[Innei]

Summary

• Prevent public comment/reader metadata leaks and protected note disclosure; revoke stale owner WebSocket authority and remove URL-based API keys.
• Validate DNS at socket connection time, proxy browser egress, and bound sandbox admission, image/S3 responses, upload quotas, archive expansion, telemetry ingestion, and relay fanout.
• Require mailbox confirmation for subscriptions, owner authorization for Space push bindings, approved source enrollment, and HTTPS/origin-scoped iOS credentials. The 23-finding review and upgrade instructions are in docs/security/2026-10-23-daybreak-blue-remediation.md.

Upgrade requirements

Deploy Relay and Core together with matching PUSH_RELAY_ENROLLMENT_TOKEN / MX_PUSH_RELAY_ENROLLMENT_TOKEN values and apply Relay migration 0003. Existing Space push bindings must be reactivated. iOS users must pair again over HTTPS; unverified email subscriptions need confirmation. Deploy telemetry with the new COLLECT_LIMITER binding.

Test plan

• Core tests: 3104 passed / 11 conditionally skipped across the full run and an isolated retry of one Redis-port-conflict file; focused security regressions rerun.
• Core response/validation gates, Core/admin/telemetry/protocol typechecks, and Core production bundle.
• Rust Relay: 27 tests, including real SQLite admission/authorization/rollback checks.
• iOS Core: 49 tests; unsigned iOS Simulator app build.
• API SDK: 200 tests; WebSocket SDK: 23 tests; push protocol: 26 tests.
• Real Chromium private-egress rejection (HTTP 403, zero private-target requests) and Node 26 worker execution.
• Scoped ESLint and git diff --check.

Database migrations checklist

• Relay SQLite migration 0003 is additive and leaves pre-existing bindings unprivileged until reactivation. Previous inserts remain valid through the default value.
• No PostgreSQL schema changes, drops, renames, or type changes.
• Relay tests cover fresh SQLite migrations; a separate SQLite upgrade check verifies that existing bindings and old-code inserts default to unprivileged. The relay uses one process per database file.
• No production deployment, live APNs delivery, or remote Daybreak Blue rescan performed.

[safedep]

SafeDep Report Summary

No dependency changes detected. Nothing to scan.

View complete scan results →

_{This report is generated by SafeDep GitHub App}

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-23T16:41:55.371066Z	e7af32f	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[Innei]

Daybreak Blue security report summary

23 findings: 3 high, 12 medium, 8 low. The original report assigns high confidence to all 23 findings.

• Scan: cdb5ad99-2e3f-4c0a-b59e-79eb7cfdf134
• Scanned revision: 038657b8c995cff0cd769ef7ed16dd209a4aea2f
• Scope: repository-wide inventory, with 216 of 3,646 files fully reviewed across six investigation tracks. Coverage is partial.
• The original scan used static source review. It did not run the application, tests, exploit reproductions, or external-service checks.

Findings and changes in this PR

Area	Findings	Summary
Public comments and notes	3 medium	Public comment responses exposed contact/network/account metadata; note ID and alternate body paths bypassed password or scheduled-publication controls. Added public projections and visibility/password gates.
Owner WebSocket authority	2 low	Existing sockets retained owner authority after demotion, and reusable API keys were accepted in URL queries. Added role-change invalidation and removed query credentials.
Serverless sandbox	2 medium, 1 low	Writable CommonJS modules escaped the VM loading boundary, worker waiters were unbounded, and WebSocket hostname egress could reach private destinations. Restricted module paths, bounded admission, and checked actual connection addresses.
Outbound HTTP, browser and images	2 high, 2 medium	Mapped IPv6/DNS rebinding bypassed destination checks; browser checks happened after navigation; image responses were unbounded; body reads outlived fetch deadlines. Added connection-time DNS enforcement, a browser egress proxy, streaming byte limits and complete-response deadlines.
Uploads and backups	1 medium, 1 low	Reader quotas raced across concurrent requests, and ZIP expansion lacked size/count limits. Added a distributed PostgreSQL lock covering upload/accounting and bounded streaming extraction.
Telemetry and email subscriptions	1 medium, 1 low	Public telemetry could create unlimited rows; anyone could activate or change another mailbox's subscription. Added ingestion budgets, deduplication, mailbox confirmation and confirmation-email cooldowns.
S3-compatible transport	2 low	Requests followed unchecked redirects and lacked complete-response deadlines/size caps. Disabled redirects and bounded transport responses.
Push enrollment and fanout	1 high, 2 medium	Anonymous Space bindings could receive owner notifications; installation storage and self-issued source fanout were unbounded. Added owner-authorized binding classes, operator-approved source enrollment and atomic storage/rate/queue budgets.
iOS credentials	1 medium, 1 low	Non-atomic pairing could attach a stale token to another origin, and LAN HTTP carried owner credentials. Scoped Keychain records by origin, removed credentials from pairing requests and required HTTPS.

The three high-severity findings were outbound SSRF, unbounded image buffering, and relay source/fanout amplification.

Verification and rollout

Independent verification for the fixes includes Core tests (3104 passed / 11 skipped across the full run and a Redis-port-conflict retry), a fresh 154-test focused security run before PR creation, real PostgreSQL/SQLite checks, 27 Rust Relay tests, 49 iOS Core tests, Core/iOS builds, and real Chromium private-egress rejection (HTTP 403; zero requests reached the private target).

Rollout requires matching Core/Relay enrollment secrets, Relay migration 0003, Space push reactivation, iOS pairing over HTTPS, confirmation of previously unverified email subscriptions, and the telemetry rate-limit binding. The sandbox remains intended for trusted owner-authored scripts.

Full 23-item remediation matrix, upgrade requirements, and verification record.

Production deployment policies, live APNs delivery, and a remote Daybreak Blue rescan have not been verified by this PR.