Repository navigation
Add comprehensive security and code audit report - #11
Merged
Merged
Conversation
Covers SQL injection risks, DoS vectors, data integrity issues, logic bugs, error handling gaps, and dependency concerns. https://claude.ai/code/session_01JEfnraWH1ASRcriZ6bGEEZ
Four original findings were addressed: SQL injection (sanitize_sql_string), content size limits (1MB cap), non-destructive consolidation (soft-delete), and store-before-delete replace ordering. Report now tracks 19 remaining issues (0 critical, 5 medium, 14 low) with priority recommendations. https://claude.ai/code/session_01JEfnraWH1ASRcriZ6bGEEZ
Validates 17 of 18 previously reported issues are fixed (config permissions excluded per user request). Identifies 10 new issues: 2 medium (NaN panic in sort, O(n^2) co-access growth) and 8 low severity. https://claude.ai/code/session_01JEfnraWH1ASRcriZ6bGEEZ
All 29 previously reported issues (19 round 1 + 10 round 2) are verified fixed or accepted. Fresh round 3 audit finds only 10 low-severity issues remaining — no critical, high, or medium issues. Codebase is in good security posture. https://claude.ai/code/session_01JEfnraWH1ASRcriZ6bGEEZ
- Read back embedding vectors from Arrow batches in batch_to_items, eliminating unnecessary re-embedding in expire_item - Fix detect_clusters to use bidirectional CTE for correct triangle detection - Fix rate limiter off-by-one where compare_exchange failure skipped counting - Fix transfer_edges to log row deserialization errors instead of silently dropping - Fix access_log ALTER TABLE migration to only silence "duplicate column" errors - Add graceful shutdown with 2s timeout for background tasks - Retry vector index creation on each search_items call - Update MCP protocol version to 2025-03-26 - Fix CLAUDE.md graph_nodes schema to match code (NOT NULL DEFAULT '') - Delete AUDIT.md https://claude.ai/code/session_01JEfnraWH1ASRcriZ6bGEEZ
rendro
pushed a commit
that referenced
this pull request
Jan 31, 2026
…orrectness Critical fixes: - #1: Replace lock-free CAS rate limiter with Mutex to eliminate race condition - #2: Add retry loop to expire_item re-insert to prevent data loss after delete - #3: Escape backslashes in SQL sanitization alongside single quotes High severity fixes: - #4: Clean stale pending consolidation entries after 30 days (was unbounded) - #5: Record validation on NEW item instead of deleted old item on replace - #6: Transfer graph edges before removing old node on replace (was losing all relationships) Medium severity fixes: - #7: Filter input IDs from get_neighbors results to prevent self-references - #8: Normalize co-access edge direction (smaller ID first) to prevent duplicates - #9: Recompute similarity from embeddings during consolidation instead of using stale scores - #10: Cap search limit inside search_items to prevent overflow before min(100) - #11: Stricter YAML detection requiring identifier-like keys (prevents false positives on prose) - #12: Log PRAGMA failures instead of silently ignoring them Low severity fixes: - #13: Remove unused sha2 dependency - #14: Delete chunks belonging to expired items during cleanup - #15: Use i32::try_from for chunk_index instead of silent truncation - #16: Wrap background tasks with spawn_logged to catch and log panics - #17: Change ListScope default from All to Project to match tool schema - #18: Use atomic temp-file-then-rename for project config to prevent TOCTOU race Added 15 new tests covering all major fixes. All 50 tests pass, clippy clean, fmt clean. https://claude.ai/code/session_01SHu7vSzBbG33DzYec2DFqe
rendro
pushed a commit
that referenced
this pull request
Jan 31, 2026
…erge, more Test-driven fixes for bugs identified in AUDIT.md: - Bug #4 (Critical): remove_node now preserves incoming SUPERSEDES edges, fixing broken provenance lineage in the replace workflow - Bug #3 (High): get_neighbors query bounded with LIMIT 100 - Bug #8 (High): Consolidation semaphore uses try_acquire_owned so the permit is dropped automatically on panic (no more permanent deadlock) - Bug #11 (Medium): process_candidate skips merging items from different projects, linking them instead with "cross_project_similar" label - Bug #7 (Medium): Rate limiter restructured to check count after increment, fixing off-by-one that allowed 61 calls per window instead of 60 - Bug #25 (Low): truncate handles max_len <= 3 without usize underflow panic - Bug #12 (Medium): Chunk threshold uses chars().count() not byte len(), preventing premature chunking of multi-byte UTF-8 content - Bug #15 (Info): Documented intentional co-access truncation to top 3 8 new tests added (50 -> 58 total), all passing. Clippy clean, fmt clean. https://claude.ai/code/session_01MBryW37FRuaQBTRcdsFy5W
rendro
pushed a commit
that referenced
this pull request
Jan 31, 2026
Chunker (issues #4, #5): - Use chars().count() instead of .len() for chunk threshold check - Ensure all byte offsets in split_by_chars land on UTF-8 char boundaries - Added tests: multibyte threshold, CJK splitting, mixed content Retry (issue #10): - Use checked_shl/saturating_mul to prevent overflow panic on large attempts - Added test: delay_for_attempt with attempt=64 and attempt=99 Recall (issue #6): - Added 100KB query size limit to prevent OOM during tokenization Unwrap elimination (issues #13, #14): - Replace all serde_json::to_string_pretty().unwrap() with unwrap_or_else - Replace Arrow StringArray downcast unwrap with graceful fallback Atomic ordering (issue #12): - Change recall_count from Relaxed to AcqRel ordering Path leakage (issue #9): - Provenance now stores only directory name, not full filesystem path Dangling edges (issue #11): - Validate related IDs exist in LanceDB before creating graph edges - Ensure target nodes exist in graph before creating edges Score transparency (issue #8): - Track raw_similarity alongside boosted similarity in recall results - Include raw_similarity in JSON output when it differs from boosted score Data loss prevention (issue #2): - expire_item: emergency recovery re-inserts original item if update fails Graceful shutdown (issue #7): - Wait up to 10s for consolidation semaphore before shutdown - Increased runtime shutdown timeout from 2s to 5s Cross-database atomicity (issues #1, #3): - Replace workflow now aborts with compensation on transfer_edges failure - Deletes new item and graph node if edge transfer fails - Preserves original item instead of leaving inconsistent state https://claude.ai/code/session_01WLA4gnq7gQrAgquAVB4p8r
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Covers SQL injection risks, DoS vectors, data integrity issues,
logic bugs, error handling gaps, and dependency concerns.
https://claude.ai/code/session_01JEfnraWH1ASRcriZ6bGEEZ