# Manara Cyber — Security review and hardening

Date: 2026-10-20. Scope: the site's first-party HTML, CSS, JavaScript modules, import flow, report export and deployment access configuration. This is a bounded engineering review, not a penetration-test certification or a claim that every vulnerability was tested.

## Confirmed issues and changes

| ID | Finding before the change | Impact and evidence | Resolution |
|---|---|---|---|
| MC-A01 | Credential masking missed Authorization values; evidence was truncated before masking | Synthetic Bearer text and a long password appeared in another rule's report evidence. Risk arises when the user shares the report; no outside exfiltration was observed. | Sensitive-indicator lines withheld before truncation; all source evidence omitted from JSON, Markdown and printed/PDF exports. Filenames remain; review before sharing. |
| MC-A02 | Findings were unbounded and analysis ran on the UI thread | 180 KB of repeated suspicious calls produced 20,000 finding records. Rendering all records could exhaust tab resources. No server denial-of-service was established. | Analysis moved to a terminable module worker with a 10-second deadline. At most 500 findings retained; the matched total and explicit truncation notice are reported. |
| MC-A03 | Aggregate GitHub import budget trusted declared file sizes before downloading | A mocked tree declaring tiny sizes could exceed the intended aggregate limit when the actual response sizes were larger. | Remaining byte budget enforced while streaming, actual UTF-8 bytes counted, consistent revision pinned for root-repository imports. |
| MC-A04 | Language allowlist could resolve inherited object properties | Names such as constructor were treated as supported even though no applicable rules ran. This was a validation defect, not prototype pollution or code execution. | Own-property allowlist lookup and shared file validation. |

## Defense-in-depth changes

- Early HTML CSP: local scripts/styles/images/fonts/workers only; network fetches limited to public GitHub API and raw content domains; no inline scripts/eval, objects, frames, base URL changes or form submissions.
- External Google Fonts CSS removed. No third-party application scripts or runtime npm dependencies added.
- Cloudflare `_headers` template supplied with CSP framing restrictions (self and ChatGPT origins), nosniff, no-referrer, restricted browser permissions and HSTS. **These response headers are configured, but were not verified on an authenticated production response.** The HTML meta policy was verified in the local browser; meta CSP cannot enforce frame-ancestors.
- URL validation rejects non-HTTPS, credentials, unapproved hosts, private-address URLs, controls, ambiguous encoded separators and dot segments. Downloads refuse redirects, omit credentials and suppress referrers. Import fetches occur in the user's browser, so this flow is not server-side SSRF.
- Shared limits: 50 files, 250,000 bytes per file, 2,000,000 bytes aggregate; reject binary NUL content and misleading control/bidi filenames. GitHub API response shapes and file metadata validated.
- Failed or cancelled scans clear the prior report instead of leaving stale results appearing current.
- JSON/Markdown/PDF exports omit source evidence. UI evidence is best-effort masked; no heuristic can identify every sensitive business value. File names can also be sensitive.

## OWASP Top 10:2025 applicability review

| Area | Review outcome and boundary |
|---|---|
| A01 Access control | Sites configuration is owner-private. An unauthenticated production request returned HTTP 401. No multi-user API or database exists in this app; platform authorization internals were not tested. |
| A02 Misconfiguration | Added CSP/meta and response-header configuration; authenticated response-header enforcement remains unverified. |
| A03 Supply chain | No third-party runtime packages or scripts. Removed remote fonts. Hosting/browser/runtime supply-chain controls are outside app ownership. |
| A04 Cryptography | HTTPS Site URL and no first-party password/key storage or crypto implementation. Provider TLS lifecycle and session internals were not audited. |
| A05 Injection | Reviewed rendering paths: input/evidence inserted with textContent, never evaluated. Browser smoke test displayed hostile img/onerror markup literally without executing it. Demo attack strings and detection regexes are data, not executed server commands. |
| A06 Insecure design | Addressed excessive result generation, export disclosure and budgets. Scanner remains heuristic; absence of findings does not establish safety. |
| A07 Authentication | Authentication handled by Sites; no custom login/password/JWT backend. Brute-force and account-recovery controls were not tested. |
| A08 Integrity | Root repository import pinned to a commit SHA. No uploaded code or package lifecycle scripts are run. Single-file links are snapshots at fetch time. |
| A09 Logging | Source code, reports and secrets are not logged by first-party app code or persisted to browser storage. Hosting/security logs are provider-controlled and were not independently audited. |
| A10 Exceptional conditions | Bounded streaming, response validation, errors, worker timeout/cancellation, stale-report clearing and output caps. External GitHub availability remains a dependency. |

## Validation

- 21 automated tests passed: existing rule/safe-input tests plus regressions for credential masking, export privacy, resource limits, URL restrictions, inherited-property allowlist bug, redirect/credential options, oversized stream cancellation, inconsistent metadata, revision pinning and CSP/source invariants.
- Browser smoke checks passed with CSP active: demo scan returned six findings using the worker; hostile markup rendered as plain text; Authorization evidence was withheld.
- Running this project's own heuristic scanner produced matches in its bundled demo strings and rule text. They were manually distinguished from executable application paths. This self-scan is not an independent security audit.
- No active attack traffic, load testing, authenticated production exploitation, infrastructure scanning or end-to-end live GitHub import was performed. The GitHub integration's network/error paths were tested with controlled responses.

## Researched infrastructure templates

1. Cloudflare Workers static-assets `_headers`: used as the configuration format for the supplied baseline. This fits the current static architecture.
2. Cloudflare Workers templates: relevant when adding a real server endpoint, such as an optional AI gateway; no framework migration was made for the current local scanner.
3. HTML5 Boilerplate Nginx configs: a useful starting point for future self-hosting; not installed because this site does not run Nginx.
4. OWASP ASVS: used to guide scope and identify controls requiring separate validation; no compliance or certification claimed.

A template cannot prevent every attack. If AI is added, introduce server-side key storage, authentication/quotas, provider disclosure, minimal context, prompt-injection controls, output validation and spend limits; the current browser-local privacy statement must change for that optional mode.

## Sources

- https://top10.owasp.org/2025/
- https://owasp.org/projects/asvs
- https://cheatsheetseries.owasp.org/cheatsheets/Content_Security_Policy_Cheat_Sheet.html
- https://cheatsheetseries.owasp.org/cheatsheets/File_Upload_Cheat_Sheet.html
- https://developers.cloudflare.com/workers/static-assets/headers/
- https://developers.cloudflare.com/workers/get-started/quickstarts/
- https://github.com/h5bp/server-configs-nginx