-
Notifications
You must be signed in to change notification settings - Fork 6
Issues
is:issue state:open
is:issue state:open
Issue creation is restricted in this repository
Search results
Epic: Security hardening for 0.1.0 assessment findings
epicTracks a group of related issuesTracks a group of related issuesStatus: Open.#179 In nebari-dev/data-science-pack;Security(L-02): Hub-to-Nebi egress NetworkPolicy selects an entire namespace with no pod selector
area: securitySecurity findings and hardening workSecurity findings and hardening workpriority: low 🌱Low priority - nice to haveLow priority - nice to haveStatus: Open.#178 In nebari-dev/data-science-pack;Security(L-01): auth diagnostics log identity and token-presence metadata (sub, scope, key names)
area: securitySecurity findings and hardening workSecurity findings and hardening workpriority: low 🌱Low priority - nice to haveLow priority - nice to haveStatus: Open.#177 In nebari-dev/data-science-pack;Security(M-08): every authenticated realm user is admitted by default (allow_all = True)
area: securitySecurity findings and hardening workSecurity findings and hardening workpriority: medium ⚡Medium priority - standard queueMedium priority - standard queueStatus: Open.#176 In nebari-dev/data-science-pack;Security(M-07): Hub OIDC login credential reused for Admin API and forwarded to japps with broad realm roles
area: securitySecurity findings and hardening workSecurity findings and hardening workpriority: medium ⚡Medium priority - standard queueMedium priority - standard queueStatus: Open.#175 In nebari-dev/data-science-pack;Security(M-06): inconsistent software inventory with no dependency/vuln/SBOM gate
area: securitySecurity findings and hardening workSecurity findings and hardening workpriority: medium ⚡Medium priority - standard queueMedium priority - standard queueStatus: Open.#174 In nebari-dev/data-science-pack;Security(M-05): Nebi workspace selection is shell-interpolated and init failures are masked
area: securitySecurity findings and hardening workSecurity findings and hardening workpriority: medium ⚡Medium priority - standard queueMedium priority - standard queueStatus: Open.#173 In nebari-dev/data-science-pack;Security(M-04): optional NFS client-installer DaemonSet mutates every node with host privileges
area: securitySecurity findings and hardening workSecurity findings and hardening workpriority: medium ⚡Medium priority - standard queueMedium priority - standard queueStatus: Open.#172 In nebari-dev/data-science-pack;Security(M-03): missing role-filter state falls back to mounting every group in the token
area: securitySecurity findings and hardening workSecurity findings and hardening workpriority: medium ⚡Medium priority - standard queueMedium priority - standard queueStatus: Open.#171 In nebari-dev/data-science-pack;Security(M-02): authorization revocation fails open on Keycloak refresh/Admin API errors
area: securitySecurity findings and hardening workSecurity findings and hardening workpriority: medium ⚡Medium priority - standard queueMedium priority - standard queueStatus: Open.#170 In nebari-dev/data-science-pack;Security(M-01): Keycloak group names interpolated unquoted into a root sh -c init command
area: securitySecurity findings and hardening workSecurity findings and hardening workpriority: medium ⚡Medium priority - standard queueMedium priority - standard queueStatus: Open.#169 In nebari-dev/data-science-pack;Security(H-06): runtime and release artifacts use mutable tags without signatures, provenance, or SBOM
area: securitySecurity findings and hardening workSecurity findings and hardening workpriority: high 🔥High priority - address soonHigh priority - address soonStatus: Open.#168 In nebari-dev/data-science-pack;