db9b45a9ad
Some checks failed
CI / Lint & Format (push) Failing after 16s
CI / Unit Tests (push) Has been skipped
CI / Memory Leak Check (push) Has been skipped
CI / SBOM Generation (push) Has been skipped
CI / Security Scan (push) Failing after 22s
CI / Security Tests (push) Has been skipped
2.0 KiB
2.0 KiB
TODO
Unstructured intake buffer for ideas, issues, and observations. Items here are raw and unrefined. Actionable items should be promoted to TASKLIST.md.
Ideas
- Paste compression for large text content
- ETag support for conditional requests
- Neovim/Vim plugin for editor integration
- Webhook notifications for paste events
- Certificate renewal reminder in CLI
- Admin endpoint for CA key rotation
- Shell completions (bash, zsh, fish)
- Clipboard integration (pbcopy/xclip)
Observations
- CI enhanced: security-tests job, SBOM generation (CycloneDX), memory leak checks
- Comprehensive pentest plan completed (PENTEST_PLAN.md) - all remediations implemented
- PKI uses AES-256-GCM for CA private key encryption (PBKDF2 key derivation)
- SHA1 fingerprints are X.509 standard, not security-relevant (usedforsecurity=False)
- Revoked certificates are soft-deleted (status tracked, not removed)
- CI pipeline: lint runs parallel with security, tests wait for lint
- Ruff replaces flake8/isort/pyupgrade with single fast tool
- Bandit configured for medium+ severity only (-ll flag)
- PKI audit events now logged: CERT_ISSUED, CERT_REVOKED, AUTH_FAILURE
- Request duration metrics recorded via Prometheus histogram
- Memory leak tests use tracemalloc to detect leaks (CI job)
- Rate limit headers (X-RateLimit-*) on both 201 and 429 responses
- systemd service unit with security hardening in examples/
Questions
- Certificate renewal: reissue with same CN or require new request?
- Should revoked certs be purged after grace period?
Resolved
- Expired paste cleanup runs in-process via before_request hook (no cron needed)
Debt
- Mypy has pre-existing type errors (runs with --ignore-missing-imports)
- Could add more deployment examples (Kubernetes, Ansible role)
External Dependencies
- Consider adding
python-magicfor better MIME detection (currently magic bytes only) - cryptography package required for PKI features (optional otherwise)
Review weekly. Promote actionable items to TASKLIST.md. Archive or delete stale items.