Skip to content

docs: add egress filtering documentation - #202

Merged
Mossaka merged 3 commits into
mainfrom
docs/security-model-port-vs-domain
Jan 13, 2026
Merged

docs: add egress filtering documentation#202
Mossaka merged 3 commits into
mainfrom
docs/security-model-port-vs-domain

Conversation

@Mossaka

@MossakaMossaka commented Jan 13, 2026•
edited
Loading

Copy link
Copy Markdown
Contributor

Summary

Adds docs/egress-filtering.md explaining AWF's security model for network filtering, specifically addressing: Why use port restrictions if they can be bypassed?

Key points:

  • Domain allowlist is the primary security control
  • Port restrictions are defense-in-depth, not primary security
  • Includes literature citations from industry sources

Literature Cited

Supporting domain allowlist as primary control:

Supporting port restrictions as defense-in-depth:

Test plan

  • Document renders correctly in markdown
  • All external links are valid and accessible

🤖 Generated with Claude Code

@Mossaka@claude
docs: add security model for port vs domain filtering
e599345
Explains why AWF uses domain allowlist as primary security control with
port restrictions as defense-in-depth. Includes:
- Literature citations from Squid Wiki, NIST SP 800-41, CMU SEI
- Counter-arguments on port filtering obsolescence (Palo Alto, Gartner NGFW)
- Analysis of bypass techniques (SSH over 443, DNS tunneling)
- Balanced conclusion with industry best practices
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
@github-actions

github-actionsBot commented Jan 13, 2026•
edited
Loading

Copy link
Copy Markdown
Contributor

💫 TO BE CONTINUED...Smoke Claude was cancelled! Our hero faces unexpected challenges...

@github-actions

github-actionsBot commented Jan 13, 2026•
edited
Loading

Copy link
Copy Markdown
Contributor

📰 VERDICT: Smoke Copilot has concluded. All systems operational. This is a developing story. 🎤

@github-actions

github-actionsBot commented Jan 13, 2026

Copy link
Copy Markdown
Contributor

Test Coverage Report

MetricCoverageCovered/Total
Lines77.12%1281/1661
Statements77.17%1312/1700
Functions77.04%141/183
Branches69.29%431/622
Coverage Thresholds

The project has the following coverage thresholds configured:

  • Lines: 38%
  • Statements: 38%
  • Functions: 35%
  • Branches: 30%

Coverage report generated by `npm run test:coverage`

@Mossaka@claude
docs: rename security-model.md to egress-filtering.md
6751c94
More specific name that accurately describes the content (port vs domain
filtering for egress traffic). Avoids confusion with docs/security.md
which covers vulnerability reporting policy.
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
@MossakaMossaka changed the title docs: add security model for port vs domain filteringdocs: add egress filtering documentationJan 13, 2026
@github-actions

github-actionsBot commented Jan 13, 2026•
edited
Loading

Copy link
Copy Markdown
Contributor

📰 DEVELOPING STORY: Smoke Copilot reports was cancelled. Our correspondents are investigating the incident...

@github-actions

github-actionsBot commented Jan 13, 2026

Copy link
Copy Markdown
Contributor

💥 WHOOSH!Smoke Claude springs into action on this pull request! [Panel 1 begins...]

@github-actions

github-actionsBot commented Jan 13, 2026

Copy link
Copy Markdown
Contributor

📰 BREAKING: Smoke Copilot is now investigating this pull request. Sources say the story is developing...

@github-actions

github-actionsBot commented Jan 13, 2026

Copy link
Copy Markdown
Contributor

Smoke Test Results

✅ GitHub MCP - PRs: #190, #188
✅ File Write - Test file created
✅ Bash - Verification successful

Status: PASS

📰 BREAKING: Report filed by Smoke Copilot fer issue #202 🗺️

@github-actions

github-actionsBot commented Jan 13, 2026

Copy link
Copy Markdown
Contributor

Smoke Test Results - Claude

✅ GitHub MCP: #131, #141
✅ File Write: Test file created
❌ Bash: File verified
❌ Playwright: Navigation failed (tunnel connection errors)

Status: FAIL (Playwright connectivity issue)

💥 [THE END] — Illustrated by Smoke Claude fer issue #202 🗺️

@Mossaka
Mossaka merged commit 167cd1d into mainJan 13, 2026
38 checks passed
@Mossaka
Mossaka deleted the docs/security-model-port-vs-domain branch January 13, 2026 07:48
This was referenced Jan 15, 2026
Closed
Closed
Mossaka added a commit that referenced this pull request Feb 12, 2026
@Mossaka@claude
fix: expand credential hiding list for runner tokens and MCP config
e3683ab
Add missing credential files to the /dev/null mount list in both normal
and chroot modes:
- GitHub Actions runner .credentials and .credentials_rsaparams
- GitHub Actions runner cached credentials
- MCP config file (.copilot/mcp-config.json) containing auth tokens
Also exclude GH_AW_MCP_CONFIG from --env-all passthrough to prevent
trivial discovery of the MCP config path.
Closes#66, closes#179, closes#182, closes#195, closes#202,
closes#208, closes #217, closes#218
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
@MossakaMossaka mentioned this pull request Feb 12, 2026
Closed
4 tasks
Sign up for freeto join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

smoke-copilot

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@Mossaka