# humanymous — security & code audit report

Source: https://humanymous.net/reference/security-audit.html
Project: humanymous — defensive anti-bot / browser-automation detection (Apache-2.0).

---

# humanymous — security & code audit report

*Pre-release audit. Method: a multi-reviewer Red/Blue process (adversarial finders per
dimension, independent verifiers that tried to refute each finding, and a final
evaluation judge), anchored to the standards listed in the *Standards referenced*
section below. This report is published for
transparency; it is not a certification.*

- **Audit date:** 2026-07-22 · **Target:** `main`
- **Verdict:** the audit returned *GO with fixes*. **Every confirmed finding
  (High → Low) has since been remediated at the code level** in a pre-release
  hardening pass; only the accepted/residual risks in the *Accepted / residual risk*
  section remain. The full list of
  applied fixes is on the [GitHub Releases page](https://github.com/modootoday/humanymous/releases) *Security* / *Fixed* sections.

## 1. Scope & asset inventory

**Reviewed:** detection engine (`cmd/server`, `:8443`); Gate reverse-proxy edge
(`cmd/gate`, `:8444`) and admin plane (`:8445`); humanymous Pass (`internal/pass`,
`web/pass.html`); the reverse-proxy forwarding path; the WASM/JS loader; the
tamper-evident audit chain (`internal/audit`); resource watermarking; the crypto axes
(PoW, attestation); public docs. **Not reviewed:** third-party dependency internals
(covered by `govulncheck` + Trivy in CI); the production ACME/CDN edge; formal
cryptographic proofs.

## 2. Methodology & tooling

Static review guided by the **OWASP Code Review Guide** and **OWASP ASVS** (target
Level 2 for the web surface); dynamic/behavioural review mapped to **OWASP WSTG** via
the repo's harnesses — the 47-profile Docker attack catalog, the 34-check Gate
conformance suite, the multi-subnet correlation swarm, the 8-round Pass red/blue
wargame, and dedicated **reverse-proxy forwarding-fidelity** tests
(`internal/gate/forward_fidelity_test.go`). Supply-chain posture assessed against
**OpenSSF Scorecard** and **SLSA v1.0**.

## 3. Remediation summary

All confirmed findings were fixed and verified (`go test ./...` green; Pass e2e 5/5;
Pass wargame gate PASS; Docker engine attack 45/45 sub-ceiling bots blocked (0 bypass) —
the T4 `native_coherent_ceiling` profile ALLOWs by design, priced via attested/ceiling-guard;
Gate conformance 34/34; images build with third-party licences bundled). Categories fixed,
with the durable controls added:

- **Admin plane** — no unauthenticated operator-token handout; loopback-default bind;
  tokens never logged; fail-closed on placeholder/low-entropy secrets.
- **Honesty** — every "100% / 0% FPR" absolute replaced with bounded, reference-measured
  language across README + the results page (enforces the project's own style guide).
- **humanymous Pass accessibility** — no hidden timeout (honest, announced expiry);
  screen-reader-announced outcomes; a real non-drag pointer path (on-screen tap
  controls) and completed slider semantics; a support-contact escape route; readable
  hint contrast.
- **Anti-replay** — the interaction-trace digest is quantized, so sub-millisecond noise
  no longer defeats replay detection.
- **Reverse-proxy fidelity** — migrated to the modern `Rewrite` hook so
  `X-Forwarded-For` is a single authoritative socket-derived value (a duplicate was
  found and fixed); strict tests assert client headers/cookies/body/method reach the
  upstream intact, the upstream's status/Set-Cookie/headers return to the client, and
  forged trust headers are blocked before forwarding.
- **Privacy** — the watermark IP token is now a **keyed** HMAC pseudonym (not a
  reversible bare hash); the watermark ledger is in the data-processing inventory with
  its TTL/erasure scope; a GDPR Art. 13/14 collection-notice snippet is documented.
- **Supply chain** — `govulncheck`, CodeQL, and Trivy image scanning gate CI; Dependabot
  covers Go modules + Actions; build version is stamped into the binaries; licences ship
  in the images. Released images are **keyless-signed with cosign** and carry an **SPDX
  SBOM** + **SLSA provenance** attestation — adopters verify all three before running; see
  [Verify a released image](../how-to/verify-the-image.md).
- **Cookies** now set `Secure`; key/id CSPRNG seeding fails closed; the in-memory Pass
  session map is bounded.

## 4. Accepted / residual risk (by design, disclosed — not defects)

These are inherent trade-offs, documented rather than "fixed":

- **Detection floor.** A *perfect* human-like forgery from a *fresh* identity can still
  clear the Pass puzzle — the fundamental limit of any accessible challenge. It is
  bounded by the attestation issuance rate and folded engine risk, and the engine
  **DENIES** the session the moment any independent bot signal (JA4/L1–L7/correlation)
  appears; solving Pass never launders a session already proven a bot.
- **False-positive posture.** The reference FPR is a DENY-only metric and does not
  measure real-human friction or disaggregate assistive-tech / uncommon-browser /
  privacy-hardened users. Disclosed in the [transparency report](../explanation/transparency-report.md).
- **Attestation axis is session-scoped by design.** To keep the normal/accessible lane
  token-free, the rate-limited attestation gate triggers on session cadence; a
  cookie-rotating flood from one fingerprint is instead caught by the **fingerprint-keyed
  velocity engine-fusion** (`l7.pass.flood` → risk → non-ALLOW verdict), a different but
  effective axis.
- **Anti-injection CSP is report-only by design** — violation telemetry for a detection
  engine, not an enforced block (stated plainly in the docs).
- **Admin-plane security** rests on loopback binding + no auto-issued token, and
  **client-certificate mTLS is shipped**: `-admin-mtls-ca <pem>` makes the admin listener
  require a client cert signed by that CA (`tls.RequireAndVerifyClientCert`) in addition to
  the bearer token. **SSO remains the production delta** — front the listener with an
  authenticating proxy for that.
- **Audit tamper-evidence** resists external tampering and enables post-hoc verification,
  but not an attacker with in-process/code control — production runs the witness and
  keys out-of-process/HSM.
- **Supply-chain hygiene, ongoing:** GitHub Actions SHA-pinning and base-image digest
  pinning are managed by Dependabot rather than hand-pinned.

## 5. Standards referenced

OWASP ASVS · OWASP Code Review Guide · OWASP WSTG · CWE · ISO/IEC 29147 & 30111 (CVD) ·
OpenSSF Scorecard & Best Practices Badge · SLSA v1.0 · SPDX/CycloneDX (SBOM) ·
NIST SSDF · W3C "Inaccessibility of CAPTCHA" & WCAG 2.2 · GDPR (Arts. 5/6/13/17/22).

*Report vulnerabilities via [`SECURITY.md`](../../SECURITY.md) /
[`security.txt`](https://humanymous.net/.well-known/security.txt).*