Security Sweep — bilko.io RS — MC #107299 (2026-08-18)

bilko.io Security Sweep — MC #107299

Verdict: PASS
Date: 2026-08-18
Scope: bilko.io RS landing only (apps/landing-io); separate from bilko.cloud and bilko.company.

Confirmed baseline findings

1. P1 — source/config exposure: mixed Pages root served exact wrangler.toml, package.json, pnpm-lock.yaml and app/page.tsx (15,989 bytes) with HTTP 200.
2. P1 — no fail-closed cache boundary: removed assets could remain reachable through Pages cache; HR incident #107298 established one-week s-maxage persistence.
3. P2 — false 200: unknown and sensitive paths returned homepage HTTP 200.
4. P2 — missing browser controls: no CSP, HSTS, frame denial or Permissions-Policy.
5. P2 — lead endpoint hardening: unbounded bodies/fields and Turnstile success accepted without hostname validation or timeout.
6. P2 — SAST blind spot: apps/landing-io/ was blanket-excluded from Semgrep.

Remediation

• Moved nine byte-identical runtime assets under physical apps/landing-io/public/; Next source/config/lockfile remain outside deploy root.
• Added .assetsignore, asset preflight, real 404.html, CSP/HSTS/frame/referrer/permissions/COOP/CORP headers.
• Added Pages middleware that returns 404/no-store for source, config, hidden and backup paths before asset-cache lookup.
• Wrangler/workflow/docs now deploy public from app cwd so sibling Functions compile.
• Bounded bodies at 16 KiB and lead fields; unsupported media returns 415; arrays/non-objects fail closed.
• Turnstile now requires a secret, 5-second timeout, successful HTTP response and hostname bilko.io.
• Added ten IO security tests; canonical landing suite updated to Fetch-compatible Requests/public HTML path.
• Removed blanket Semgrep exclusion; escaped JSX URL entities to obtain complete parsing without changing rendered URLs.

Verification

• IO security tests: 10/10 PASS.
• Canonical landing suite: 29/29 PASS.
• Configured landing Gitleaks: 0; Semgrep: 0 findings / 0 parse errors; pnpm audit: 0 all severities.
• Local Wrangler: Worker compiled; runtime pages 200; source/config/unknown paths 404; Function invalid/OPTIONS guards pass.
• Preview Playwright: 5/5 PASS, desktop/mobile screenshots; no real lead submitted.
• AzDO PR #354, build #1134 PASS, merge 771e9c6d078945ec23319a83d3e7ff275aa8cedd.
• Production deployment 6bb2f936-b640-4653-b62b-645d914c056d, source 771e9c6.
• Production Playwright: 5/5 PASS.
• Final exact probes: 18/18 sensitive/source/config paths HTTP 404; guarded paths Cache-Control: no-store.
• Homepage bytes/hash exactly match merged public/index.html; TLS and browser headers verified live.
• Task preview deleted; no #107299 preview remains.

Linked finding reconciliation

• #106358: production and preview binding policy remains explicit in wrangler.toml; both deployments logged Compiled Worker. Preview deliberately has no production KV binding.
• #106405: current live Turnstile sitekey 0x4AAAAAADAlOJsyIecNG_GG remains pinned; deleted widgets are rejected by canonical tests. The approved removal of invalid data-size="invisible" is now live.
• No real lead, Slack message or KV record was created during this sweep.

Residual constraints

• CSP retains 'unsafe-inline' because canonical static HTML embeds inline script/style; future hash/nonce migration is recommended.
• Valid Turnstile/real-lead submission was intentionally not executed. Evidence covers current sitekey, DOM source, invalid/hostile paths, unit contracts, compiled Worker and binding config.
• Shared monorepo raw Gitleaks history reports documented synthetic test values/placeholders; configured landing scan is zero. This PASS does not apply to bilko.company or authenticated Bilko SaaS.

Evidence anchors

• final-live-security-summary.json
• production-playwright-report.json
• azdo-build-1134.json
• azdo-pr-completed.json
• remediation-local/
• screenshots/production-final-desktop.png
• screenshots/production-final-mobile.png