dirtydishes/islandflow
1
0
Fork 0
Code Issues 2 Pull requests 4 Projects Releases Packages Wiki Activity Actions 1

Add attack surface audit artifacts
Some checks failed
CI / Validate (pull_request) Has been cancelled
Details

Browse source 
- Add advisory, entrypoint, and candidate scan outputs
- Capture dependency intelligence and cross-service attack surface notes
This commit is contained in:
dirtydishes 2026-05-28 05:13:36 -04:00
parent a35a757622
commit 47a5adca90
26 changed files with 2807 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

35
piolium/attack-surface/cross-service-edges.json Normal file
View file

@ -0,0 +1,35 @@
{
"single_service": false,
"services": [
{"name":"web","root":"apps/web/","language":"typescript","frameworks":["nextjs"]},
{"name":"api","root":"services/api/","language":"typescript","frameworks":["bun","websocket"]},
{"name":"ingest-options","root":"services/ingest-options/","language":"typescript","frameworks":["nats","clickhouse"]},
{"name":"ingest-equities","root":"services/ingest-equities/","language":"typescript","frameworks":["nats","clickhouse"]},
{"name":"ingest-news","root":"services/ingest-news/","language":"typescript","frameworks":["nats"]},
{"name":"compute","root":"services/compute/","language":"typescript","frameworks":["nats","clickhouse"]},
{"name":"candles","root":"services/candles/","language":"typescript","frameworks":["nats","clickhouse","redis"]},
{"name":"replay","root":"services/replay/","language":"typescript","frameworks":["nats"]}
],
"edges": [
{"id":"E001","channel":"http","producer":{"service":"web","file":"apps/web/app/api/admin/synthetic/shared.ts","line":51,"pattern":"fetch(url.toString(), { method, headers, body })"},"consumer":{"service":"api","file":"services/api/src/index.ts","line":1364,"pattern":"GET/PUT /admin/synthetic/*"},"data_shape":"admin synthetic status/control HTTP JSON body proxied from browser","sanitization_at_boundary":"API bearer token check; no browser-user auth in web proxy per authz matrix","trust_tagged":"web injects SYNTHETIC_ADMIN_TOKEN for caller"},
{"id":"E002","channel":"queue:options.prints","producer":{"service":"ingest-options","file":"services/ingest-options/src/index.ts","line":430,"pattern":"publishJson(js, SUBJECT_OPTION_PRINTS, print)"},"consumer":{"service":"replay/external","file":"packages/bus/src/subjects.ts","line":2,"pattern":"SUBJECT_OPTION_PRINTS = 'options.prints'"},"data_shape":"OptionPrint JSON","sanitization_at_boundary":"OptionPrintSchema.parse before publish; consumers schema-parse when present","trust_tagged":"none"},
{"id":"E003","channel":"queue:options.prints.signal","producer":{"service":"ingest-options","file":"services/ingest-options/src/index.ts","line":432,"pattern":"publishJson(js, SUBJECT_OPTION_SIGNAL_PRINTS, print)"},"consumer":{"service":"compute","file":"services/compute/src/index.ts","line":1501,"pattern":"subscribeJson(js, SUBJECT_OPTION_SIGNAL_PRINTS, opts)"},"data_shape":"signal-passing OptionPrint JSON","sanitization_at_boundary":"producer and compute parse OptionPrintSchema; no message authentication","trust_tagged":"signal_pass flag controls downstream processing"},
{"id":"E004","channel":"queue:options.prints.signal","producer":{"service":"ingest-options/replay","file":"services/replay/src/index.ts","line":407,"pattern":"publishJson(js, SUBJECT_OPTION_SIGNAL_PRINTS, event as OptionPrint)"},"consumer":{"service":"api","file":"services/api/src/index.ts","line":945,"pattern":"subscribeWithReset(SUBJECT_OPTION_SIGNAL_PRINTS, ...)"},"data_shape":"OptionPrint JSON for live API fanout","sanitization_at_boundary":"consumer OptionPrintSchema.parse in pump; no message authentication","trust_tagged":"none"},
{"id":"E005","channel":"queue:options.nbbo","producer":{"service":"ingest-options","file":"services/ingest-options/src/index.ts","line":460,"pattern":"publishJson(js, SUBJECT_OPTION_NBBO, nbbo)"},"consumer":{"service":"compute","file":"services/compute/src/index.ts","line":1537,"pattern":"subscribeJson(js, SUBJECT_OPTION_NBBO, opts)"},"data_shape":"OptionNBBO JSON","sanitization_at_boundary":"schema parse both ends; no message authentication","trust_tagged":"none"},
{"id":"E006","channel":"queue:equities.prints","producer":{"service":"ingest-equities","file":"services/ingest-equities/src/index.ts","line":266,"pattern":"publishJson(js, SUBJECT_EQUITY_PRINTS, print)"},"consumer":{"service":"compute","file":"services/compute/src/index.ts","line":1573,"pattern":"subscribeJson(js, SUBJECT_EQUITY_PRINTS, opts)"},"data_shape":"EquityPrint JSON","sanitization_at_boundary":"schema parse both ends; no message authentication","trust_tagged":"none"},
{"id":"E007","channel":"queue:equities.prints","producer":{"service":"ingest-equities","file":"services/ingest-equities/src/index.ts","line":266,"pattern":"publishJson(js, SUBJECT_EQUITY_PRINTS, print)"},"consumer":{"service":"candles","file":"services/candles/src/index.ts","line":341,"pattern":"subscribeJson(js, SUBJECT_EQUITY_PRINTS, resetOpts)"},"data_shape":"EquityPrint JSON","sanitization_at_boundary":"consumer EquityPrintSchema.parse; no message authentication","trust_tagged":"none"},
{"id":"E008","channel":"queue:equities.quotes","producer":{"service":"ingest-equities","file":"services/ingest-equities/src/index.ts","line":292,"pattern":"publishJson(js, SUBJECT_EQUITY_QUOTES, quote)"},"consumer":{"service":"ingest-options","file":"services/ingest-options/src/index.ts","line":476,"pattern":"subscribeJson<EquityQuote>(js, SUBJECT_EQUITY_QUOTES, ...)"},"data_shape":"EquityQuote JSON used to enrich option prints","sanitization_at_boundary":"schema parse at producer; consumer subscribes and later validates context; no message authentication","trust_tagged":"none"},
{"id":"E009","channel":"queue:equities.candles","producer":{"service":"candles","file":"services/candles/src/index.ts","line":188,"pattern":"publishJson(js, SUBJECT_EQUITY_CANDLES, candle)"},"consumer":{"service":"api","file":"services/api/src/index.ts","line":963,"pattern":"subscribeWithReset(SUBJECT_EQUITY_CANDLES, ...)"},"data_shape":"EquityCandle JSON for live fanout","sanitization_at_boundary":"candle schema parse before emit and API parse; no message authentication","trust_tagged":"none"},
{"id":"E010","channel":"queue:flow.packets","producer":{"service":"compute","file":"services/compute/src/index.ts","line":574,"pattern":"publishJson(js, SUBJECT_FLOW_PACKETS, validated)"},"consumer":{"service":"api","file":"services/api/src/index.ts","line":987,"pattern":"subscribeWithReset(SUBJECT_FLOW_PACKETS, ...)"},"data_shape":"FlowPacket JSON for storage/live fanout","sanitization_at_boundary":"schema parse before publish and in API; no message authentication","trust_tagged":"none"},
{"id":"E011","channel":"queue:flow.smart_money","producer":{"service":"compute","file":"services/compute/src/index.ts","line":1083,"pattern":"publishJson(js, SUBJECT_SMART_MONEY_EVENTS, smartMoneyEvent)"},"consumer":{"service":"api","file":"services/api/src/index.ts","line":993,"pattern":"subscribeWithReset(SUBJECT_SMART_MONEY_EVENTS, ...)"},"data_shape":"SmartMoneyEvent JSON","sanitization_at_boundary":"schema parse; no message authentication","trust_tagged":"none"},
{"id":"E012","channel":"queue:flow.classifier_hits","producer":{"service":"compute","file":"services/compute/src/index.ts","line":1114,"pattern":"publishJson(js, SUBJECT_CLASSIFIER_HITS, hit)"},"consumer":{"service":"api","file":"services/api/src/index.ts","line":999,"pattern":"subscribeWithReset(SUBJECT_CLASSIFIER_HITS, ...)"},"data_shape":"ClassifierHitEvent JSON","sanitization_at_boundary":"schema parse; no message authentication","trust_tagged":"none"},
{"id":"E013","channel":"queue:flow.alerts","producer":{"service":"compute","file":"services/compute/src/index.ts","line":1151,"pattern":"publishJson(js, SUBJECT_ALERTS, alert)"},"consumer":{"service":"api","file":"services/api/src/index.ts","line":1005,"pattern":"subscribeWithReset(SUBJECT_ALERTS, ...)"},"data_shape":"AlertEvent JSON","sanitization_at_boundary":"schema parse; no message authentication","trust_tagged":"none"},
{"id":"E014","channel":"queue:flow.news","producer":{"service":"ingest-news","file":"services/ingest-news/src/index.ts","line":158,"pattern":"publishJson(js, SUBJECT_NEWS, story)"},"consumer":{"service":"api","file":"services/api/src/index.ts","line":1281,"pattern":"NewsStorySchema.parse(...); insertNewsStory(clickhouse, payload); fanoutLive(...)"},"data_shape":"NewsStory JSON from external Alpaca news feed","sanitization_at_boundary":"NewsStorySchema.parse only; no NATS subject-level source authentication in compose","trust_tagged":"NATS subject name implies trusted ingest-news origin"},
{"id":"E015","channel":"db-table:news","producer":{"service":"api","file":"services/api/src/index.ts","line":1281,"pattern":"insertNewsStory(clickhouse, payload)"},"consumer":{"service":"api/web","file":"packages/storage/src/clickhouse.ts","line":1289,"pattern":"FROM news"},"data_shape":"persisted NewsStory columns served by /news/history/news","sanitization_at_boundary":"ClickHouse insert/read typed; UI rendering not re-derived here","trust_tagged":"database as durable trust boundary"}
],
"coverage_gaps": [
{"reason":"third-party/external HTTP client calls excluded from internal edge findings","location":"services/ingest-news/src/index.ts:109; services/ingest-equities/src/adapters/alpaca.ts:158; services/ingest-options/src/adapters/alpaca.ts:159","expression":"fetch(provider URLs)"},
{"reason":"unmatched in-repo producer or consumer for raw options.prints stream; likely storage/replay or external consumer","location":"services/ingest-options/src/index.ts:430","expression":"SUBJECT_OPTION_PRINTS"},
{"reason":"Docker compose NATS command has JetStream only and no auth/ACL/TLS flags","location":"deployment/docker/docker-compose.yml:166","expression":"command: ['-js', '-sd', '/data']"}
]
}