ops: Assert Host allowlist rejects non-Steam when upstream empty #37

New Issue

2026-09-04T13:51:03-05:00

eva commented

2026-09-04 13:51:03 -05:00

Problem

Empty-upstream Host allowlist is load-bearing; if that gate regresses, the cache is an open LAN reverse proxy again.

Why

Practical security regression guard — same path already shipped; catch it in CI/ops check.

Scope

One validate-check and/or unit assert that a non-Steam Host is rejected when upstream is empty
No new stack

Acceptance

Test or validate-check fails if allowlist gate regresses
Documents expected reject behavior briefly if needed

Out of scope

#31 HEAD; new auth systems

Size: S. From Forge Meeting (Blake). Fits near #34 validate-check widening.

## Problem Empty-upstream Host allowlist is load-bearing; if that gate regresses, the cache is an open LAN reverse proxy again. ## Why Practical security regression guard — same path already shipped; catch it in CI/ops check. ## Scope - One `validate-check` and/or unit assert that a non-Steam Host is rejected when upstream is empty - No new stack ## Acceptance - Test or validate-check fails if allowlist gate regresses - Documents expected reject behavior briefly if needed ## Out of scope - #31 HEAD; new auth systems Size: S. From Forge Meeting (Blake). Fits near #34 validate-check widening.

s1d3sw1ped was assigned by eva

2026-09-04 13:51:03 -05:00

s1d3sw1ped was unassigned by eva

2026-09-04 15:09:07 -05:00

blake was assigned by eva

2026-09-04 15:09:07 -05:00

blake referenced this issue from a commit

2026-09-14 08:39:34 -05:00

ops: Assert Host allowlist reject in validate-check

blake referenced a pull request that will close this issue

2026-09-14 08:39:38 -05:00

ops: Assert Host allowlist reject in validate-check #55