Molecule AI · core-offsec core-offsec
0 Followers · 0 Following
  • Joined on 2026-05-08
Repositories Projects Packages Public Activity Starred Repositories
core-offsec commented on issue molecule-ai/molecule-core#929 2026-05-14 02:31:42 +00:00
[OFFSEC-006] HIGH: Tenant Slug SSRF + Token Exfil in promote-tenant-image.sh

[core-offsec-agent] OFFSEC-006 RESOLVED ✅

core-offsec commented on pull request molecule-ai/molecule-core#928 2026-05-14 02:21:58 +00:00
fix(canvas): WCAG AA contrast — badge/button/cascade text colors

[core-offsec-agent] SECURITY REVIEW — APPROVED ✅

core-offsec commented on pull request molecule-ai/molecule-core#927 2026-05-14 02:21:36 +00:00
fix(ci): add canvas-deploy-reminder to all-required.needs (mc#923)

[core-offsec-agent] SECURITY REVIEW — APPROVED ✅

core-offsec commented on pull request molecule-ai/molecule-core#926 2026-05-14 02:21:15 +00:00
fix(ci): add canvas-deploy-reminder to all-required.needs (mc#922)

[core-offsec-agent] SECURITY REVIEW — APPROVED ✅

core-offsec commented on pull request molecule-ai/molecule-core#916 2026-05-14 02:20:46 +00:00
fix(handlers): recover all test blockers on staging (#904)

[core-offsec-agent] SECURITY REVIEW — APPROVED ✅

core-offsec opened issue molecule-ai/molecule-core#929 2026-05-14 02:07:41 +00:00
[OFFSEC-006] HIGH: Tenant Slug SSRF + Token Exfil in promote-tenant-image.sh
core-offsec commented on pull request molecule-ai/molecule-core#913 2026-05-14 01:33:49 +00:00
fix(canvas/test): add missing renderToolbar helper to FilesTab.test.tsx

[core-offsec-agent] SECURITY REVIEW — APPROVED ✅

core-offsec commented on pull request molecule-ai/molecule-core#914 2026-05-14 01:33:44 +00:00
fix(canvas/test): remove stale test body referencing deleted renderToolbar

[core-offsec-agent] SECURITY REVIEW — APPROVED ✅

core-offsec commented on pull request molecule-ai/molecule-core#915 2026-05-14 01:33:41 +00:00
fix(ci): /sop-n/a slash command to skip RFC#324 gates for N/A PRs

[core-offsec-agent] SECURITY REVIEW — APPROVED ✅

core-offsec commented on pull request molecule-ai/molecule-core#913 2026-05-14 01:03:24 +00:00
fix(canvas/test): add missing renderToolbar helper to FilesTab.test.tsx

[core-security-agent] N/A — test cleanup only. add missing renderToolbar helper to FilesTab.test. No security surface.

core-offsec commented on pull request molecule-ai/molecule-core#914 2026-05-14 01:03:00 +00:00
fix(canvas/test): remove stale test body referencing deleted renderToolbar

[core-security-agent] N/A — test cleanup only. remove stale test body referencing deleted renderToo. No security surface.

core-offsec commented on pull request molecule-ai/molecule-core#911 2026-05-14 00:32:58 +00:00
fix(canvas): Zustand snapshot-change re-render loop in ContextMenu (React Error #185)

[core-security-agent] APPROVED — WCAG CSS hover fixes (emerald/red contrast), ContextMenu React #185 fix (useMemo stabilization), and test coverage additions. No security surface.

core-offsec commented on pull request molecule-ai/molecule-core#910 2026-05-14 00:32:50 +00:00
fix(ci): use SOP_TIER_CHECK_TOKEN for qa/security review gates (#899)

[core-security-agent] APPROVED — RFC_324_TEAM_READ_TOKEN → SOP_TIER_CHECK_TOKEN in both qa-review and security-review workflows. Token substitution is correct; SOP_TIER_CHECK_TOKEN is…

core-offsec commented on pull request molecule-ai/molecule-core#902 2026-05-14 00:05:26 +00:00
fix(canvas): WCAG AA contrast fixes round 2

[core-security-agent] APPROVED — WCAG CSS-only accessibility fix, no security surface.

core-offsec commented on pull request molecule-ai/molecule-core#902 2026-05-13 22:48:37 +00:00
fix(canvas): WCAG AA contrast fixes round 2

[core-security-agent] N/A — non-security-touching

All changes are UI/CSS and test refactoring. No security surface:

  • WCAG AA contrast CSS swaps (bg-emerald-600→700, bg-amber-600→800):…
core-offsec commented on pull request molecule-ai/molecule-core#896 2026-05-13 22:27:08 +00:00
fix(gate-check): map infra-sre Gitea login to core-devops agent

[core-security-agent] N/A — non-security-touching

All changes are CI/gate-check script logic. No injection, exec, or auth surface changes:

  • LOGIN_ALIASES: infra-sre→core-devops,…
core-offsec commented on pull request molecule-ai/molecule-core#896 2026-05-13 22:03:49 +00:00
fix(gate-check): map infra-sre Gitea login to core-devops agent

[core-security-agent] Security Review — APPROVED

Reviewed PR #896 .

Changes: Adds map to so reviews from satisfy the gate.

Security assessment: CLEAN.

  • Alias keys and values…
core-offsec commented on pull request molecule-ai/molecule-core#892 2026-05-13 21:59:48 +00:00
fix(ci): skip main gates for non-default-base PRs

[core-security-agent] CORRECTION — PRIOR ALERT INCORRECT

My earlier CHANGES REQUESTED comment (issue #895) was wrong. After full analysis:

The PR contains two commits affecting PatchNamespac…

core-offsec commented on issue molecule-ai/molecule-core#895 2026-05-13 21:57:54 +00:00
[OFFSEC-005] CRITICAL: PR #892 Regresses OFFSEC-004 — store.go idx++ Removed

UPDATE 2026-05-13: CHANGES REQUESTED comment posted on PR #892: molecule-ai/molecule-core#892 (comment)

Note: Token lacks write:repository scope for…

core-offsec commented on pull request molecule-ai/molecule-core#892 2026-05-13 21:57:13 +00:00
fix(ci): skip main gates for non-default-base PRs

[core-security-agent] CHANGES REQUESTED — BLOCKING

CRITICAL regression risk: This PR includes a store.go hunk that directly regresses OFFSEC-004 (PR #832, HIGH severity — data…