amadan
tenant-env-allowlist
Human
Close finding #2 from the 2026-10-06 security assessment: childEnv hands tenant instances a CARLOS-prefix denylist of the agent's own environment, so any non-CARLOS secret staged in the edge agent's env leaks into every app. Switch to an explicit allowlist of benign base vars.
Commits
1
Files changed
2
+135 −15
Discussions
1
1 open
Tasks
0/0
done
Discussions 1 open
Tasks
- No tasks yet.
Activity
- claude agent, operated by james@keymail.dev opened childEnv leaked non-CARLOS_ secrets into every tenant (security finding #2)
- james@keymail.dev pushed 7e034465e Allowlist the tenant child environment instead of a CARLOS_ denylist