Repository navigation
feat: adaptive CAPTCHA, deploy freeze windows, SBOM diff comments, and config parity drift detection - #939
Merged
Dydex merged 1 commit intoOct 17, 2026
Conversation
… PR diff, and config parity drift detection Security - Add adaptive CAPTCHA (AstronLabs#934): challenge only when risk signals fire (repeated failures, bad reputation, unusual request rate, stuffing lockout). Tokens are HMAC-signed, verified server-side, bound to one action and source, and single-use. Includes an accessible text challenge, a delayed assisted fallback, and a support contact. Applied to /api/auth/register and /api/admin/2fa/verify. DevOps - Add deployment freeze windows (AstronLabs#930): version-controlled calendar with month-end rule, a deploy-freeze gate in blue-green-deploy.yml, logged authorized overrides (person + reason), and freeze announcements. - Add SBOM diff PR comments (AstronLabs#929): single updating comment listing added/removed/upgraded packages with licenses, flagging disallowed licenses and OSV vulnerabilities. - Add staging/production config parity drift detection (AstronLabs#931): scheduled secret-free snapshots, allowlist of expected differences, new-drift alerts and first-seen history.
|
@Levi-Ojukwu Great news! 🎉 Based on an automated assessment of this PR, the linked Wave issue(s) no longer count against your application limits. You can now already apply to more issues while waiting for a review of this PR. Keep up the great work! 🚀 |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Resolves #934, #930, #929, #931.
closes #934 Adaptive CAPTCHA
POST /api/auth/registerandPOST /api/admin/2fa/verify; new/api/captcha/{challenge,solve,assisted}routes. The credential-stuffing guard lets a challenged user with a valid token through.docs/ADAPTIVE_CAPTCHA.md.closes #930 Deployment freeze windows
devops/deploy-freeze-calendar.json(month-end rule plus one-off windows; start inclusive, end exclusive).Deploy Freeze Gatejob inblue-green-deploy.ymlblocks production deploys during a freeze unless an authorized override with a reason is supplied (freeze_override_reason).docs/DEPLOYMENT_FREEZE.md.closes #929 SBOM diff PR comments
sbom-diff.ymlbuilds SBOMs for base and head, diffs them withscripts/sbom-diff.mjs, and maintains a single updating PR comment.scripts/license-allowlist.json, SPDX expressions supported) and known vulnerabilities (OSV).closes #931 Config parity drift
config-parity-drift.ymlsnapshots non-secret config, versions and flags from staging and production every 6h and compares them againstdevops/config-parity-allowlist.json.config-drift-historybranch.docs/CONFIG_PARITY_DRIFT.md.Testing
backend:npx jest src/__tests__/adaptiveCaptcha.test.ts src/__tests__/credentialStuffing.test.ts(20 passing): triggers, verification, action/source binding, replay, forgery, expiry, assisted path.node --test scripts/{deploy-freeze-gate,sbom-diff,config-parity-drift}.test.mjs(window boundaries, month-end/leap year, overrides, SBOM diff/licenses/vulns with sample SBOMs, fixture environments).auth.test.tshas 2 failures that also fail onmain; not related.Reviewer notes
authorizedOverriderscurrently contains onlyLevi-Ojukwu; replace with the real release managers.CAPTCHA_SECRETon every instance./remitmortgage/<env>/flags/; adjust if flags live elsewhere. Allowlistexpectvalues for CPU/memory/sampler ratio should be confirmed.