cleveragents/cleveragents-core

Fork 3

Epic: Security & Safety Hardening #362

New issue

Open

opened 2026-02-22 23:41:38 +00:00 by freemo · 8 comments

freemo commented

2026-02-22 23:41:38 +00:00

Owner

Background

Covers security audit findings: template rendering hardening, explicit exception handling, async resource leak closure, and read-only action enforcement.

Expected Behavior

Security audit findings are resolved: template rendering is hardened against injection, exception handling is explicit and safe, async resource leaks are closed, and read-only action enforcement prevents unintended mutations.

Child Issues

Definition of Done

This Epic is complete when all child issues are closed and merged. Security audit findings resolved.

## Background Covers security audit findings: template rendering hardening, explicit exception handling, async resource leak closure, and read-only action enforcement. ## Expected Behavior Security audit findings are resolved: template rendering is hardened against injection, exception handling is explicit and safe, async resource leaks are closed, and read-only action enforcement prevents unintended mutations. ## Child Issues - #319 - #320 - #321 - #322 - #405 ## Definition of Done This Epic is complete when all child issues are closed and merged. Security audit findings resolved.

freemo added this to the v3.3.0 milestone

2026-02-22 23:41:38 +00:00

freemo added the

labels

2026-02-22 23:41:38 +00:00

freemo added a new dependency

2026-02-22 23:54:28 +00:00

#376 Legendary: Hardening, Testing & Security

freemo added a new dependency

2026-02-22 23:56:02 +00:00

#318 fix(security): remove eval-based config parsing

freemo added a new dependency

2026-02-22 23:56:02 +00:00

#319 fix(security): harden template rendering

freemo added a new dependency

2026-02-22 23:56:03 +00:00

#320 fix(security): enforce explicit exception handling

freemo added a new dependency

2026-02-22 23:56:03 +00:00

#321 fix(security): close async resources and leaks

freemo added a new dependency

2026-02-22 23:56:03 +00:00

#322 feat(security): enforce read-only actions

freemo added a new dependency

2026-02-23 17:12:59 +00:00

#387 Fix flaky database_integration robot suite on CI

freemo referenced this issue

2026-02-23 17:13:15 +00:00

Fix flaky database_integration robot suite on CI #387

freemo commented

2026-02-24 02:29:22 +00:00

Author

Owner

Implementation Notes — Advanced Security Scans Alignment

2026-02-13: Task Q0-adv-security In Progress - Align Security Scans with Nox

Added Semgrep as Step 3 in security_scan session (between Bandit and Vulture).
Changed semgrep hook from wrapper script to direct invocation.
Updated quality-automation docs with revised thresholds (85->97%).

(Migrated from docs/implementation-notes.md)

## Implementation Notes — Advanced Security Scans Alignment **2026-02-13**: Task Q0-adv-security In Progress - Align Security Scans with Nox - Added Semgrep as Step 3 in `security_scan` session (between Bandit and Vulture). - Changed semgrep hook from wrapper script to direct invocation. - Updated quality-automation docs with revised thresholds (85->97%). *(Migrated from `docs/implementation-notes.md`)*

freemo referenced this issue

2026-02-24 03:27:28 +00:00

fix/data-injection-fix #30

freemo referenced this issue

2026-02-24 03:27:31 +00:00

fix/file-system-security #32

freemo referenced this issue

2026-02-24 03:27:32 +00:00

fix/server-side-request-forgery-security-fix #33

freemo referenced this issue

2026-02-24 03:27:33 +00:00

fix: replace yaml.dump() with yaml.safe_dump() to prevent serialization of malicious objects #34

freemo added the

MoSCoW

Must have

Points

labels

2026-02-24 03:36:23 +00:00

freemo self-assigned this

2026-02-24 03:37:59 +00:00

freemo referenced this issue

2026-02-24 03:40:53 +00:00

Legendary: Hardening, Testing & Security #376

freemo referenced this issue

2026-03-04 01:01:54 +00:00

feat(autonomy): implement semantic escalation with confidence scoring and threshold comparison #546

~~freemo referenced this issue 2026-03-04 04:57:04 +00:00~~

feat(autonomy): implement semantic escalation with confidence scoring and threshold comparison #558

freemo referenced this issue

2026-03-04 23:39:57 +00:00

feat(security): implement Prompt Injection Mitigation (5 mechanisms) #572

freemo referenced this issue

2026-03-04 23:40:08 +00:00

feat(security): implement Secret Masking in LLM Context Construction #573

freemo added a new dependency

2026-03-05 00:34:08 +00:00

#573 feat(security): implement Secret Masking in LLM Context Construction

freemo commented

2026-03-11 05:43:25 +00:00

Author

Owner

PM Status (Day 31):

Epic #362 (Security & Safety Hardening) status review:

M4 milestone (v3.3.0): This epic is assigned to M4. M4 is now feature-complete. Safety profile enforcement (#345) merged Day 23. Secret masking (#573) has PR #656 submitted by @CoreRasurae (merge conflict, no reviews).

Child issue status: Please verify which child issues under this epic are still open vs closed. If all security-related child features are merged, this epic may be ready for closure.

@freemo — can you confirm whether the remaining child issues under this epic are resolved? If so, we can close this epic and unblock M4 milestone closure.

**PM Status (Day 31)**: Epic #362 (Security & Safety Hardening) status review: **M4 milestone (v3.3.0)**: This epic is assigned to M4. M4 is now feature-complete. Safety profile enforcement (#345) merged Day 23. Secret masking (#573) has PR #656 submitted by @CoreRasurae (merge conflict, no reviews). **Child issue status**: Please verify which child issues under this epic are still open vs closed. If all security-related child features are merged, this epic may be ready for closure. @freemo — can you confirm whether the remaining child issues under this epic are resolved? If so, we can close this epic and unblock M4 milestone closure.

freemo referenced this issue

2026-04-02 08:15:04 +00:00

BUG: [error-handling] Silent exception swallowing in MigrationRunner._find_alembic_ini #1273

freemo commented

2026-04-02 08:16:16 +00:00

Author

Owner

New child issue added: #1273 — BUG: [error-handling] Silent exception swallowing in MigrationRunner._find_alembic_ini

This issue covers the silent except Exception: pass in _find_alembic_ini that suppresses import errors without logging them. The fix replaces pass with a _logger.debug(...) call, consistent with the explicit exception handling theme of this Epic.

Issue #1273 blocks this Epic.

New child issue added: #1273 — **BUG: [error-handling] Silent exception swallowing in `MigrationRunner._find_alembic_ini`** This issue covers the silent `except Exception: pass` in `_find_alembic_ini` that suppresses import errors without logging them. The fix replaces `pass` with a `_logger.debug(...)` call, consistent with the explicit exception handling theme of this Epic. Issue #1273 blocks this Epic.

freemo referenced this issue

2026-04-02 08:19:53 +00:00

BUG: [error-handling] Exception during migration prompt is not logged #1274

freemo referenced this issue

2026-04-02 08:23:10 +00:00

BUG-HUNT: [spec-alignment] Default value of effective_profile_snapshot violates spec intent #1275

freemo referenced this issue

2026-04-02 08:24:01 +00:00

BUG: [error-handling] Exception during migration prompt is not logged #1274

freemo commented

2026-04-02 08:24:23 +00:00

Author

Owner

New child issue added to this Epic: #1275 — BUG-HUNT: [spec-alignment] Default value of effective_profile_snapshot violates spec intent

This issue covers the Plan domain model's effective_profile_snapshot field defaulting to "{}", which violates the specification's auditability and reproducibility requirements. It is a low-priority spec-alignment bug that fits within the Security & Safety Hardening scope.

New child issue added to this Epic: #1275 — **BUG-HUNT: [spec-alignment] Default value of `effective_profile_snapshot` violates spec intent** This issue covers the `Plan` domain model's `effective_profile_snapshot` field defaulting to `"{}"`, which violates the specification's auditability and reproducibility requirements. It is a low-priority spec-alignment bug that fits within the Security & Safety Hardening scope.

freemo referenced this issue

2026-04-02 08:31:57 +00:00

BUG-HUNT: [consistency] Inconsistent validation logic for project names and namespaces #1276

freemo referenced this issue

2026-04-02 08:33:18 +00:00

BUG-HUNT: [consistency] Inconsistent validation logic for project names and namespaces #1276

freemo referenced this issue

2026-04-02 08:44:14 +00:00

BUG-HUNT: [concurrency] In-memory storage in PlanLifecycleService is not thread-safe #1281

freemo referenced this issue

2026-04-02 08:44:25 +00:00

Fix silent exception swallowing in LegacyDataMigrator.migrate_project_data #1283

freemo commented

2026-04-02 08:45:16 +00:00

Author

Owner

New child issue added: #1283 — Fix silent exception swallowing in LegacyDataMigrator.migrate_project_data

This issue addresses the explicit exception handling audit finding (silent swallowing of json.JSONDecodeError and OSError in the legacy data migration path). It depends on #1283.

New child issue added: #1283 — Fix silent exception swallowing in `LegacyDataMigrator.migrate_project_data` This issue addresses the explicit exception handling audit finding (silent swallowing of `json.JSONDecodeError` and `OSError` in the legacy data migration path). It depends on #1283.

freemo referenced this issue

2026-04-02 08:48:50 +00:00

BUG-HUNT: [consistency] Redundant plan fetching in try_auto_run #1285

freemo referenced this issue

2026-04-02 08:50:58 +00:00

BUG-HUNT: [consistency] Redundant plan fetching in try_auto_run #1285

freemo referenced this issue

2026-04-02 08:51:24 +00:00

BUG-HUNT: [spec-alignment] Default database location deviates from specification #1288

freemo commented

2026-04-02 08:51:57 +00:00

Author

Owner

Child issue added: #1288 — BUG-HUNT: [spec-alignment] Default database location deviates from specification

This issue fixes the database_url default in Settings to use ~/.cleveragents/cleveragents.db as required by the specification, rather than the current working directory.

Child issue added: #1288 — BUG-HUNT: [spec-alignment] Default database location deviates from specification This issue fixes the `database_url` default in `Settings` to use `~/.cleveragents/cleveragents.db` as required by the specification, rather than the current working directory.

freemo referenced this issue

2026-04-02 08:55:07 +00:00

BUG-HUNT: [spec-alignment] Database schema documentation in specification is outdated #1289

freemo commented

2026-04-02 08:55:52 +00:00

Author

Owner

Child issue #1289 (BUG-HUNT: [spec-alignment] Database schema documentation in specification is outdated) has been created and blocks this Epic.

freemo referenced this issue

2026-04-02 09:00:40 +00:00

fix: [error-handling] Propagate exception when sandbox backup restore fails during commit #1291

freemo commented

2026-04-02 09:01:27 +00:00

Author

Owner

New child issue added to this Epic: #1291 — fix: [error-handling] Propagate exception when sandbox backup restore fails during commit

This issue addresses the swallowed exception in CopyOnWriteSandbox.commit and OverlaySandbox.commit when safe_restore fails during rollback. It is a direct child of this Epic (Security & Safety Hardening) as it falls under the "explicit exception handling" audit finding.

Dependency: #1291 is independent of the current open work in this Epic and does not block any existing child issues.

New child issue added to this Epic: #1291 — **fix: [error-handling] Propagate exception when sandbox backup restore fails during commit** This issue addresses the swallowed exception in `CopyOnWriteSandbox.commit` and `OverlaySandbox.commit` when `safe_restore` fails during rollback. It is a direct child of this Epic (Security & Safety Hardening) as it falls under the "explicit exception handling" audit finding. **Dependency**: #1291 is independent of the current open work in this Epic and does not block any existing child issues.

Rows
Columns