🔒 security(release): ship v1.4.3 hardening pass by scttbnsn · Pull Request #138 · CodesWhat/sockguard

scttbnsn · 2026-07-20T16:39:11Z

Summary

close embedded-resource and stale-name-cache owner isolation gaps
gate image/plugin registry pushes behind the exfiltration acknowledgement
enforce Vercel browser headers and hardened Helm pod defaults
include the stable blind-write runtime fix already on main
publish voice-matched v1.4.3 changelog, README/roadmap, site version, chart metadata, release guide, docs, and security report

Verification

lefthook run pre-push (GoReleaser snapshot, golangci-lint, race suite, govulncheck, fuzz smoke, dedupe, Knip, Biome, 89 tests, static builds, clean-tree)
zizmor .github/workflows — no findings (10 ignored, 22 suppressed)
helm lint chart/sockguard
helm template sockguard chart/sockguard
exact v1.4.3 CHANGELOG extraction
generated-doc secret pattern scan — clean

Release choreography

After merge and exact v1.4.3 tag verification, merge this stable line forward into dev/v1.5, prepare v1.5.0-rc.2, and reset the v1.5 stable soak.

gate_status: skill

Exercise exact and wildcard image/plugin push rules across global and named-client policy, including the explicit acknowledgement path. gate_status: skill

Treat image and plugin pushes as local-artifact exfiltration surfaces even though the Docker API exposes them as writes, while retaining the existing opt-in key for compatibility. gate_status: skill

Parse the deployed Vercel policy contract and require the catch-all CSP, anti-framing, MIME, referrer, permissions, image-origin, and script-origin invariants. gate_status: skill

Apply a root catch-all Vercel policy for the marketing and copied docs exports, preserving static Next.js and same-origin analytics compatibility without enabling unsafe-eval or external script origins. gate_status: skill

Render the actual DaemonSet and require non-root identity, runtime-default seccomp, read-only filesystem, no escalation, dropped capabilities, and supplemental socket-group compatibility. gate_status: skill

Default the pod to Chainguard UID/GID 65532 with runAsNonRoot and RuntimeDefault seccomp while preserving the documented supplemental Docker-socket group override. gate_status: skill

Document the embedded ownership boundary, fresh authorization semantics, push exfiltration acknowledgement, Vercel policy, Helm hardening, migration impact, regression evidence, and scanner disposition in Sockguard’s established release-note voice. gate_status: exempt

gate_status: skill

gate_status: exempt

gate_status: skill

vercel · 2026-07-20T16:39:17Z

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
sockguard-website	Ready	Preview, Comment	Jul 20, 2026 4:42pm

coderabbitai · 2026-07-20T16:39:21Z

Warning

Review limit reached

@scttbnsn, you've reached your PR review limit, so we couldn't start this review.

Next review available in: 4 minutes

Enable usage-based reviews in Billing to review now. Otherwise, wait until the next included review is available.
You're only billed for reviews past your plan's rate limits ($0.25/file).

How can I continue?

After more reviews become available, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews.

How do review limits work?

CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability.

For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window.

Please refer docs for additional details.

Review details

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro Plus

Run ID: 6b15d17d-9af4-419b-86b4-cd4cd9a8324a

📥 Commits

Reviewing files that changed from the base of the PR and between 99e1c47 and 7222c75.

⛔ Files ignored due to path filters (1)

CHANGELOG.md is excluded by !CHANGELOG.md

📒 Files selected for processing (21)

README.md
RELEASING.md
app/integration/docker_integration_test.go
app/internal/cmd/rules.go
app/internal/cmd/rules_test.go
app/internal/ownership/coverage_gap_test.go
app/internal/ownership/middleware.go
app/internal/ownership/middleware_test.go
chart/sockguard/Chart.yaml
chart/sockguard/templates/daemonset.yaml
chart/sockguard/values.yaml
docs/content/docs/configuration.mdx
docs/content/docs/security.mdx
knip.json
scripts/helm-security-context.test.mjs
scripts/security-headers.test.mjs
security_best_practices_report.md
vercel.json
website/src/app/page-data.test.mjs
website/src/lib/site-config.ts
website/src/lib/site-content.ts

✨ Finishing Touches

🧪 Generate unit tests (beta)

Create PR with unit tests
Commit unit tests in branch codex/security-release-v1.4.3

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

_{Comment @coderabbitai help to get the list of available commands.}

scttbnsn · 2026-07-20T17:03:04Z

@coderabbitai review

coderabbitai · 2026-07-20T17:03:11Z

✅ Action performed

Review finished.

Note: CodeRabbit is an incremental review system and does not re-review already reviewed commits. This command is applicable only when automatic reviews are paused.

scttbnsn added 12 commits July 20, 2026 12:22

🧪 test(ownership): cover embedded refs and mutable names

ee2720e

gate_status: skill

🔒 security(ownership): authorize embedded workload refs

36a9946

gate_status: skill

🧪 test(config): cover registry-push exfiltration gates

530bc52

Exercise exact and wildcard image/plugin push rules across global and named-client policy, including the explicit acknowledgement path. gate_status: skill

🔒 security(config): gate registry-push exfiltration

85eacd2

Treat image and plugin pushes as local-artifact exfiltration surfaces even though the Docker API exposes them as writes, while retaining the existing opt-in key for compatibility. gate_status: skill

🧪 test(web): lock hosting-layer security headers

775f23a

Parse the deployed Vercel policy contract and require the catch-all CSP, anti-framing, MIME, referrer, permissions, image-origin, and script-origin invariants. gate_status: skill

🔒 security(web): enforce browser hardening headers

380c3c0

Apply a root catch-all Vercel policy for the marketing and copied docs exports, preserving static Next.js and same-origin analytics compatibility without enabling unsafe-eval or external script origins. gate_status: skill

🧪 test(chart): lock rendered workload confinement

ffc8577

Render the actual DaemonSet and require non-root identity, runtime-default seccomp, read-only filesystem, no escalation, dropped capabilities, and supplemental socket-group compatibility. gate_status: skill

🔒 security(chart): pin nonroot identity and seccomp

73a73b5

Default the pod to Chainguard UID/GID 65532 with runAsNonRoot and RuntimeDefault seccomp while preserving the documented supplemental Docker-socket group override. gate_status: skill

🔒 security(chart): render hardened pod context

00b6c08

gate_status: skill

🔧 chore(release): prepare v1.4.3 security patch

40543be

gate_status: exempt

🔧 chore(knip): register Helm test binary

b3c3084

gate_status: skill

scttbnsn requested review from ALARGECOMPANY and biggest-littlest as code owners July 20, 2026 16:39

vercel Bot deployed to Preview July 20, 2026 16:41 View deployment

🧪 test(integration): mirror image ownership defaults

7222c75

vercel Bot deployed to Preview July 20, 2026 16:42 View deployment

scttbnsn mentioned this pull request Jul 20, 2026

🔒 security(v1.5): carry remediation pass into rc.2 #139

Merged

biggest-littlest approved these changes Jul 20, 2026

View reviewed changes

scttbnsn merged commit 41b7fe8 into main Jul 20, 2026
46 checks passed

scttbnsn deleted the codex/security-release-v1.4.3 branch July 20, 2026 17:39

scttbnsn mentioned this pull request Jul 20, 2026

🔒 security(web): load headers from Vercel project root #140

Merged

7 tasks

Navigation Menu

Uh oh!

Uh oh!

🔒 security(release): ship v1.4.3 hardening pass - #138

🔒 security(release): ship v1.4.3 hardening pass#138
scttbnsn merged 13 commits into
mainfrom
codex/security-release-v1.4.3

scttbnsn commented Jul 20, 2026

Uh oh!

vercel Bot commented Jul 20, 2026 •

edited

Loading

Uh oh!

coderabbitai Bot commented Jul 20, 2026 •

edited

Loading

Review limit reached

Uh oh!

scttbnsn commented Jul 20, 2026

Uh oh!

coderabbitai Bot commented Jul 20, 2026 •

edited

Loading

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Uh oh!

Uh oh!

Conversation

scttbnsn commented Jul 20, 2026

Summary

Verification

Release choreography

Uh oh!

vercel Bot commented Jul 20, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

coderabbitai Bot commented Jul 20, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Review limit reached

Uh oh!

scttbnsn commented Jul 20, 2026

Uh oh!

coderabbitai Bot commented Jul 20, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

vercel Bot commented Jul 20, 2026 •

edited

Loading

coderabbitai Bot commented Jul 20, 2026 •

edited

Loading

coderabbitai Bot commented Jul 20, 2026 •

edited

Loading