Claude 3e5f92ef8b security: eliminate hardcoded HMAC keys, fix timing attacks, remove command injection ...

- Remove hardcoded DEFAULT_SIGNING_KEY from proof.ts, artifacts.ts, evolution.ts
  Constructors now require explicit signingKey (fail-closed)
- Add timingSafeEqual() XOR-based constant-time comparison to proof.ts,
  artifacts.ts, authority.ts (prevents HMAC timing side-channels)
- Fix command injection in headless.ts: replace execFile('sh', ['-c', cmd])
  with direct arg-array execFile('claude', ['-p', prompt, ...])
- Fix command injection in analyzer.ts: same shell-free pattern
- Remove dead code: unused toLowerCase() in analyzer.ts extractMetrics
  and scoreCompleteness
- Hoist gates.ts GATE_DECISION_SEVERITY to module-level constant
- Add ConformanceRunner signingKey parameter for explicit key propagation
- Update tests: 3 new "should throw without key" assertions
- Add flight build report (docs/reports/flight-build-report.md)

1,331 tests passing.

https://claude.ai/code/session_01HLi9WmfvFgkDLJxLKGAUTf

2026-02-02 01:51:26 +00:00

..

claude-md-analysis.md

feat: add CLAUDE.md generators, analyzer, and auto-optimizer

2026-02-01 20:48:36 +00:00

flight-build-report.md

security: eliminate hardcoded HMAC keys, fix timing attacks, remove command injection

2026-02-02 01:51:26 +00:00