Trust center
Everything that backs the claim lives in the repo.
This is the index. Each entry links to the living document where the real work is kept — no PDFs behind a form, no marketing gloss. If it is not here, it does not exist yet, and this site will not pretend otherwise.
Evidence & artifacts
Requirements registry377 IDs
docs/traceability/requirements-registry.md
Every requirement with its stable ID, allocated at proposal time and never reused.
Traceability matrixGenerated
docs/traceability/matrix.md
Requirement → spec → tests → commits, regenerated from repository state by tools/trace.py.
Risk register52 risks
docs/security/risk-register.md
Known risks with likelihood, impact, and what protects against each one now.
Threat modelLiving
docs/security/threat-model.md
STRIDE analysis of every attack surface, updated in the same change that adds one.
Dependency (SOUP) registerLiving
docs/security/soup-register.md
Every third-party dependency with its role, license, and review state.
Known-anomalies registerLiving
docs/security/known-anomalies.md
Oddities and accepted imperfections, recorded instead of quietly ignored.
Release records57 published
GitHub Releases
Every tagged release with its notes — the same text as the CHANGELOG entry it mirrors.
Process & governance
Development-process specGoverning
openspec/specs/dev-process/spec.md
The process rules themselves — spec before code, stable IDs, tagged tests, review gates — written as requirements like everything else.
Commit standard & merge gatesEnforced by hooks
docs/process/commit-standard.md
Commit format with mandatory requirement trailers, and the checklist every change passes before it merges.
Archived change proposals66 of 67 approved
openspec/changes/archive/
Every completed change with its proposal, design, tasks, and the recorded owner approval that let implementation begin.
User & admin manualSynced per change
docs/manual/
Documentation is updated in the same change that alters behavior — a change declares its manual impact or states why there is none.
Repository history scanRecorded
docs/security/history-scan.md
History hygiene: what was checked for secrets and residue before the repository went public.
Test coverage, honestly
305 of 305
implemented requirements with tagged tests
The traceability check fails the merge gate on any implemented requirement without one — this cannot silently regress.
55
approved, not yet built
Backlog requirements carry no tests by definition; they are specified, awaiting implementation.
8 of 15
process rules machine-tested
The rest of the process rules are enforced by git hooks and the merge-gate checklist rather than the test suite.
Not in place yet
Controls this project does not have. Stated here so the evidence above cannot be mistaken for more than it is; each entry cites the committed document that records the deferral or decision.
External penetration test
None has been performed. The roadmap schedules the penetration-test decision — whether, scope, and by whom — at the 1.0 go-live milestone.
docs/roadmap.mdCI-enforced quality gates
Test suites and consistency checks run at every merge gate on the operator’s machine, not in CI; the Pages deploy workflow is the only CI.
docs/process/commit-standard.mdLive dependency-advisory review
Dependency inventory is complete and mechanically verified, but advisory scanning (pip-audit, npm audit) is deferred until network-connected CI exists.
docs/security/soup-register.mdFormal CAPA process
There is no corrective-and-preventive-action log; the known-anomalies register is the nearest current artifact.
docs/security/known-anomalies.mdRisk register
52 risks · rendered from docs/security/risk-register.md
| ID | Risk | L | I | Status |
|---|---|---|---|---|
| RISK-001 | Arbitrary file read via client-supplied path to an OPDS download/stream endpoint (Mylar `deliverFile` traversal — the headline finding). | H | H | Mitigated |
| RISK-002 | SQL injection via client-controlled ids/params interpolated into SQL (Mylar `_Comic`/`_StoryArc` string concat). | M | H | Mitigated |
| RISK-003 | OPDS world-readable and exempt from site auth by default. | H | M | Mitigated |
| RISK-004 | Weak OPDS auth primitives: plaintext-compared Basic, no TLS enforced, no lockout/rate limit. | M | M | Mitigated |
| RISK-005 | Zip-bomb / decompression / truncated-image resource exhaustion when the server opens untrusted archives and resizes images (PIL `LOAD_TRUNCATED_IMAGES`) at OPDS feed/stream time. | M | M | Mitigated |
| RISK-006 | Download filename derived from attacker-controlled redirect-final URL (`unquote` before `basename`); traversal / hostile / device names. | M | H | Mitigated |
| RISK-007 | Scraped hrefs fetched with session cookies and redirects followed blindly (SSRF to internal addresses; cookie exfiltration; `run.php`/`go.php` URL mutation). | M | H | Mitigated |
| RISK-008 | `zipfile.extractall` on hostile packs: zip-bombs, `../` traversal entries, symlink tricks; extraction before verification. | M | H | Accepted |
| RISK-009 | FlareSolverr call uses `verify=False`; Cloudflare clearance cookies persisted in plaintext (`.gc_cookies.dat`); solver URL is an SSRF pivot. | M | M | Mitigated |
| RISK-010 | Decompression-bomb / zip-slip / malformed-image exposure on the **import**, **cover-extraction**, and **ComicInfo-tagging** archive paths (DDL/OPDS limits do not cover these). | M | M | Mitigated |
| RISK-011 | User-editable ComicVine wiki HTML flows into names/aliases/descriptions → stored XSS in UI **and** steers downstream indexer/DDL search queries. | M | M | Mitigated |
| RISK-012 | `CV_VERIFY` disables TLS certificate verification globally for ComicVine traffic. | L | M | Mitigated |
| RISK-013 | Secret exposure: CV API key in URL query strings; indexer/SAB keys in logs; Mylar's reversible salted-base64 at-rest obfuscation; secrets in image/repo/diagnostics. | M | H | Mitigated |
| RISK-014 | Scraped/remote text (DDL series titles/sizes/years, CV fields) written unescaped into logs, DB, UI → XSS + log injection. | M | M | Mitigated |
| RISK-015 | Single hardcoded DDL upstream (getcomics.org) → domain takeover becomes a malware-delivery channel; CRC does not authenticate content. | L | H | Mitigated |
| RISK-016 | Cloudflare evasion + spoofed User-Agent + shortener filtering are ToS-sensitive automation choices. | M | L | Accepted |
| RISK-017 | Mylar's per-provider proxy applied only to the DDL session (split-tunnel surprise; other traffic ignores the proxy). | L | L | Accepted |
| RISK-018 | Hostile filename crashes the parser (Mylar wraps whole passes in bare `except`; no fuzzing). | L | M | Mitigated |
| RISK-019 | Attacker-influenced ComicVine series/issue titles used to build destination folder/file paths could escape the managed library root (`..`, separators, absolute paths). | M | H | Mitigated |
| RISK-020 | **M1/M2 ship with NO application auth** on UI/API/OPDS/WebSocket; only compensating control is Tailscale-only exposure. | H | H | Mitigated |
| RISK-021 | No listener-level request-body-size cap or request rate limit → memory/CPU DoS from large or rapid requests (incl. WebSocket floods). | M | M | Mitigated |
| RISK-022 | Cross-Site WebSocket Hijacking (unvalidated Origin) and unconsolidated CSRF stance on state-changing endpoints once cookie-session auth exists. | L | M | Mitigated |
| RISK-023 | Hotlinked ComicVine cover URLs leak iPad/OPDS client requests to a third-party CDN (traffic-analysis / availability coupling). | L | L | Mitigated |
| RISK-024 | XXE / entity-expansion (billion-laughs) via untrusted XML: Newznab/Torznab RSS responses and any residual CV/OPDS XML; only CBL got a hardening note. | M | M | Mitigated |
| RISK-025 | SSRF via config-/wiki-supplied outbound URLs: ComicVine cover-image fetch (wiki-editable `ImageURL`), and indexer/SAB/FlareSolverr/pull-source hosts pointed at internal/loopback addresses. DDL allowlist does not cover these. | M | M | Mitigated |
| RISK-026 | Indexer returns a mislabelled payload (HTML/error page where an NZB is expected) → bad content into the pipeline. | L | M | Mitigated |
| RISK-027 | Hostile/slow provider (indexer or GetComics) wedges workers or triggers a ban; unbounded pagination walk. | M | M | Mitigated |
| RISK-028 | Mylar's SAB add-by-URL scheme (SAB pulls the NZB from Mylar's API via a one-time download key) adds a callback auth surface. | L | M | Mitigated |
| RISK-029 | SAB-reported completed path (remote/foreign) read/moved by the process → path confusion / reading unintended locations. | L | M | Mitigated |
| RISK-030 | Password-protected / corrupt archives consume resources or slip into the library. | L | M | Mitigated |
| RISK-031 | Shell script hooks (pre/extra/on-snatch) are a remote-code-execution surface (Mylar feature). | L | H | Accepted |
| RISK-032 | Crash/power-loss loses acknowledged work or corrupts queue state → duplicate snatches / double imports (Mylar smears state across globals/DB/memory). | M | M | Mitigated |
| RISK-033 | Container runs privileged / library volumes owned by root → host-level blast radius. | L | M | Mitigated |
| RISK-034 | Self-update mechanism (git pull / tarball fetch) is a supply-chain/RCE surface (Mylar feature). | L | H | Accepted |
| RISK-035 | ComicVine XML parsing via minidom/expat (entity-expansion unsafe in some configs). | L | M | Mitigated |
| RISK-036 | ComicVine `requests.get` without a timeout hangs the scheduler thread indefinitely. | M | M | Mitigated |
| RISK-037 | CBL reading-list import parses untrusted XML from the internet (XXE/entity expansion). | L | M | Mitigated |
| RISK-038 | Spoofed browser User-Agent to ComicVine (ToS/politeness inheritance). | L | L | Mitigated |
| RISK-039 | External weekly-pull JSON source (unofficial third party) as an outbound dependency and untrusted-content ingress. | L | L | Mitigated |
| RISK-040 | Unbounded `import_history` growth from a blocked-item retry loop: a still-completed `import_blocked` item is re-fed to `import_pending` by every ~1-min tracking cycle (the deliberate retry-on-evidence-change path), and each failed retry writes a fresh `import_blocked` history event — a permanently stuck item ping-pongs and accretes ~1.4k rows/day until the user acts. | M | L | Mitigated |
| RISK-041 | Plaintext provider credentials in database/config backups. Scheduled backups copy the SQLite DB and config file verbatim; both persist ComicVine/Newznab (DogNZB, NZB.su)/SABnzbd keys in plaintext (no encryption-at-rest/secret store yet), so every backup file is credential-bearing. | L | H | Mitigated |
| RISK-042 | Third-party use of the owner's published, un-revocable ComicVine API key. The key is embedded in `docs/research/Foragerr.dc.html` in public git history (blob `495f29e`, all tags `v0.1.0`–`v0.3.5`); it cannot be rotated or revoked (provider offers neither). Anyone reading history can extract and use it, spoofing the client identity of foragerr's ComicVine traffic. | L | L-M | Accepted |
| RISK-043 | `GET /api/v1/log` exposes recent backend log content — including acquisition/indexer activity and any file paths or third-party hostnames that appear in log message text — to any tailnet-position reader before M8 auth. | L | M | Mitigated |
| RISK-044 | Unauthenticated `PUT`/`DELETE /api/v1/issues/{issue_id}/collections` (FRG-API-022) let any tailnet-position client declare, replace, or delete trade-containment records (FRG-SER-020) for any trade issue. | L | L | Mitigated |
| RISK-045 | Humble session cookie (`_simpleauth_sess`) stored at rest in the `sources` table's settings JSON. | L | H | Mitigated |
| RISK-046 | Cookie theft (OS-clipboard residual during the manual DevTools copy-paste connect flow, a compromised operator machine, or exfiltration of the decrypted value) grants an attacker full access to the operator's Humble Bundle account — order history, entitlements, and download rights — indistinguishable from the operator's own logged-in session. | L | H | Accepted |
| RISK-047 | Humble order-API responses (`GET /api/v1/user/order`, `GET /api/v1/order/{gamekey}`) are store-controlled, untrusted JSON parsed server-side; a compromised or malicious response could attempt an oversized body, a malformed shape, or hostile string content. | L | M | Mitigated |
| RISK-048 | Entitlement download fetches a signed, time-limited URL returned by the Humble order API and streams it into the download-staging area; a compromised/hostile response could point the fetch at an arbitrary host (SSRF) or an oversized/slow payload. | L | M | Mitigated |
| RISK-049 | Malicious RAR archive (decompression bomb, crafted metadata, symlink/traversal members, encrypted or truncated structure) processed by the CBR page-streaming path. | M | M | Mitigated |
| RISK-050 | The companion browser extension is self-distributed (not store-reviewed); a tampered build could gain reach beyond its stated permissions or copy the Humble cookie somewhere other than the clipboard. | L | M | Mitigated |
| RISK-051 | The GitHub Pages deploy workflow is the repository's first CI: a compromised or hijacked third-party action could exfiltrate the job token or publish tampered site content (supply chain). | L | M | Mitigated |
| RISK-052 | Trusted-proxy misconfiguration: an operator who lists a wrong or reachable-by-others address in `trusted_proxies` lets that peer spoof its scheme (forcing/clearing cookie `Secure`) and its client address (defeating rate-limit keying and audit attribution) via forwarded headers. | L | M | Mitigated |