Enrollment rate-limit bucket scope unresolved: per-source or plane-wide? #83

New issue

Open

opened 2026-08-22 11:00:02 +00:00 by a73x · 0 comments

a73x commented

2026-08-22 11:00:02 +00:00

(Migrated from git.a73x.sh)

From the pre-launch security audit (finding API-7). Ranked #1 of the OUTSTANDING set —
not because it is confirmed High, but because it is the cheapest unresolved uncertainty.

The uncertainty. The enrollment limiter demonstrably works (5x403 -> 429 observed
black-box). But from a single source address I could not tell whether I emptied my
bucket or the plane's. If the bucket is plane-wide, ~6 requests from anywhere pause
fleet enrollment for everyone — an unauthenticated, fleet-wide DoS. If it is per-source,
this is Low and closes.

Part A (10 minutes). Resolve the bucket scope — read the limiter/proxy config, or
probe from two source addresses. This either drops the finding or escalates it to the
top of the whole list.

Part B (if needed). A Traefik rateLimit middleware on the console/API IngressRoutes
with an explicit sourceCriterion makes the scope per-source by construction, and needs
no Cloudflare account or DNS change (the plane already fronts HTTP with Traefik). Draft
was scoped but not built.

Migrated from git-collab issue 99613bd81805f49df01405e9f922f80a6ab78e83.

Original author: a73x dev@a73x.sh.

From the pre-launch security audit (finding API-7). Ranked #1 of the OUTSTANDING set — not because it is confirmed High, but because it is the cheapest unresolved uncertainty. **The uncertainty.** The enrollment limiter demonstrably works (5x403 -> 429 observed black-box). But from a single source address I could not tell whether I emptied *my* bucket or *the plane's*. If the bucket is plane-wide, ~6 requests from anywhere pause fleet enrollment for everyone — an unauthenticated, fleet-wide DoS. If it is per-source, this is Low and closes. **Part A (10 minutes).** Resolve the bucket scope — read the limiter/proxy config, or probe from two source addresses. This either drops the finding or escalates it to the top of the whole list. **Part B (if needed).** A Traefik `rateLimit` middleware on the console/API IngressRoutes with an explicit `sourceCriterion` makes the scope per-source by construction, and needs no Cloudflare account or DNS change (the plane already fronts HTTP with Traefik). Draft was scoped but not built. --- Migrated from git-collab issue `99613bd81805f49df01405e9f922f80a6ab78e83`. Original author: a73x <dev@a73x.sh>.