James
|
fa7541bd4d
|
Security review: Replication functionality (Commercial Only)
Comprehensive security audit of event-driven replication.
CRITICAL issues (5):
1. Inter-POP authentication not implemented (stub TODO)
2. Backup-side request authentication missing
3. Backup mode uses env var (should be config-only)
4. No replay attack protection (need nonces + signatures)
5. Weak token validation (only checks existence, not entropy)
HIGH issues (4):
6. HTTPS cert validation concern
7. No audit logging of replication attempts
8. Cascade replication not prevented
9. Information disclosure in error messages
Status: NOT PRODUCTION READY - security TODO stubs present
|
2026-04-02 01:02:36 -04:00 |