Security Sweep — lumiscare.com Public Landing — MC #107301 (2026-08-18)

lumiscare.com Security Sweep — MC #107301

Overall verdict: PARTIAL
Public marketing domain: PASS
Repository credential/key posture: BLOCKED — external rotation/owner decisions required
Date: 2026-08-18

Scope and privacy boundary

Only public lumiscare.com, tracked landing/, repository metadata/history scans and deployment configuration were examined. No authentication, patient/carer/tenant data, PHI, clinical API, portal workflow, account or form submission was accessed. Both AzDO and GitHub repositories are PRIVATE.

Public-domain findings and remediation

1. P1 — false 200 fallback: navigationFallback rewrote every unknown/source/sensitive path to the homepage with HTTP 200.
   • Removed SPA fallback (the marketing site has no client router).
   • Added 404.html and SWA responseOverrides.404 preserving HTTP 404.
2. P2 — unnecessary CSP privilege: a scriptless/formless static site allowed inline/eval scripts, broad Microsoft/Azure/ALAI connections, blob and arbitrary HTTPS images.
   • CSP now uses script-src 'none', connect-src 'none', form-action 'none', object-src 'none', frame-ancestors 'none', explicit Google Fonts styles/fonts and self/data images only.
   • Added COOP/CORP and expanded Permissions-Policy denial.
3. P2 — missing regression gate: added scripts/check-public-landing.py and blocking Azure CI job for exact asset allowlist, no scripts/forms/symlinks, strict CSP and true 404.
4. P1 process safety — clinical blast radius: ordinary manual runs deploy backend and all clinical portals.
   • Added typed ciOnly and publicLandingOnly runtime parameters.
   • Build #1141 proved a queue variable was ineffective and was cancelled before any backend build/deploy job.
   • Build #1145 proved backend-only guarding still allowed frontend stage entry and was cancelled before any SWA deploy job.
   • Build #1148 PASS: only Gate: Public landing security ran; every build/deploy/PI2/prod stage was machine-verified SKIPPED.
5. Credential hygiene: removed RUNBOOK instructions that extracted a PAT from a git remote. The expired credential-bearing local azdo URL was replaced by credential-free canonical HTTPS; current vault askpass was validated. No credential value appears in evidence.

Public verification

• Local preflight PASS; Azure SWA emulator: root/legal 200, source/config/unknown paths true 404, restrictive headers live.
• Landing Gitleaks 0; landing Semgrep 0 findings / 0 errors.
• Preview SWA mc107301: Playwright 4/4 PASS, desktop/mobile screenshots, zero data entry.
• AzDO PR #357 merged to dev as e7560a32bd78a0f3e862a5a2852ce52b73575ffe with explicit [skip ci]; no automatic clinical pipeline was created.
• Production deployed manually to only lumiscare-landing; no backend/backoffice/admin/family deployment.
• Production Playwright 4/4 PASS.
• Final exact probes: 13/13 HTTP 404; homepage hash exactly matches merged landing/index.html; TLS and all required headers live.
• Preview deleted; only SWA environment default remains Ready.

Repository blockers — not silently closed

Redacted full scan found 35 current-tree and 76 reachable-history Gitleaks records. They include documented legacy/test candidates but also previously confirmed security findings that this public-domain task cannot safely rotate or rewrite:

• MC #10065 (paused, owner decision): tracked RSA private-key files; revoke/replace/history treatment requires owner authorization.
• MC #103380 (open): legacy external-tenant Azure service-principal secret; external tenant admin must rotate/delete and audit RBAC. No value was printed.
• MC #103765 (open): Azure DevOps PAT class in historical/current build material; rotation and repository-wide cleanup remain owned by that task.

Current-tree removal alone would not revoke credentials or purge reachable history. Those actions cross client/legacy-tenant boundaries and are therefore a real blocker, not a process excuse. Consequently the repository cannot receive a zero-secret PASS under MC #107301.

Residual accepted items

• style-src 'unsafe-inline' remains because the canonical landing embeds CSS in HTML; scripts are fully disabled.
• Google Fonts remain external and explicitly scoped in CSP.
• Marketing/feature claims were not validated as clinical capabilities in this security task.

Evidence anchors

• final-live-security-summary.json
• production-playwright-report.json
• build-1148-timeline.json
• azdo-build-1148.json
• azdo-pr-completed.json
• preview-cleanup.json
• repository-visibility.json
• baseline/gitleaks-tree.json and baseline/gitleaks-history.json (redacted, mode 0600)
• remediation-local/