[fclairamb]

Specs for the open findings of the daily security scan. Specs only, no code change.

Specs

Spec	Severity	Finding	Summary
specs/todos/2026-10-20-01-sender-response-body-caps.md	medium	K1 (2026-10-20)	The Google Chat, Gotify, Matrix, Mattermost, MS Teams, ntfy, Slack webhook and Zulip senders, and the RabbitMQ checker, read response bodies from a host the user chooses with no size cap. Only the timeout bounds them. A member pointing one at their own server can exhaust the server's memory, through the integration test endpoint, the notification jobs or the check workers. Same class as J1 (A2A), fixed in #608. Fix: one capped-read helper.

Scan of 2026-10-20 covered:

• the grouped-check status-page fix (fix(status-pages): close a grouped check's entry when it recovers #615): the sibling lookups stay within the org;
• the rate-limit borrowing (fix(checkworker): stop the rate limiter starving long-period checks #609): the debt is bounded and cannot be triggered by a tenant or an agent;
• the dash0 chart changes and the dependency bumps.

It also verified the A2A response cap of #608 (J1). No other new finding.

🤖 Generated with Claude Code

[codecov]

Codecov Report

❌ Patch coverage is 96.15385% with 3 lines in your changes missing coverage. Please review.
✅ Project coverage is 83.39%. Comparing base (3ee0007) to head (8eeca3e).

Files with missing lines	Patch %	Lines
server/internal/jmap/client.go	76.92%	3 Missing ⚠️

Additional details and impacted files

@@           Coverage Diff           @@
##             main     #618   +/-   ##
=======================================
  Coverage   83.38%   83.39%           
=======================================
  Files        1238     1239    +1     
  Lines      127061   127100   +39     
=======================================
+ Hits       105949   105989   +40     
+ Misses      21103    21102    -1     
  Partials        9        9           

Files with missing lines	Coverage Δ
server/internal/checkers/checkrabbitmq/checker.go	76.92% <100.00%> (+0.84%)	⬆️
server/internal/integrations/freebox/client.go	86.76% <100.00%> (+0.19%)	⬆️
server/internal/notifications/body_cap.go	100.00% <100.00%> (ø)
server/internal/notifications/googlechat.go	77.23% <100.00%> (ø)
server/internal/notifications/gotify.go	89.10% <100.00%> (ø)
server/internal/notifications/matrix.go	87.66% <100.00%> (+1.85%)	⬆️
server/internal/notifications/mattermost.go	87.93% <100.00%> (ø)
server/internal/notifications/msteams.go	92.78% <100.00%> (ø)
server/internal/notifications/ntfy.go	87.50% <100.00%> (+1.78%)	⬆️
server/internal/notifications/pagerduty.go	91.42% <100.00%> (ø)
... and 4 more

... and 13 files with indirect coverage changes

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.