Mark/devforge
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

[Security] MEDIUM: 5 issue(s) found in devforge #36

New issue
Closed
opened 2026-05-14 23:23:58 +00:00 by Mark · 2 comments
Mark commented 2026-05-14 23:23:58 +00:00
Owner
Copy link

Security Scan Results for devforge

Severity: MEDIUM
Findings: 5

1. docker_root_user

  • Details: Dockerfile does not set a non-root USER — container runs as root
  • File: templates/oh-my-opencode-lite/Dockerfile

2. docker_root_user

  • Details: Dockerfile does not set a non-root USER — container runs as root
  • File: templates/oh-my-opencode/Dockerfile

3. docker_root_user

  • Details: Dockerfile does not set a non-root USER — container runs as root
  • File: services/web/Dockerfile

4. docker_root_user

  • Details: Dockerfile does not set a non-root USER — container runs as root
  • File: services/orchestrator/Dockerfile

5. docker_root_user

  • Details: Dockerfile does not set a non-root USER — container runs as root
  • File: services/api/Dockerfile

This issue was auto-generated by the security sweep cron job.

## Security Scan Results for `devforge` **Severity:** MEDIUM **Findings:** 5 ### 1. docker_root_user - **Details:** Dockerfile does not set a non-root USER — container runs as root - **File:** `templates/oh-my-opencode-lite/Dockerfile` ### 2. docker_root_user - **Details:** Dockerfile does not set a non-root USER — container runs as root - **File:** `templates/oh-my-opencode/Dockerfile` ### 3. docker_root_user - **Details:** Dockerfile does not set a non-root USER — container runs as root - **File:** `services/web/Dockerfile` ### 4. docker_root_user - **Details:** Dockerfile does not set a non-root USER — container runs as root - **File:** `services/orchestrator/Dockerfile` ### 5. docker_root_user - **Details:** Dockerfile does not set a non-root USER — container runs as root - **File:** `services/api/Dockerfile` --- *This issue was auto-generated by the security sweep cron job.*
Mark commented 2026-05-20 22:37:10 +00:00
Author
Owner
Copy link

GSD VERIFY phase failed after 3 attempts.
═══ Gate: verify-passed (devforge#36) ═══
Mode: Tier 1 (functional only)

GATE OK: All gates up to 'implement' pass
── Tier 1: Functional ────────────────────────────────
Running tests...
❌ Tests failed (exit 1)
 FAIL  services/web/src/utils/terminalUtils.test.ts > terminalUtils > decodeTerminalMessage > should return empty Uint8Array for Blob input in sync decoder
 FAIL  services/web/src/utils/terminalUtils.test.ts > terminalUtils > debug mode > should return false when debug is not enabled
 FAIL  services/web/src/utils/terminalUtils.test.ts > terminalUtils > debug mode > should return true when debug is enabled
 FAIL  services/web/src/utils/terminalUtils.test.ts > terminalUtils > debug mode > should disable debug mode
ReferenceError: localStorage is not defined
 ❯ services/web/src/utils/terminalUtils.test.ts:12:5
 10|  beforeEach(() => {
 11|  vi.restoreAllMocks();
 12|  localStorage.clear();
 |  ^
 13|  });
 14| 

⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯[4/9]⎯

 Test Files  4 failed | 1 passed (5)
 Tests  6 failed | 4 passed (10)
 Start at  15:37:08
 Duration  661ms (transform 439ms, setup 0ms, import 115ms, tests 9ms, environment 1ms)
Running linter...
✅ Lint clean
⚠️ No type checker discovered
No previous test result to compare

❌ GATE FAIL: verify-passed
- Tests failed with exit code 1
GATE FAIL: verify — blocked at 2026-05-20T22:37:10Z
Class: test-failure
Evidence: Verification failed: 1 failures
Git tag: devforge#36-gate-verify-fail-4aba53ac0ab2 (use gate-retry after fixing)

GSD VERIFY phase failed after 3 attempts. ═══ Gate: verify-passed (devforge#36) ═══ Mode: Tier 1 (functional only) GATE OK: All gates up to 'implement' pass ── Tier 1: Functional ──────────────────────────────── Running tests... ❌ Tests failed (exit 1)  FAIL  services/web/src/utils/terminalUtils.test.ts > terminalUtils > decodeTerminalMessage > should return empty Uint8Array for Blob input in sync decoder  FAIL  services/web/src/utils/terminalUtils.test.ts > terminalUtils > debug mode > should return false when debug is not enabled  FAIL  services/web/src/utils/terminalUtils.test.ts > terminalUtils > debug mode > should return true when debug is enabled  FAIL  services/web/src/utils/terminalUtils.test.ts > terminalUtils > debug mode > should disable debug mode ReferenceError: localStorage is not defined  ❯ services/web/src/utils/terminalUtils.test.ts:12:5  10|  beforeEach(() => {  11|  vi.restoreAllMocks();  12|  localStorage.clear();  |  ^  13|  });  14|  ⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯[4/9]⎯  Test Files  4 failed | 1 passed (5)  Tests  6 failed | 4 passed (10)  Start at  15:37:08  Duration  661ms (transform 439ms, setup 0ms, import 115ms, tests 9ms, environment 1ms) Running linter... ✅ Lint clean ⚠️ No type checker discovered No previous test result to compare ❌ GATE FAIL: verify-passed - Tests failed with exit code 1 GATE FAIL: verify — blocked at 2026-05-20T22:37:10Z Class: test-failure Evidence: Verification failed: 1 failures Git tag: devforge#36-gate-verify-fail-4aba53ac0ab2 (use gate-retry after fixing)
Mark commented 2026-05-23 17:36:54 +00:00
Author
Owner
Copy link

Fixed: Added non-root USER to all 5 Dockerfiles:

  • templates/oh-my-opencode-lite/Dockerfile → appuser
  • templates/oh-my-opencode/Dockerfile → appuser
  • services/web/Dockerfile → nginx
  • services/orchestrator/Dockerfile → appuser
  • services/api/Dockerfile → appuser

Commit: ce70c11

Fixed: Added non-root USER to all 5 Dockerfiles: - templates/oh-my-opencode-lite/Dockerfile → appuser - templates/oh-my-opencode/Dockerfile → appuser - services/web/Dockerfile → nginx - services/orchestrator/Dockerfile → appuser - services/api/Dockerfile → appuser Commit: ce70c11
Mark closed this issue 2026-05-23 17:36:54 +00:00
Sign in to join this conversation.
No Branch/Tag specified
Branches Tags
main
No results found.
Labels
Clear labels   
blocked:gate-plan

   
blocked:gate-research

   
blocked:lint-failed

   
blocked:needs-attention

Issue requires human attention to resolve

  
blocked:needs-decision

   
blocked:no-changes

   
blocked:no-procedure

   
blocked:verify-failed

   
bug

Bug report

  
chore

Config / cleanup / ops housekeeping

  
feature-request

   
in-progress

   
needs-research

Ready for research pipeline

  
ops-task

Operations task — install, configure, deploy, API calls

  
quickfix

   
security/medium

Medium severity security issue

  
triage-approved
No labels
blocked:gate-plan
blocked:gate-research
blocked:lint-failed
blocked:needs-attention
blocked:needs-decision
blocked:no-changes
blocked:no-procedure
blocked:verify-failed
bug
chore
feature-request
in-progress
needs-research
ops-task
quickfix
security/medium
triage-approved
Milestone
Clear milestone
No items
No milestone
Projects
Clear projects
No items
No project
Assignees
Clear assignees
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference
Mark/devforge#36
No description provided.