Security Audit Findings - February 2026

[jamestexas]

This issue tracks the security vulnerabilities identified during the comprehensive audit conducted on February 16, 2026. The specific findings are detailed in the linked sub-issues.

• Security: Incomplete RequireRefProtection Implementation in GitHub OIDC Provider #66 Incomplete RequireRefProtection Implementation
• Security: Incomplete Private Key Zeroization for ML-DSA-44 #67 Incomplete Private Key Zeroization (ML-DSA-44)
• Security: Predictable Temporary Socket Path for Signet Agent #68 Predictable Temporary Socket Path
• Security: Missing MaxBytesReader Enforcement in Middleware #69 Missing MaxBytesReader Enforcement

[jamestexas]

Status update: 3 of 4 sub-issues resolved.

• Security: Incomplete RequireRefProtection Implementation in GitHub OIDC Provider #66 Incomplete RequireRefProtection — closed
• Security: Predictable Temporary Socket Path for Signet Agent #68 Predictable Temporary Socket Path — closed
• Security: Missing MaxBytesReader Enforcement in Middleware #69 Missing MaxBytesReader Enforcement — closed
• Security: Incomplete Private Key Zeroization for ML-DSA-44 #67 ML-DSA-44 Private Key Zeroization — open, blocked on upstream cloudflare/circl API limitation. Best-effort zeroization is in place (serialized buffer is zeroed), but opaque internal struct fields cannot be cleared until circl exposes a Zeroize() method. Acceptable for ephemeral keys; documented as a known limitation for long-lived keys.