rustfs/.agents/skills/adversarial-validation/references/security.md

Security Lens

Use security-advisory-lessons only for a dedicated advisory/security audit. For an ordinary matched diff, attack these boundaries:

• Admin routes: route registration, whitelist, handler authn, and the exact AdminAction must agree. Read-only diagnostics still require admin authz.
• IAM/service accounts: treat parent, claims, keys, groups, status, and policy names as attacker-controlled; prove ownership/root authority before writes.
• Protocol frontends: every changed/sibling command authorizes the matching S3 action before reaching storage.
• Secrets/signatures: use constant-time comparison, normalize public failures, keep RPC/root/STS keys independent, and fail closed when secrets are absent.
• RPC: bind signatures to the exact method/path and timestamp; reject replay, stale, malformed, truncated, and invalid-enum payloads without panic.
• Paths/object/archive entries: reject traversal, absolute/platform escapes, and normalization differences between authz and storage.
• Copy/multipart/presigned POST: enforce source, destination, version-aware actions, copy-source conditions, and every signed policy condition.
• Logging/errors: never expose credentials, tokens, expected signatures, raw secret-bearing input, or merged configs—including via Debug and parse errors.
• Untrusted serde: reject unknown fields where compatible and validate security-critical defaults/ranges before numeric conversion.
• SSE/browser/CORS/trusted proxy: inspect stored ciphertext and wrapper order; isolate user content; never reflect credentialed arbitrary origins or trust forwarded identity from direct clients.
• Object Lock: unreadable/fabricated/unparsable metadata fails closed across foreground, lifecycle, scanner, and force-delete paths.

Security findings distinguish unauthenticated compromise from a low-privileged authenticated bypass.