Security Sweep — bilko.cloud HR — MC #107298 (2026-08-18)

bilko.cloud Security Sweep — MC #107298 
 Verdict: PASS 
 Date: 2026-08-18 
 Scope: bilko.cloud HR landing only ( apps/landing-hr ); separate verdict from bilko.io and bilko.company. 
 Baseline findings 
 
 P1 — mixed Cloudflare Pages asset root: production served exact wrangler.toml and package.json with HTTP 200; unknown/sensitive paths returned the homepage as HTTP 200. 
 P1 — stale removed-asset cache: after the first production asset-root fix, exact config URLs remained cached with s-maxage=604800 . A successful zone purge did not evict the Pages asset cache. A Pages middleware deny guard was added and independently passed CI before the final deploy. 
 P2 — missing browser controls: no CSP, HSTS, frame-deny or Permissions-Policy on the baseline homepage. 
 P2 — public Function hardening gaps: request bodies and several fields were unbounded; Turnstile accepted any successful hostname and had no timeout. 
 P2 — blanket SAST exclusion: apps/landing-hr/ was excluded from Semgrep. 
 
 Remediation 
 
 Physically isolated all 52 unchanged runtime assets under apps/landing-hr/public/ ; byte-integrity check: 52/52 identical. 
 wrangler.toml now deploys public ; workflow/docs use app cwd plus pages deploy public , preserving sibling Functions. 
 Added .assetsignore , asset preflight, real 404.html , CSP/HSTS/frame/referrer/permissions/COOP/CORP headers and immutable asset caching. 
 Added Pages _middleware.js fail-closed guard for config/source/hidden/backup paths before cache lookup. 
 Bounded request body at 16 KiB and lead fields; unsupported media returns 415. 
 Turnstile now fails closed without a secret, uses a 5-second timeout, checks HTTP success and requires hostname bilko.cloud . 
 Sanitized storage failure response codes; internal details remain server-side. 
 Added 12 focused HR Function/middleware tests and updated canonical landing tests for the Fetch Request/public-root contract. 
 Removed HR blanket Semgrep exclusion. 
 
 Verification 
 
 Local HR tests: 12/12 PASS . 
 Canonical landing suite: 29/29 PASS . 
 Asset preflight: PASS; local Wrangler: Functions compiled and sensitive paths 404. 
 Configured landing Gitleaks: 0 ; Semgrep: 0 ; pnpm production audit: 0 at all severities . 
 Raw shared-repo Gitleaks findings were adjudicated as documented synthetic test values/placeholders; no landing secret finding. Existing unrelated credential work is not duplicated here. 
 Preview Playwright: 5/5 PASS , desktop and mobile screenshots. 
 AzDO PR #352 → build #1129 PASS → merge 41383beefeaeccb8725c7ef897d8280d4935bf92 . 
 Stale-cache follow-up PR #353 → build #1131 PASS → merge 6c75e5c45141c59a01586351d157aa56eae11edf . 
 Production deployment: d5dbe05b-0c1e-42c3-b15d-5fd6dfdb7525 , source 6c75e5c . 
 Final production Playwright: 6/6 PASS (desktop/mobile, security headers, Turnstile source, submit click geometry, legal pages, sensitive 404s, non-mutating Function guards). 
 Final exact-path probes: 15/15 HTTP 404 , Cache-Control: no-store for guarded paths. 
 Homepage bytes/hash exactly match merged public/index.html . 
 TLS valid for bilko.cloud ; HSTS/CSP and all required browser headers live. 
 All three #107298 preview deployments deleted; no matching preview branch deployment remains. 
 
 Linked finding reconciliation 
 
 #106408: current production/source uses live Turnstile sitekey 0x4AAAAAADmvPOAvTZjn4gU9 ; deleted key absent. No real lead was submitted. 
 #106413: current source and production contain no cookie-banner overlay; Playwright proves the submit button owns its center hit point. This sweep does not fabricate an end-to-end lead mutation. 
 #106358: IO/BA task is outside this HR verdict. HR BILKO_LEADS production/preview bindings remain in wrangler.toml , and both production deployments logged Compiled Worker . 
 Canonical main's more conservative MC #107052 landing claims are now live; this intentionally supersedes the previously deployed unmerged #106980 branch copy. 
 
 Residual / accepted constraints 
 
 CSP retains 'unsafe-inline' because the legacy static page embeds inline script/style. Migration to hashes/nonces is recommended but not required for this closure. 
 No valid Turnstile/real-lead submission was made, by explicit non-mutation/privacy constraint. Verification covers live widget identity, DOM geometry, invalid/hostile requests, Function unit contracts and compiled production Functions. 
 Bilko monorepo/application risks outside apps/landing-hr are not inherited as a PASS for bilko.io, bilko.company or authenticated Bilko SaaS surfaces. 
 
 Evidence anchors 
 
 final-live-security-summary.json 
 production-playwright-final-report.json 
 production-cache-guard-deploy.log 
 azdo-build-1129.json , azdo-build-1131.json 
 azdo-pr-completed.json , cache-guard-pr-completed.json 
 remediation-local/ 
 screenshots/production-final-desktop.png , screenshots/production-final-mobile.png