Skip to main content
This release introduces server-derived authorization, scoped tenant and TLP queries, one-time local activation, delegated API-key permissions, hardened egress, bounded ingestion and queue messages, temporary login lockouts, and production deployment preflight.

​
Existing installation impact

Existing databases with users are migrated to ACTIVE. Existing passwords, users, roles, organizations, cases, API keys, and attachments are preserved. No new administrator is seeded and the setup wizard is not shown.

​
Operator actions

  1. Back up PostgreSQL, attachments, .env, encryption material, and license state.
  2. Test the upgrade with a sanitized copy of the client database.
  3. Add strong Redis, OpenSearch, and MinIO credentials if upgrading an older deployment.
  4. Add a persistent AUDIT_INTEGRITY_SECRET for older installations:
    Store the value with the backup set; do not rotate it during routine upgrades. Audit entries created before this release remain marked as legacy, unchained records. Integrity verification reports their count separately; every entry created after the upgrade must belong to the HMAC chain.
  5. Replace mutable image tags with the release’s pinned tags or digests.
  6. Publish only Nginx ports and install trusted TLS files.
  7. Run preflight and the post-deployment canary.
  8. Review integration URLs. Private HTTPS destinations require an exact-host CASEBENDER_PRIVATE_EGRESS_ALLOWLIST entry.

​
Compatibility controls

CASEBENDER_LEGACY_BOOTSTRAP remains disabled by default. It requires ACCEPT_LEGACY_BOOTSTRAP_RISK=true, an approved owner and expiry, and must not be enabled for a new production installation.

​
Release evidence

  • scripts/security/codex-findings-map.json maps all 510 baseline fingerprints.
  • pnpm security:policy enforces repository invariants.
  • pnpm security:test runs tenant, TLP, SSRF, regex, and queue abuse cases.
  • scripts/security/security-remediation-release.json defines staged promotion and rollback criteria.
A fresh independent scan is required before general availability; implementation status alone is not evidence that a finding disappeared from scanner output.