Summary

PR 2 of 4 in the critical-cleanup sweep. Addresses every CRITICAL and the seven highest-severity HIGH findings from the parallel security audit.

Pairs with the CI gates landed in #1.

CRITICAL fixes

1. Python executor RCE (services/crews/tools/python_executor.py)

The previous blocklist was a substring search on the raw code string. Bypassable in seconds:

m = __import__('o' + 's')              # split string defeats `import os` check
importlib.import_module('subprocess')  # importlib wasn't in the blocklist
open('/etc/passwd').read()             # open was never blocked
().__class__.__bases__[0].__subclasses__()  # dunder traversal to subprocess.Popen

Fix: Replaced with RestrictedPython.compile_restricted — AST-level validation that rejects __import__, exec, eval, dunder traversal, and attribute writes at compile time. Globals are limited to safe_builtins + limited_builtins + utility_builtins plus a name-bound stdlib allowlist (math, statistics, collections, itertools, etc.). Stdout captured by PrintCollector. Thread-based wall-clock timeout.

2. Twilio webhook signature validation (api/voice_webhooks.py)

All three endpoints (voice-status, voice-recording, voice-transcription) had zero signature validation. Anyone with the URL could:

• Inject arbitrary transcripts for any guessable call_sid
• Forge call statuses (mark completed, failed)
• Trigger voice_service.process_completed_call against arbitrary records

Fix: New core/webhook_security.verify_twilio_signature — HMAC-SHA1 over the sorted form params + the public URL, signed with TWILIO_AUTH_TOKEN. Uses TWILIO_WEBHOOK_BASE_URL to reconstruct the URL Twilio actually signed when behind a reverse proxy. All three endpoints Depends() on the verifier, so requests are 403'd before any DB access.

3. Resend webhook HMAC (api/webhooks.py)

RESEND_WEBHOOK_SECRET was configured but never imported by the handler. Anyone could POST forged bounce/complaint events to suppress legitimate emails or fabricate EmailEvent rows.

Fix: Svix-style HMAC-SHA256 over {webhook_id}.{timestamp}.{body} with 5-minute replay tolerance. Handles the whsec_ prefix and both svix-* / webhook-* header casings.

4. init_db() silent failure (database.py)

except Exception:
    pass  # Tables already exist from migrations

Swallowed all exceptions including wrong-DSN/permission/network errors — boot succeeded with a dead DB.

Fix: Replaced with an explicit SELECT 1 connectivity check that raises RuntimeError on failure. Base.metadata.create_all() removed — Alembic is the single source of truth for schema, which closes the silent migration-drift bug.

HIGH fixes

5. SSRF on outbound HTTP (core/url_guard.py, both web_scraper.py)

Both scrapers used httpx.AsyncClient(follow_redirects=True) with no IP filter. Prompt-injectable into hitting http://169.254.169.254/... (AWS IMDS) or any internal service.

Fix: New url_guard module with assert_safe_url + safe_http_get:

• Rejects non-http/https schemes (file://, gopher://, etc.)
• Resolves all DNS records; rejects if any is loopback / link-local / RFC-1918 / multicast / reserved
• safe_http_get follows redirects manually with per-hop revalidation — closes the "benign hostname 302s to IMDS" bypass

6–8. IDOR fixes (api/findings.py, api/voice.py, api/missions.py)

All three returned data filtered only by their resource ID, never by user_id. An authenticated attacker could enumerate other users' findings, voice extractions, call transcripts, and mission runs by guessing UUIDs.

Fix: Each list/get/create now joins through Project (or Mission for runs) on user_id. voice.py factored the ownership check into a shared _owned_voice_extraction helper. findings.py and voice.py also gained limit/offset pagination.

9. Auth brute-force (api/auth.py)

/auth/login and /auth/register had zero rate limiting despite slowapi being installed.

Fix: @limiter.limit("5/minute") on login, @limiter.limit("3/minute") on register.

10. LLM-controlled phone numbers (core/phone_guard.py, voice_caller.py)

The LLM could supply any string to voice_caller's phone_number parameter — including premium-rate (+1-900), international, and emergency lines. Real cost / TCPA exposure.

Fix: New phone_guard.validate_outbound_number:

• Parses via phonenumbers
• Region must be in US/CA allowlist (configurable)
• Number type must be FIXED_LINE / MOBILE / TOLL_FREE / VOIP
• Explicit denylist: 1-900, 1-976, 1-809, 9xx emergency short codes
• Failure returns a structured tool-error so the LLM can self-correct

11. Voice server CORS (voice/server.py)

allow_origins=["*"] with a WebSocket / future-credentialed surface = cross-site hijacking from any origin.

Fix: Parsed settings.allowed_origins allowlist, narrowed methods/headers.

Tests

backend/tests/test_security_guards.py — unit coverage for each new primitive:

• 7 python_executor tests confirming the historic bypasses now fail
• 6 url_guard tests for loopback, IMDS, RFC-1918, IPv6 loopback, file://, missing host
• 5 phone_guard tests for 1-900, 911, +44, empty input, valid US mobile
• 3 webhook_security tests for Twilio reference match, Resend valid signature, Resend replay rejection

New dependencies

• RestrictedPython>=7.4 — the sandbox itself
• twilio>=9.0.0 — used elsewhere already; pinned here for the SDK
• phonenumbers>=8.13.0 — E.164 parsing

What this does NOT fix (deferred to PR 3)

These are reliability/perf, not security:

• APScheduler in-process multi-fire under --workers >1 → PR 3
• Missing DB indexes → PR 3
• Sync db.query in async routes → PR 3
• asyncio.ensure_future (deprecated) → PR 3

Test plan

• CI green on this branch
• test_security_guards.py passes
• Manual: hit /webhooks/twilio/voice-status with no signature → expect 403
• Manual: hit /webhooks/resend with a stale svix-timestamp → expect 403
• Manual: invoke python_executor with __import__('o'+'s') → expect status: error
• Manual: voice_caller with phone_number: "+19005551234" → expect rejection

References

• Security review CRITICAL chore: bootstrap operational hygiene (CI, hooks, templates, configs) #1-4, HIGH chore(deps): bump actions/setup-node from 4 to 6 #5-11
• Architecture review G5 (init_db silent fail)