Security Sweep — bilko.company BA — MC #107300 (2026-08-18)

bilko.company Security Sweep — MC #107300

Verdict: PASS
Date: 2026-08-18
Scope: bilko.company BA landing only (apps/landing-ba), separate from bilko.cloud/bilko.io.

Confirmed findings

• P1: mixed Pages root exposed exact wrangler.toml, package/lock/TypeScript configs and app/page.tsx (15,765 bytes) as HTTP 200.
• P1: no pre-cache denial for removed source/config files.
• P2: unknown/sensitive paths returned homepage HTTP 200.
• P2: CSP/HSTS/frame/permissions headers absent.
• P2: lead handler parsed unbounded bodies/fields and did not validate Turnstile hostname or timeout.
• P2: landing-ba was blanket-excluded from Semgrep.

Remediation

• Nine byte-identical runtime assets moved to physical apps/landing-ba/public/; source/config/tooling stay outside deploy root.
• Added .assetsignore, preflight, real 404, security headers and pre-cache Pages middleware returning 404/no-store.
• Wrangler/workflow/docs deploy public from app cwd so Functions compile.
• Added 16 KiB body limit, field bounds, 415/400 handling, Turnstile secret/HTTP/5-second timeout/bilko.company hostname validation.
• Added ten BA security tests; canonical landing harness supports explicit per-domain Turnstile hostname and public HTML path.
• Removed Semgrep exclusion; JSX entity escaping provides complete parsing without URL behavior change.

Verification

• BA tests 10/10 PASS; canonical landing 29/29 PASS.
• Gitleaks 0, Semgrep 0 findings / 0 errors, pnpm audit 0 all severities.
• Local Wrangler compiled Worker and passed runtime/source/API checks.
• Preview Playwright 5/5 PASS; no real lead submitted.
• AzDO PR #356; build #1138 PASS; merge 390bbb2171027478dabb2d6c9f5679cc3e5d9054.
• Production deployment 6b384006-1d39-4a9f-92e7-0861cea22cd2, source 390bbb2.
• Production Playwright 5/5 PASS.
• Final exact paths 18/18 HTTP 404; guarded paths no-store; homepage hash equals merged asset; TLS/headers live.
• Preview removed; no #107300 preview remains.

Linked findings

• #106358 production/preview KV policy remains explicit; production and preview logged Compiled Worker.
• #106405 current sitekey 0x4AAAAAADmvPZ-_WFwLJxwE remains pinned; deleted widgets fail canonical tests. Approved removal of invalid data-size="invisible" is live.
• #106408 is HR-specific and not duplicated here.
• No lead, Slack message or KV record was created.

Residual constraints

• CSP retains 'unsafe-inline' for canonical inline HTML.
• Valid Turnstile/real lead was intentionally not submitted; verification uses source identity, invalid/hostile live probes, unit contracts, compiled Worker and binding config.
• This PASS does not cover other domains or authenticated Bilko SaaS.

Evidence

final-live-security-summary.json, production-playwright-report.json, azdo-build-1138.json, azdo-pr-completed.json, remediation-local/, production screenshots.