|
| 1 | +# GitHub Outreach Run 005 |
| 2 | + |
| 3 | +Date: 2026-05-25 21:18 +07 |
| 4 | +Channel: GitHub public PR |
| 5 | +Mode: Autonomous, within `docs/autonomous-outreach-policy.md` |
| 6 | +Outbound count: 1 |
| 7 | + |
| 8 | +## Summary |
| 9 | + |
| 10 | +This run prioritized proof-of-work over a sales message on an explicit public security-hardening issue. |
| 11 | + |
| 12 | +- Opened 1 small public PR related to JWT localStorage blast-radius reduction. |
| 13 | +- Did not include payment links in outbound content. |
| 14 | +- Used only public repository code and issue context. |
| 15 | +- No credentials, account access, private data, or secrets were requested. |
| 16 | + |
| 17 | +## 1. Sayap-Garuda-Indah/inventory |
| 18 | + |
| 19 | +Public context: |
| 20 | + |
| 21 | +- Issue: https://github.com/Sayap-Garuda-Indah/inventory/issues/41 |
| 22 | +- PR opened: https://github.com/Sayap-Garuda-Indah/inventory/pull/45 |
| 23 | + |
| 24 | +Why it fit: |
| 25 | + |
| 26 | +- Open public issue from 2026-05-06 explicitly describes JWT access tokens stored in `localStorage`. |
| 27 | +- The issue asks for compensating controls if cookie-based auth is not immediately adopted. |
| 28 | +- The repo has a Docker/Nginx frontend deployment where browser security headers can be added without private access. |
| 29 | + |
| 30 | +Action: |
| 31 | + |
| 32 | +- Forked `Sayap-Garuda-Indah/inventory` to `bmtriet/inventory`. |
| 33 | +- Opened PR `fix(frontend): add browser security headers`. |
| 34 | + |
| 35 | +Exact PR body: |
| 36 | + |
| 37 | +```markdown |
| 38 | +## Summary |
| 39 | +- Add a conservative Content-Security-Policy to the frontend Nginx config. |
| 40 | +- Add X-Content-Type-Options, Referrer-Policy, and Permissions-Policy headers. |
| 41 | +- Keep camera available for same-origin scanner flows while disabling microphone and geolocation. |
| 42 | + |
| 43 | +## Context |
| 44 | +This is a small hardening slice related to #41. It does not replace the larger fix of moving bearer tokens out of localStorage into HttpOnly/Secure/SameSite cookie-based session handling. It reduces the browser attack surface while that auth-storage migration is planned. |
| 45 | + |
| 46 | +The CSP assumes the Docker deployment serves the frontend and API same-origin via /api. If another deployment calls a different API origin or adds third-party scripts, connect-src/script-src will need an explicit allowlist update. |
| 47 | + |
| 48 | +## Validation |
| 49 | +- PASS: npm ci |
| 50 | +- PASS: npm run build |
| 51 | +- PASS: git diff --check |
| 52 | +- NOT RUN: nginx -t via Docker image; local Docker daemon was unavailable in my environment. |
| 53 | +- PRE-EXISTING: npm run lint currently fails on unrelated no-explicit-any/no-unused-vars/react-hooks/react-refresh issues in existing frontend files. |
| 54 | +- PRE-EXISTING: npm audit --audit-level=critical --omit=dev reports existing dependency advisories. |
| 55 | +``` |
| 56 | + |
| 57 | +Verification: |
| 58 | + |
| 59 | +- `npm ci` passed. |
| 60 | +- `npm run build` passed. |
| 61 | +- `git diff --check` passed. |
| 62 | +- `npm run lint` failed on pre-existing unrelated frontend lint errors. |
| 63 | +- `npm audit --audit-level=critical --omit=dev` failed on pre-existing dependency advisories. |
| 64 | +- `nginx -t` via Docker image could not run because the local Docker daemon was unavailable. |
| 65 | +- The PR currently has no GitHub checks reported. |
| 66 | + |
| 67 | +Follow-up status: |
| 68 | + |
| 69 | +- No follow-up unless the maintainer replies. |
| 70 | + |
| 71 | +## LLMGate Use |
| 72 | + |
| 73 | +- Model used: `gpt-5.4`. |
| 74 | +- Input: public issue context, public package/deployment facts, and the proposed Nginx header snippet only. |
| 75 | +- Purpose: review CSP and `Permissions-Policy` caveats before opening the PR. |
| 76 | +- No private data, credentials, raw chat logs, or local secrets were sent. |
0 commit comments