.gitbay/wiki/Architecture/10-Known-Gaps.org

 1#+title: Known gaps
 2
 3Open weaknesses. Issues on krz/gitbay are public; this page gives the
 4title and the consequence, not a reproduction. The current list is the
 5open issues labelled =security=:
 6https://gitbay.org/krz/gitbay/issues?label=security. The table below is
 7what the 2026-09-27 review found; remove a row when its issue closes.
 8
 9* Filed
10
11| Issue | Area             | Gap                                                                   | Severity |
12|-------+------------------+-----------------------------------------------------------------------+----------|
13
14* Not filed
15
16| Area  | Gap                                                                                                         | Severity |
17|-------+-------------------------------------------------------------------------------------------------------------+----------|
18| Audit | The hash chain is unkeyed, so whoever can write the database can edit a row and recompute every later hash; removing the newest audit rows, or writing new rows under their freed ids, needs no recomputing at all. Neither is detectable from the database; only comparing =gitbayd admin audit verify='s last id and hash with the daemon's journal shows it. Rows written by =gitbayd shell= (=ssh.mode = "system"=) and host admin commands have no journal copy, and the refusal caps are per process, so under that mode each connection counts separately | low |
19| Availability | Under =ssh.mode = "system"= each SSH session is a separate =gitbayd shell= process, so the pack and push limits (=internal/packlimit=, #262, #308) cannot count SSH clones or pushes across sessions; only HTTP and git:// share a budget there | low |
20| Availability | A push holds its slot for at most =push_receive_timeout= (15m) before its pre-receive starts, and, once its pack has begun, at most =push_idle= (60s) with nothing moving either way. A client that trickles its pack and reconnects when cut can hold a slot per principal for up to the receive deadline each time; deploy keys multiply the per-principal share, bounded by =push_concurrency= | low |
21| Availability | An HTTP or git:// client that disconnects while queued for a pack slot keeps its place until =pack_queue_wait= runs out; only SSH notices the disconnect | low |
22
23* Questions an auditor will ask that have no answer yet
24
25| Question                                                  | Status                                   |
26|-----------------------------------------------------------+------------------------------------------|
27| What is the measured recovery time?                       | 8m43s from the offsite copy to a clone, laptop drill 2026-09-29, no host provisioning (Admin wiki) |
28| How many concurrent clones does the host sustain?         | unmeasured (#262)                        |
29| Have the collaboration features been used by independent users? | no; one human user, tests only     |