Alta-Proxy-Tool/docs/security/2026-08-security-baseline.md

APT security hardening baseline

• Canonical source: GitPeji peji/Alta-Proxy-Tool
• Starting commit: a80074ac57b7a4517837b5d95754f5e6433df3ac
• Branch: hardening/security-foundation
• Original review: /home/peji/.hermes/reports/alta-proxy-tool-full-review-2026-08-19.md
• Implementation plan: docs/plans/2026-08-19-apt-security-foundation.md
• Starting package version: 1.0.0
• Starting audit: 25 findings (1 critical, 22 high, 2 moderate); production-only audit 3 findings (2 high, 1 moderate)
• Starting release state: split release hosting, no application CI, unsafe unsigned updater, no automated tests

Guardrails

• GitPeji only; alternate-host remote removed.
• Production Tool Hub and existing downloads remain unchanged.
• Synthetic sentinel credentials only in tests.
• Work remains on the isolated hardening branch until review gates pass.
• No feature additions until Critical/Important security closure.

Accepted passwordless proxy exception

Zac explicitly requires the paired-extension Connect → select camera → Start Proxy flow without re-entering Alta credentials. The external aware-cam-proxy.exe helper supports cookie authentication only through -k; it exposes no stdin, named-pipe, environment-variable, or credential-file interface. APT therefore passes the validated main-owned session directly to the fixed helper as one argv value. This exception remains bounded by direct shell: false spawn, trusted-device allowlisting, no renderer/IPC credential parameter, no logs/files/shells, redacted launch errors, safe tracked metadata, and synthetic regression tests.