Skip to content

Security audit — 2026-07-24

Scope: the DTED.org current tree and Git history, Python application code and dependencies, built container, Compose runtime policy, Nginx/TLS edge, production credential-file permissions, public endpoints, and generated source receipt metadata. Secret values and client IPs were not collected.

Application revision: 017ff3e33617494aa78242403f3e84813a72d522. Production portal image: sha256:2907ae9d9132563f99fa9cb6b172dc656f83636378db4d2bef701fd5def6f53f.

Results

Area Result Evidence or remediation
Current tree Pass Gitleaks v8.30.1, fully redacted, no findings
Complete Git history Pass 75 commits scanned by Gitleaks v8.30.1, no findings
Large receipt metadata Pass 105 repository and production JSON files scanned without emitting values; no findings or parse errors
Python package consistency Pass Exact image passes python -m pip check
Python advisories Pass pip-audit found no known vulnerability after upgrading pip 26.1.2, setuptools 83.0.0, and wheel 0.46.2
Container vulnerabilities Pass Trivy found zero fixed high/critical OS or Python findings in the exact production image
Static analysis Pass Bandit medium/high scan is clean; remote XML uses defusedxml and narrow intentional URL/TLS exceptions are documented inline
Container isolation Pass Both services are deployed with a read-only root, all capabilities dropped, no-new-privileges, PID limit 512, init, isolated /tmp, and unprivileged UID/GID 1001
Nginx/TLS Pass Public listeners are Nginx on 80/443; the portal is loopback-only on 8780; version tokens are hidden; TLS 1.2 and 1.3 verify successfully
Credential files Pass Provider files are root:root 0600, admin hash is root:www-data 0640, TLS key is root-only, portal database is 0640, and the stale one-time password file was deleted without reading
Admin bootstrap Remediated Future bootstrap writes only a SHA-512 hash and shows the random password once on the controlling terminal

Live acceptance

The hardened revision was deployed successfully. Nginx configuration validation, portal health, container-policy inspection, and documentation publication passed. External responses were verified as follows:

  • documentation 200;
  • admin without credentials 401;
  • active California 200;
  • protected California 3DEP preview from a public client 403;
  • the same preview through the loopback QA path 200;
  • unknown dataset 404.

Every response above identifies only Server: nginx and includes HSTS, X-Content-Type-Options: nosniff, frame denial, a no-referrer policy, and the restrictive permissions policy.

California, Tennessee, Texas, and Virginia passed the quality-required live smoke test. North Carolina and South Carolina passed delivery/integrity smoke checks while retaining their disclosed failed terrain-quality result. The protected California 3DEP candidate passed locally with quality required and baseline_policy: none. All seven checks validated the SDS index, byte ranges, offline package, root per-cell path, native ATAK-prefixed per-cell path, and client-host targeting. The source-specific check also required a 404 outside its coverage.

Test suite: 101 passed. Strict documentation build, Compose rendering, shell syntax, Git diff checks, Bandit, pip consistency, pip-audit, Trivy, repository secret scan, full-history secret scan, and 105-file receipt metadata scan all passed.

Scanner provenance

  • Gitleaks v8.30.1: sha256:c00b6bd0aeb3071cbcb79009cb16a60dd9e0a7c60e2be9ab65d25e6bc8abbb7f
  • Trivy v0.72.0: sha256:cffe3f5161a47a6823fbd23d985795b3ed72a4c806da4c4df16266c02accdd6f
  • pip-audit v2.10.1
  • Bandit v1.9.4

Residual risks

Superseded July 31, 2026: the operator site now uses central AndKit OIDC and the legacy Nginx Basic Authentication tooling has been removed. The remaining bullets preserve this audit's point-in-time findings.

  • A Content Security Policy is not yet enforced because the current landing and documentation assets require compatibility review. Other browser hardening headers are enforced.
  • dted-enclave and snstac-tak-interop are not resolved from the public PyPI advisory index. Tests, static analysis, pinned source hashes, and container scanning cover them, but public package-name advisory matching does not.
  • Application dependencies use bounded compatible-release ranges and therefore can advance on a future rebuild. The base image, build backend, packaging tools, and TAK source archive are pinned; operators must retain and scan the exact deployed image digest.
  • North Carolina and South Carolina have disclosed terrain-quality failures. Those are data integrity/fitness limitations, not security scan failures.
  • The service is public-information-only. The system-use notice does not confer CMMC certification or authorization to process FCI or CUI.