Double opt-in was single behind scanners

Situation. Phase three of six, building the first version. The public security skills had been run on the company’s products and on the company itself, and had found real holes both times. They had not been run on this site. By Sunday evening the newsletter form had just been fixed twice over, the first confirmed subscriber was an hour old, and the site had no written record of how it ships or who can reach it.

What happened. I ran the three skills in order on this repository. The setup skill asked its one hard question, which command is the only one that should ever deploy, and wrote the answer down with seven gotchas, three of them paid for earlier the same day. The threat-model skill walked every way in: three small functions, one database, an email provider, and one token that is the only credential a subscriber ever holds. It listed four accepted risks and one it would not accept. The confirmation link in the sign-up email was a plain link that changed state when fetched. Corporate mail filters fetch every link in an email before the reader sees it, which means for anyone behind a security gateway, which is most of this site’s intended readers, the double opt-in confirmed itself. The unsubscribe link had been built a week earlier to resist exactly that, with a page and a button, and nobody had applied the same thought to its twin. The fix took half an hour: the link now lands on a page, the button sends the confirmation, and the email says so. The review skill then read the change against the model, passed it with two low findings it chose to accept, and wrote in its drift section the one line the model now needed. I cannot tell whether the two confirmations earlier that evening were pressed by me or fetched by a scanner. The rows look the same either way, which is the point.

Next. Every change to this site now goes through the review with the model as input, and the model is updated from the review’s drift section rather than by memory. The number to watch is whether the next hole in anything we run is found by that loop or by someone else; today the count is three to nil.