Skip to content
P‑AIProject‑AI
Security · Triage 2026-04-27

P0/P1 remediation dashboard

Status, owners, and due dates pulled from the user-submitted vulnerability inventory. Click a status chip to advance it locally; export the live state to CSV.

7 of 7 items shown
PR-1 · Workflow Security
  • T-001P0-AWorkflow Security

    Harden / disable risky archive workflows

    owner: DevOps Leaddue: 2026-04-27
    files
    • .github/workflows/archive/build-release.yml
    • .github/workflows/archive/sign-release-artifacts.yml
    remediation
    • Remove dynamic interpolation of untrusted event/input values in shell contexts
    • Pin third-party actions by full commit SHA
    • Reduce permissions: to least privilege per job
PR-2 · Deserialization + Sandbox Guardrails
  • T-002P0-ADeserialization

    Patch unsafe deserialization (torch.load / pickle.loads)

    owner: Security Engineeringdue: 2026-04-27
    files
    • src/app/core/snn_integration.py
    • src/cognition/adapters/model_adapter.py
    • src/app/core/memory_optimization/compression_engine.py
    remediation
    • torch.load(..., weights_only=True, map_location='cpu') where supported
    • Trusted-directory + extension allowlist + SHA256 allowlist for model files
    • Replace pickle.loads with JSON/msgpack or signed-blob verification gate
  • T-003P0-ADebug Runtime

    Kill debug-mode RCE surface in demo server

    owner: Demo Ownerdue: 2026-04-27
    files
    • demos/thirstys_security_demo/demo_server.py
    remediation
    • Set debug=False
    • Bind localhost by default for demos unless explicit env override
PR-3 · SQL Injection Hardening
  • T-004P0-BSQL Injection

    Remove dynamic SQL concatenation

    owner: Data Platformdue: 2026-04-28
    files
    • src/app/core/clickhouse_integration.py
    • src/app/core/risingwave_integration.py
    • src/app/core/storage.py
    remediation
    • Strict identifier allowlists for table/view names
    • Parameterize values only — never concatenate untrusted predicates
    • Reject arbitrary where_clause strings; use structured filter DSL
PR-4 · Android Security Posture
  • T-005P0-BMobile Security

    Lock Android defaults (allowBackup, cleartext)

    owner: Mobile Leaddue: 2026-04-28
    files
    • android/app/src/main/AndroidManifest.xml
    • android/legion_mini/src/main/AndroidManifest.xml
    • app/src/main/AndroidManifest.xml
    remediation
    • allowBackup=false
    • Disable cleartext unless debug flavor requires it
    • Explicitly gate exported components and network security config
PR-5 · Dependency Upgrades + lockfiles + regression
  • T-006P1Dependencies

    Upgrade vulnerable Python + JS packages

    owner: Platform Engdue: 2026-04-29
    files
    • requirements.txt
    • desktop/package.json
    • web/package.json
    remediation
    • Python security libs first (cryptography, PyJWT, gunicorn)
    • JS ecosystem (axios, next, Electron track)
    • Compatibility test sweep before merge
  • T-007P1Secret Response

    Secret response — rotate, scrub, scan

    owner: Security Leaddue: 2026-04-29
    files
    • secrets registry
    • .github/workflows/**
    remediation
    • Rotate any real credentials/private keys
    • Replace committed values with placeholders
    • Add secret scanning allowlist only for intentional fake examples