.gitbay/wiki/Architecture/10-Known-Gaps.org
37 lines · 3099 bytes
Known gaps
Open weaknesses. Issues on krz/gitbay are public; this page gives the
title and the consequence, not a reproduction. The current list is the
open issues labelled security:
https://gitbay.org/krz/gitbay/issues?label=security. The table below is
what the 2026-09-27 review found; remove a row when its issue closes.
Filed
| Issue | Area | Gap | Severity |
|---|---|---|---|
| #255 | CI isolation | Untrusted and trusted builds of a repository share a writable build home | high |
| #258 | CI integrity | Any writer can post a ci/* status; tree reuse ignores trust and image |
high |
| #259 | Recovery | No restore has been exercised; verification does not check git connectivity | high |
| #260 | CI network | Builds share the runner's source address; no egress policy | medium |
| #261 | Various | Migration foreign-key check after commit; three web writes bypass dispatch; documentation drift | medium |
| #262 | Availability | No limit on concurrent git pack generation | high |
| #273 | Data at rest | CI secrets, webhook secrets and mirror tokens are stored in clear in SQLite | high |
| #274 | Backups | The local backup archive is not encrypted | medium |
| #275 | Audit | Refused writes are not audited; the audit table is writable by the daemon user | medium |
| #276 | Sessions | Web sessions last 7 days with no idle timeout | low |
| #278 | Login links | web login over SSH skips the login-link rate limit |
low |
| #279 | SSRF | Mirror URLs are checked when saved, not when git connects | medium |
| #280 | STARTTLS only when the relay offers it | medium | |
| #281 | TLS | No explicit minimum TLS version | low |
| #282 | Hook socket | Anything that can open hook.sock can act as any user |
medium |
| #297 | Credentials | A browser session can mint tokens and keys that outlive it | low |
Questions an auditor will ask that have no answer yet
| Question | Status |
|---|---|
| What is the measured recovery time? | unmeasured (#259) |
| How many concurrent clones does the host sustain? | unmeasured (#262) |
| What can a build reach on the host's network? | configuration inspected, reachability untested (#260) |
| Have the collaboration features been used by independent users? | no; one human user, tests only |