Triaged all 29 Open SWE findings (6 posted + 23 below-threshold). Fixed the
three genuine ones; the rest are refuted/unreachable/intentional (details
replied on the PR).
- #0/#22 (high): SHOC_WEBHOOK_URL now has NO hardcoded default. A dropped env
var previously fell back to the dev endpoint and would ship prod work-order
data there; deliver() now fails closed (retryable) on an unset/non-https
URL. The CDK env var is the single source.
- #9/#26 (high): capture record["dynamodb"]["SequenceNumber"] once, safely,
before delivery. The catch-all exists so an exception can't re-deliver the
whole batch — it must not itself KeyError on the subscript. A record without
a SequenceNumber (unreachable for real streams) is logged + skipped.
- #16/#17: bound the Secrets Manager + SQS client timeouts (botocore Config:
3s connect / 5s read / 2 retries) so a slow AWS call can't hang the
invocation toward its 60s timeout and re-deliver the batch.
Dismissed (confirmed sound): HMAC scope is contract-pinned + golden-vector
shared (changing it is a breaking cross-party change); the replay script's
hardcoded prod account is a deliberate fail-closed guard, and its required
--url + dry-run-default + https-only are its intended operator-runbook design.
753 pytest / 85.7%, ruff, cdk synth green. No IAM/auth/Lambda-signature
change, so the mandatory cross-family gates are unaffected.
High-recall detector fan-out (injection/authz/secrets-crypto/iac-iam/logic)
+ proof-or-kill verifier. Gate PASSES: 1 confirmed medium, 0 confirmed
critical/high. Confirmed finding fixed; several unverified-but-cheap
hardenings applied since the emitter ships dark and activation is weeks out.
- CONFIRMED medium (confused deputy): the rotation Lambda's generated
invoke permission for secretsmanager.amazonaws.com carried no
SourceAccount/SourceArn, so any account's Secrets Manager could invoke
the rotator. Patched the generated CfnPermission in place (a second
permission would be additive, not restrictive) to pin account + this
secret ARN.
- delivery + replay: refuse to follow receiver 3xx redirects (no-redirect
opener) so live X-SH-* auth headers can't be forwarded to a
receiver-chosen Location and an http:// Location can't slip past the
https guard. Fixed the "unfollowed 3xx" comment that was factually wrong.
- delivery: classify 401/403 as retryable (invalidate key cache + retry in
order) instead of parking -- transient auth failures (rotation outran the
TTL cache, clock skew) are availability events, not contract bugs.
- envelope: build_event now genuinely total (guarded eventID /
ApproximateCreationDateTime subscripts) per its own never-raise contract.
- handler: catch-all so an unexpected per-record error (e.g. SQS park
failure) reports only that record instead of failing the whole batch
(which would re-deliver every earlier success for 24h); per-invocation
emit/skip batch summary so a systemic silent drop is queryable/alarmable.
- rotator: narrow the AWSCURRENT-read except to ResourceNotFound/JSONDecode
(transient SM/KMS errors re-raise so the overlap key isn't silently
dropped); kid uniqueness checked against ALL retained kids with a random
suffix on collision (never reissue a kid for a different secret).
- contract: skeleton-upsert required on ANY unknown work_order_id (not just
comment-before-create) + monotonicity guard (ignore older updated_at), so
a parked created or an out-of-order replay can't corrupt receiver state.
Unverified/refuted findings left as-is with rationale: the two "high" logic
claims (whole-batch crash triggers, ordering violation) were refuted on
reachability (real stream records carry required fields; persistence writes
strings only; full-state idempotent upsert absorbs the ordering gap). Signed
kid/version binding (AUTHZ-002) declined: coordinated contract change, not
cheap, no exploit with one algorithm/key.
