Security Sweep — bilko.company BA — MC #107300 (2026-08-18)

bilko.company Security Sweep — MC #107300 
 Verdict: PASS 
 Date: 2026-08-18 
 Scope: bilko.company BA landing only ( apps/landing-ba ), separate from bilko.cloud/bilko.io. 
 Confirmed findings 
 
 P1: mixed Pages root exposed exact wrangler.toml , package/lock/TypeScript configs and app/page.tsx (15,765 bytes) as HTTP 200. 
 P1: no pre-cache denial for removed source/config files. 
 P2: unknown/sensitive paths returned homepage HTTP 200. 
 P2: CSP/HSTS/frame/permissions headers absent. 
 P2: lead handler parsed unbounded bodies/fields and did not validate Turnstile hostname or timeout. 
 P2: landing-ba was blanket-excluded from Semgrep. 
 
 Remediation 
 
 Nine byte-identical runtime assets moved to physical apps/landing-ba/public/ ; source/config/tooling stay outside deploy root. 
 Added .assetsignore , preflight, real 404, security headers and pre-cache Pages middleware returning 404/no-store. 
 Wrangler/workflow/docs deploy public from app cwd so Functions compile. 
 Added 16 KiB body limit, field bounds, 415/400 handling, Turnstile secret/HTTP/5-second timeout/ bilko.company hostname validation. 
 Added ten BA security tests; canonical landing harness supports explicit per-domain Turnstile hostname and public HTML path. 
 Removed Semgrep exclusion; JSX entity escaping provides complete parsing without URL behavior change. 
 
 Verification 
 
 BA tests 10/10 PASS ; canonical landing 29/29 PASS . 
 Gitleaks 0 , Semgrep 0 findings / 0 errors , pnpm audit 0 all severities . 
 Local Wrangler compiled Worker and passed runtime/source/API checks. 
 Preview Playwright 5/5 PASS ; no real lead submitted. 
 AzDO PR #356; build #1138 PASS; merge 390bbb2171027478dabb2d6c9f5679cc3e5d9054 . 
 Production deployment 6b384006-1d39-4a9f-92e7-0861cea22cd2 , source 390bbb2 . 
 Production Playwright 5/5 PASS . 
 Final exact paths 18/18 HTTP 404 ; guarded paths no-store; homepage hash equals merged asset; TLS/headers live. 
 Preview removed; no #107300 preview remains. 
 
 Linked findings 
 
 #106358 production/preview KV policy remains explicit; production and preview logged Compiled Worker . 
 #106405 current sitekey 0x4AAAAAADmvPZ-_WFwLJxwE remains pinned; deleted widgets fail canonical tests. Approved removal of invalid data-size="invisible" is live. 
 #106408 is HR-specific and not duplicated here. 
 No lead, Slack message or KV record was created. 
 
 Residual constraints 
 
 CSP retains 'unsafe-inline' for canonical inline HTML. 
 Valid Turnstile/real lead was intentionally not submitted; verification uses source identity, invalid/hostile live probes, unit contracts, compiled Worker and binding config. 
 This PASS does not cover other domains or authenticated Bilko SaaS. 
 
 Evidence 
 final-live-security-summary.json , production-playwright-report.json , azdo-build-1138.json , azdo-pr-completed.json , remediation-local/ , production screenshots.