Findings Register
The consolidated worklist behind the dashboard maturity ratings. 37 findings (iteration 1 + re-verify), tracked across 39 GitHub issues (RBAC spans backend + frontend). Each row links to its issue, where the full evidence (file:line) and fix detail live. F-25–F-28 came from the internal SECURITY-AND-PERFORMANCE-GAPS.md audit; F-29–F-33 from the completeness review; F-34–F-35 from the secret-scanning run; F-37 from a branch-protection review.
Re-verified 2026-07-10 (against
origin/main): 1 resolved (F-13 ALB/TLS). Partial progress: F-03, F-11, F-12, F-18, F-22, F-27 (see the dashboard callout for details), and frontend RBAC route guards now exist (backend F-02 still open). Everything else unchanged.Update 2026-07-18: F-36 resolved —
bun.lockcommitted + un-ignored and--frozen-lockfileenforced across every Docker/CI build in all three repos; a reusable lockfile guard (fin-infralockfile-guard.yml, called by all repos) now blocks regressions (blitz#1104, blitz-ui#715/#716, fin-infra#53/#54). Dependency-CVE counts, now measured against the committed lockfiles, are authoritative: blitz 97, blitz-ui 93 (190 total) — F-29/F-30 updated. New this pass: F-37 (no branch protection onmainin the code repos, surfaced while making the guard a required check).
Why the detail is in the issues, not here
This page is the register — severity, domain, what it is, and where it's tracked. The exact code locations and exploit walkthroughs stay in the linked GitHub issues (one click away). Same access boundary (@finaisse.com), but a single source of truth: the issue is authoritative, this table is the index.
Severity: P0 exploitable now / ≤7d · P1 high / ≤30d · P2 real weakness / ≤90d. Domains link to the domain detail.
🔴 P0 — Critical (must fix before production)
| ID | Finding | Domain | Tracked by |
|---|---|---|---|
| F-01 | Cross-tenant access via spoofable x-blitz-tenant-id header — not bound to JWT tenant claim; no Postgres RLS backstop | 7 | blitz#992 |
| F-02 | RBAC not enforced on finance endpoints — any authenticated user can post/delete journals, approve payments | 4 | blitz#671 · blitz-ui#314 |
| F-03 🟡 partial | SQL injection in matching output service — sourceentity/displayfields now constrained; matchstatus/matchtype still raw-interpolated | 5 | blitz#998 |
| F-04 | Permissive CORS (origin:()=>true + credentials) on all services incl. admin apimgmt; CSRF-able | 6 | blitz#999 |
| F-25 | Mass-assignment of identity/audit fields — client sets createdby/approvedby/assigneduseremail → impersonation + audit-trail falsification | 16 · 4 | blitz#1014 |
| F-26 | /filter WHERE clauses accept arbitrary fields (no allowlist) → BOLA / cross-user data enumeration (~239 filter controllers) | 6 · 7 | blitz#1015 |
🟠 P1 — High
| ID | Finding | Domain | Tracked by |
|---|---|---|---|
| F-05 | No HTTP security headers on any service or frontend nginx (no CSP/HSTS/X-Frame-Options) | 3 · 5 | blitz#1000 |
| F-07 | Auth tokens in JS-readable cookies (no httpOnly/Secure/SameSite); no refresh rotation | 4 | blitz#1001 |
| F-08 | Stored XSS via unsanitized v-html on email bodies + AI content (no DOMPurify) | 5 | blitz-ui#657 |
| F-09 | API docs (Swagger/Scalar) served without auth in non-dev environments | 6 | blitz#1002 |
| F-10 | Temporal client TLS hardcoded false (lower risk on Railway's encrypted private net; must fix for AWS) | 3 | blitz#1003 |
| F-11 | AWS Day-1 detection baseline missing (CloudTrail, GuardDuty, Security Hub, VPC Flow Logs, WAF) — go-live blocker | 9 · 11 | fin-infra#31 |
| F-12 | AWS IAM resource scopes too broad (kms:Decrypt on *, ECS/CloudFront on *) | 4 · 9 | fin-infra#32 |
| 3 | fin-infra#33 | ||
| F-23 | No multi-factor authentication for application users (esp. admin/approver roles) | 4 | blitz#1007 |
| F-24 | No independent validation — establish penetration test + vulnerability disclosure (VDP) program | 14 | fin-infra#39 |
| F-27 🟡 partial | Pagination: itemsPerPage now capped (max 1000, too high); take/skip still unbounded | 6 | blitz#1016 |
| F-28 | JWT accepted via query param (authenticator.ts:46) → token leakage to logs | 4 · 11 | blitz#1017 |
| F-29 | 97 open dependency CVEs in blitz (1 critical, 37 high) — authoritative vs the committed lockfile (was 114 on an unpinned tree; re-measured 2026-07-18 post-F-36); SCA not in CI | 8 | blitz#1018 |
| F-30 | 93 open dependency CVEs in blitz-ui (2 critical, 49 high) — authoritative vs the committed lockfile (re-measured 2026-07-18 post-F-36); SCA not in CI | 8 | blitz-ui#667 |
| F-31 | No automated security scanning in CI (SCA/SAST/secret/IaC/image) — establish the program | 14 · 8 | fin-infra#40 |
| F-34 | Secrets committed to blitz-ui git history (8 hits incl. GCP key in .env.production) — rotate + scrub | 4 · 8 | blitz-ui#668 |
| F-35 | Secrets in blitz git history (39 hits; real GCP key in railway-iac + generated-file FPs) — rotate + .gitleaks.toml | 4 · 8 | blitz#1019 |
| F-37 🆕 | No branch protection on main in blitz and blitz-ui — force-push and unreviewed merge possible, no required status checks (fin-infra is protected; guard now required there). Weakens SCM integrity and undercuts the new CI guards | 14 · 8 | fin-infra#55 |
🟢 P2 — Medium
| ID | Finding | Domain | Tracked by |
|---|---|---|---|
| F-06 | Rate limiting only on agents — auth/login + main API unthrottled (Railway Fastly gives some edge protection) | 6 | blitz#670 |
| F-14 | AI/agent surface: PII to LLM with no redaction, shared key (role-spoof part covered by P0 #671) | 5 · 7 | blitz#669 |
| F-15 | Incomplete audit trail on financial records; no tamper-evidence / signing | 16 | blitz#1008 |
| F-16 | Server-side state-transition guards + segregation-of-duties unverified | 17 | blitz#1009 |
| F-17 | No SPF/DKIM/DMARC; unthrottled email-triggered workflows; attachment parsing risk | 3 · 5 | blitz#1004 |
| F-18 | Encryption uses AWS-managed keys only; no CMKs, no S3 TLS-only policy, no secret rotation | 2 · 9 | fin-infra#34 |
| F-19 | Unbounded tenant Prisma client / pg-pool caches (no TTL/eviction) | 7 | blitz#1005 |
| F-20 | No container image scanning / signing / digest pinning; :latest tags | 8 · 10 | fin-infra#35 |
| F-21 | No pre-commit secret scanning; dead GOOGLE_API_KEY in UI build | 4 | blitz#1006 |
| F-22 | CI/CD + account hardening: no Terraform plan gate, no Identity Center/MFA, no break-glass, single NAT | 14 · 9 | fin-infra#36 |
| F-32 | No endpoint/workstation security baseline (disk encryption, MDM, EDR) — developer laptops are the perimeter | 19 | fin-infra#41 |
| F-33 | No security-awareness / people-security program (training, phishing sim, joiner/leaver) | 20 | fin-infra#42 |
bun.lock gitignored → non-reproducible builds + unreliable dependency scanning--frozen-lockfile enforced across all Docker/CI builds in all 3 repos, reusable lockfile guard blocks regressions (closed 2026-07-18) | 8 | blitz#1072 · blitz-ui#694 |
Live queries: all open security issues · Finboard project · filter by severity from the dashboard cards.
Findings tagged "needs runtime confirmation" in their issues (F-01 cache path, F-03 reachability, F-16 enforcement) should be validated dynamically — this register is from a read-only review, not a penetration test (see F-24).