/VM findings that live in no repo**, applied + verified them, and merged + deployed the flotilla changes. The rfc-app/nginx/systemd findings were left to a parallel in-flight session (see Coordination). Net for OHM: the VM is materially hardened and the operator CLI has three defense-in- depth improvements; the application-layer findings remain pending that other session's release. ## The "did we leak the audit?" scare (resolved: NO) Mid-session the operator flagged that a transcript containing the audit might have been pushed to the public repo before an internet drop. I froze remediation and verified the **entire git history** of `wiggleverse/ohm-session-history` (fresh clone, all branches, `git log -S` for audit-unique strings): - Audit session 0026 published **only its 454-byte placeholder** — its full transcript was never pushed (the publish push is atomic; it failed on the internet drop, leaving only the start-gesture placeholder). - **Zero** audit-unique strings appear in any commit, ever. - The audit file itself lives only in local `~/git/ohm-infra` (not a git repo) — never committed anywhere. Verdict: nothing leaked. The real containment for the audit's value (an exploit roadmap) is shipping the fixes, which is what the session then continued doing. ## Coordination — the rfc-app remediation is owned elsewhere On inspecting `/Users/benstull/git/rfc-app` I found branch `feature/v0.25.0-security-hardening` already checked out with a large **uncommitted** remediation (a parallel live session, 0027 or 0029). It covers the rfc-app application findings, the nginx server block, and the systemd unit. Editing rfc-app would have clobbered another session's live work, so — with the operator — Session 0030 explicitly scoped to: - **flotilla repo** fixes (no overlap), and - **live GCP/VM ops** that exist in no repo. The operator chose this division (and chose to perform the live ops this session, and to defer SSH-scoping to a proper IAP rollout). ## Work performed ### Flotilla repo (PR #1 — merged) Branch `session-0030/flotilla-security-hardening` → **PR #1**, merged to `main` (merge commit `7b32a46`). 161 tests pass. - **L1** — the live secret redactor is threaded into `_PhaseRunner` and now scrubs **both** the success and failure phase-`detail` paths before they are persisted to `deploys.phases` / surfaced to the operator (previously only the separate `error_summary` was scrubbed). Test extended to assert no secret survives in any persisted phase detail. (This fix was already present in the working tree at session start; Session 0030 verified, tested, and landed it.) - **I6** — `redact_live` now matches several decodings of the same secret bytes (utf-8/replace, surrogateescape, latin-1) so a non-ASCII secret that surfaced via a different decode path than the needle still redacts. Match only ever redacts more, never less. Residual byte- boundary limitation documented honestly (moot for ASCII/UTF-8 secrets). - **L9** — `ssh.py` no longer leans on `--quiet`'s blanket first-connect host-key accept; it adds `StrictHostKeyChecking=accept-new`, which still connects to genuinely-new hosts non-interactively but **refuses a changed key**. Full first-connect TOFU removal remains the §19.2 IAP item. - **I5** — `overlay set` warns (does not block) when a key name carries an unambiguous secret word, nudging toward `secret bind`/`secret set`. Deliberately does not match generic `*_KEY`/`*_API_KEY`, so public site keys don't train the operator to ignore the warning. After merge, a clean idempotent redeploy of the current pin (v0.26.0) exercised the hardened flotilla code end-to-end: **`deploys.id=35`**, all 9 phases ok, health verified in 5.0s. ### Live GCP/VM ops (project `wiggleverse-ohm`, VM `ohm-rfc-app`) - **M3** — the SQLite data directory was world-traversable and the DB (plus its WAL/SHM sidecars) world-readable. Tightened the **directory to `750`** (the robust containment — closes world access regardless of per-file mode regression) and the files to **`640`**. Verified to survive both a full VM reboot and a deploy-triggered service restart (sqlite preserves the main DB's mode on its sidecars). Also discovered and **secured** (but did not delete) a set of orphaned `ohm-app.db\r*` files — stale copies left by the historical CRLF path bug; flagged to the operator for deletion after confirmation. - **L5** — deleted the dead `default-allow-rdp` firewall rule (3389 is unused surface on Linux). SSH-from-anywhere left in place by operator decision; the right fix is an IAP rollout (§19.2), not fragile IP scoping. - **L6** — created a dedicated least-privilege runtime service account (`ohm-rfc-app-vm@…`) with logging+monitoring writer only (the app reads its config from `.env` at deploy time, so **no** Secret Manager access is needed on the VM), and swapped the VM off the default compute SA. - **L7** — enabled Shielded-VM **Secure Boot** (boot disk confirmed UEFI-compatible first; vTPM + integrity monitoring were already on). L6 + L7 were applied in a single VM stop/start window (~15s of downtime), after confirming no deploy was in flight. All four verified intact after the later deploy. ### Config verification (audit action item 5) Read the live `.env` **variable names** only (no values): - `TURNSTILE_REQUIRED="true"` — confirmed (mitigates the OTC abuse Low). - `GITEA_WEBHOOK_SECRET` — present (Gitea webhook authenticated). - **`WEBHOOK_EMAIL_BOUNCE_SECRET` — absent.** This confirms M5 as a live config gap (the bounce webhook is currently unauthenticated). Handed to the operator with an operator-run secret gesture (never request/echo secret bytes in-conversation — §3 conversation-layer corollary). The operator will bind it and redeploy as a follow-up. ## Friction / dead-ends (kept honest) - The first `chmod 640 …/data/*` failed: having just set the directory to `750`, the non-root SSH login user could no longer list it to expand the glob. Re-ran the file chmod under `sudo sh -c` so root expanded it. - After merging PR #1, `git checkout main && git pull` did **not** fast-forward (local `main` had no upstream tracking), so the working tree briefly reverted to pre-fix code. Recovered with `git fetch && git merge --ff-only origin/main` and set the upstream. No work lost (the fixes were safe in the merge commit). ## Findings status at session end | Owner | Findings | Status | | --- | --- | --- | | **0030 (flotilla)** | L1, I6, L9, I5 | **Done** — merged (PR #1) + deployed | | **0030 (live VM/GCP)** | M3, L5(RDP), L6, L7 | **Done** — applied + verified | | **Operator follow-up** | M5 (config bind), `*.db\r` cleanup, systemd `UMask=0077` | Flagged with gestures | | **Deferred** | L5 (SSH 0.0.0.0/0 → IAP §19.2) | By operator decision | | **Parallel v0.25.0 branch** | C1, H1, M1, M2, M4, L2, L3, L4, L8, I1, I3, I4 | **Pending** — uncommitted, **not yet deployed** (still live on prod) | ## Cross-references - flotilla PR #1 (`wiggleverse/ohm-rfc-app-flotilla`), merge `7b32a46`. - OHM deploy `deploys.id=35`, v0.26.0 (idempotent redeploy exercising the hardened flotilla). - GCP: VM `ohm-rfc-app` / `us-central1-a` / `wiggleverse-ohm`; new SA `ohm-rfc-app-vm@wiggleverse-ohm.iam.gserviceaccount.com`; deleted firewall rule `default-allow-rdp`. - Source audit: `~/git/ohm-infra/SECURITY-AUDIT-0026-2026-05-28.md` (local only — never published). --- ## Operating instructions for the next session The application-layer security work is the open thread. Concretely: 1. **Ship v0.25.0.** The `feature/v0.25.0-security-hardening` branch in rfc-app holds the application + nginx + systemd remediation (C1 XSS sanitizer, the auth-verify rate-limit/lockout, the device-trust lookup fix, security headers, cookie hardening, the bounce-webhook `_required` guard, etc.). It is **uncommitted and undeployed**, which means the audit's **Critical (C1)** and other findings are **still live on production**. This is the highest priority: confirm/finish the branch, commit, release as v0.25.0, bump `ohm-rfc/.rfc-app-version`, and deploy via flotilla. Coordinate with whichever session owns that branch (was 0027/0029) before touching it. 2. **M5 config** — the operator intends to bind `WEBHOOK_EMAIL_BOUNCE_SECRET` (Secret Manager + `flotilla secret bind` + provider-side config) and redeploy. The code-side `_required` guard rides along in v0.25.0. 3. **systemd `UMask=0077`** — add to rfc-app's `deploy/systemd/rfc-app.service` (belt-and-suspenders on top of the `750` data dir). 4. **Orphaned `ohm-app.db\r*` files** on the VM — secured to `640`; delete once confirmed orphaned. 5. **L5 SSH / IAP (§19.2)** — the deferred item: IAP-only SSH (firewall + tunnel role + flip flotilla's deploy path to `--tunnel-through-iap`), which also retires the L9 first-connect TOFU residue. Suggested next-session launch prompt: > Ship rfc-app v0.25.0-security-hardening (finish/commit the existing > branch, release, bump the OHM pin, deploy) — this lands the still-live > audit-0026 application findings incl. the Critical XSS. Coordinate with > the session that owns the branch first. Then help the operator bind > WEBHOOK_EMAIL_BOUNCE_SECRET (M5) and add systemd UMask=0077.