Hacktoberfest 2026: the issues maintainers tagged for October, open and beginner-friendly. Browse Hacktoberfest issues

[LAUNCH-E M5+R6, Medium] Separate environment allow-lists per execution class and warn on credential-looking allow-list names

Open
  • Is something wrong?
#286 0 comments 0 reactions 0 assignees View on GitHub

Maintainers usually reply within 1 day

Nobody has claimed this yet.

Assessment

Difficulty
4/5
Estimated time
3-5 days
Newbie friendliness
48/100
Issue type
Feature
Clarity
Clearly specified
Activity status
Active
Tech stack
python
Domain
security

Research direction

Start with the allow-list configuration and launch call sites in src/autoforge/config.py and src/autoforge/engine.py, then trace filtering in src/autoforge/child_env.py and src/autoforge/sdk_policy.py. Read the security audit notes in docs/security.md and run the relevant tests to map each launch class. Done means separate backward-compatible allow-lists, warnings for credential-looking names, updated security/configuration/usage docs, and passing make check.

Written by the indexing model from the issue text.

Description

enhancement

Artifact: follow-up issue for audit findings M5 (Medium) and R6 (proposed as an accepted residual, reclassified to Medium by the maintainer on #257) of the LAUNCH-E security audit (#257, PR #279). This issue body is the authoritative copy. Audited commit: 388ecb3b9d6376f8914054cc06ea5e5caab164da (main); line numbers below are at that commit.

Parent: #255 · Audit: #257 · Audit PR: #279 · Severity: Medium (both)

Summary

  • M5: execution.env_allowlist and env_allowlist_extra apply to every launch class alike. A name added for a validation command reaches every agent, and one added for an agent (Pi's API key, for example) reaches the candidate's code run by validation and pre-merge commands.
  • R6: the allow-list refuses only the names gh and git read a credential from (GH_TOKEN, GITHUB_*, GH_*, ...). A GitHub token the operator forwards under a name of their own (GITHUB_PAT, MY_GITHUB_PAT, or through a broad prefix such as H*) is accepted and reaches every launch; the SDK filter keeps such a name too. An enforced sandbox does not close this, so it is not an accepted residual under #257's rubric; it is an easy-to-misconfigure boundary.

Evidence (at 388ecb3)

  • src/autoforge/config.py:316-317,1296-1306; src/autoforge/engine.py:5337,5836,9586 (one allow-list at each call site).
  • src/autoforge/child_env.py:143-172,273-295; src/autoforge/sdk_policy.py:207-209.
  • Disclosed in docs/security.md ("Other limits": one allow-list for every launch); the overstated "no credential variable can be listed" wording is corrected by PR #279.

Scope

  1. Separate allow-lists per execution class (agent launches; repository commands: LOCAL validation, REMOTE validator, pre-merge), with backward-compatible defaults and strict key validation.
  2. Warn (in doctor and at config load) on allow-listed names or prefixes that look like credentials (*TOKEN*, *PAT*, *SECRET*, *PASSWORD*, *GITHUB*), and refuse prefixes broad enough to cover a refused credential name's neighbours if that can be done without false positives; document the rule.
  3. Update docs/configuration.md, docs/security.md and docs/usage.md.

Acceptance criteria

  • A variable allow-listed only for repository commands does not reach an agent, and vice versa; tests cover each launch class.
  • A credential-looking allow-list entry produces a visible warning (or refusal), tested with dummy names.
  • make check passes.
Dominant language
Python
Stars
0
Forks
0
Avg merge
5h 57m
Merged PRs (30d)
71

Getting set up

This project ships no dev container, Dockerfile or contributing guide, so setting up is up to you: start from its README, and see our first-contribution guide for the general steps.

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

More from iceboundrock/AutoForge

All issues in iceboundrock/AutoForge

Similar issues

More Python issues

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.