Epic: Security assessment remediation (v0.1.0-alpha.20)

Goal

Track remediation of the security findings identified in a static assessment of v0.1.0-alpha.20 (pinned commit 4ad2c10). Each finding was independently re-validated against the current code before filing, and each is filed as its own narrowly scoped issue. This is a tracking issue: it groups and orders the work but does not replace the linked issues. The definition of done for each item lives in its linked issue.

This release is a development pre-release, so these are remediation and hardening items for the v0.1.0 security baseline rather than reports against a supported release. See #132 (pre-v0.1.0 release validation) and #129 (graduate from alpha) for the surrounding release work.

All linked issues carry the area: security label.

Findings

Critical

• #152 - auth-enabled routes are published before the SecurityPolicy is accepted (fail-open)

High

• #153 - auth.groups is documented as access control but is not enforced at the gateway
• #154 - self-service fields can create and administer Keycloak realm groups and memberships
• #155 - caller-selected spaClient.clientId can reconfigure or delete an existing Keycloak client
• #156 - hostname and TLS listener delegation lacks an ownership boundary
• #157 - release artifacts use mutable inputs and lack signing, provenance, and SBOM

Medium

• #158 - generated child resources can overwrite unrelated same-name objects
• #118 - protected and public HTTPRoutes can overlap for the same path (existing issue)
• #37 - Keycloak clients use wildcard WebOrigins (existing issue; also covers HTTP redirect URIs)
• #159 - generic-oidc issuerURL is unvalidated (gateway-side SSRF and client-secret exposure)
• #160 - cross-namespace Service backends lack target-owner consent and leak an existence oracle
• #161 - token exchange trusts every peer NebariApp client in the realm
• #162 - broad Kubernetes and Keycloak authority lacks network containment
• #163 - build uses a stale Go patch and lacks govulncheck, image-scan, and SBOM gates
• #164 - identity and credential reconciliation is additive with incomplete cleanup

Low

• #165 - user-provided TLS Secrets are not cryptographically or semantically validated

Notes

• #118 and #37 predate this pass and already tracked two of the findings; they are linked here rather than duplicated. #37 remains a sub-issue of #79 (Keycloak & Auth) since an issue can have only one parent, so it appears in the checklist above but not in this epic's sub-issue list.
• Line numbers cited in the linked issues reference commit 4ad2c10. The only intervening change to security-relevant files since then was landing-page icon fields, so the cited behavior is current.

Use the linked issues #152–#165 as the entry points; this issue is only an ordering and tracking epic. Start with the highest-priority linked finding and read its definition of done, then follow any files, tests, or commands named there. The epic is complete when each applicable checklist item is resolved through its linked issue.