#+title: Known gaps

Open weaknesses. Issues on krz/gitbay are public; this page gives the
title and the consequence, not a reproduction. The current list is the
open issues labelled =security=:
https://gitbay.org/krz/gitbay/issues?label=security. The table below is
what the 2026-09-27 review found; remove a row when its issue closes.

* Filed

| Issue | Area             | Gap                                                                   | Severity |
|-------+------------------+-----------------------------------------------------------------------+----------|
| #255  | CI isolation     | Untrusted and trusted builds of a repository share a writable build home | high  |
| #258  | CI integrity     | Any writer can post a =ci/*= status; tree reuse ignores trust and image | high   |
| #259  | Recovery         | No restore has been exercised; verification does not check git connectivity | high |
| #260  | CI network       | Builds share the runner's source address; no egress policy            | medium   |
| #261  | Various          | Migration foreign-key check after commit; three web writes bypass dispatch; documentation drift | medium |
| #262  | Availability     | No limit on concurrent git pack generation                            | high     |
| #273  | Data at rest     | CI secrets, webhook secrets and mirror tokens are stored in clear in SQLite | high |
| #274  | Backups          | The local backup archive is not encrypted                             | medium   |
| #275  | Audit            | Refused writes are not audited; the audit table is writable by the daemon user | medium |
| #276  | Sessions         | Web sessions last 7 days with no idle timeout                         | low      |
| #278  | Login links      | =web login= over SSH skips the login-link rate limit                  | low      |
| #279  | SSRF             | Mirror URLs are checked when saved, not when git connects             | medium   |
| #280  | Mail             | STARTTLS only when the relay offers it                                | medium   |
| #281  | TLS              | No explicit minimum TLS version                                       | low      |
| #282  | Hook socket      | Anything that can open =hook.sock= can act as any user                | medium   |
| #297  | Credentials      | A browser session can mint tokens and keys that outlive it            | low      |

* Questions an auditor will ask that have no answer yet

| Question                                                  | Status                                   |
|-----------------------------------------------------------+------------------------------------------|
| What is the measured recovery time?                       | unmeasured (#259)                        |
| How many concurrent clones does the host sustain?         | unmeasured (#262)                        |
| What can a build reach on the host's network?             | configuration inspected, reachability untested (#260) |
| Have the collaboration features been used by independent users? | no; one human user, tests only     |