security: pre-release red/green/purple hardening (1 CRIT + 8 HIGH closed)#27

Merged

blackaxgit merged 9 commits into

mainfrom

chore/pre-release-rgp-hardening

May 19, 2026

Commits on May 19, 2026

docs(security): pre-release red/green/purple scaffold (recon + 2026 research + procedure)
blackaxgit
committed
test(security): RED phase confirmed findings + hermetic ignore-gated PoCs
blackaxgit
committed
fix(security): B4-1 CRIT drop entire validator/user_learning subtree from untrusted project config
blackaxgit
committed
fix(security): B6-1/B6-2 bound+redact Azure error bodies, scrub tenant hosts
blackaxgit
committed
fix(security): B1-4/B3-2 reject overbroad allow rule patterns
blackaxgit
committed
fix(security): B5-4 audit security-weakening env overrides; B3-1 harden MCP cred mask
blackaxgit
committed
ci(security): B5-1/B5-2 supply-chain gate (cargo-audit/deny, SBOM, provenance)
blackaxgit
committed
test(security): remove RED B1-9 PoC unit (accepted/Track residual, documented in register)
blackaxgit
committed
docs(security): PURPLE sign-off, SHIP with 2 tracked pre-1.0 conditions
blackaxgit
committed