id: b9ee3aae-cc4b-4b40-87bc-62f33aa6cfca title: 'Inbox hardening: caps, rate, abuse suite' state: closed labels:
- kind:security assignees: [] milestone: m4-mailbox created: 2026-09-10T03:52:27.765502010Z updated: 2026-09-10T04:57:13.816214942Z
Context: Hardening is what makes the inbox shippable. Same branch lineage as #9 or follow-up branch; verify adversarially. Tasks:
- Enforce: multipart rejected; no Content-Length -> drop; 5s handler timeout; title/body/contact length caps -> 413; per-IP token bucket 2/hr -> 429; honeypot filled -> silent
received, dropped; global quota 500 files -> 503; Origin check + SameSite=Lax on forms; POST-only; no cookies/CORS;nosniff+no-storeon POST responses; full-disk -> 503. - Caps tunable via flags/env (
--max-title/--max-body/--max-bytes/--rate-per-hour/--quota,HU13_*); no config file. - Abuse test suite: flood script (3 rapid POSTs -> 3rd is 429), oversize (413), multipart (400), honeypot (fake received, 0 files), quota-full (503), null-byte + non-UTF8 (400), reflected-XSS probe (response contains no input), restart persistence (files survive). Success rubric (dod §Mailbox abuse lines):
-
Each abuse test passes individually; suite runs in CI (
f0rge ci run) in <60s. -
Fixed ~500ms POST delay present (no timing oracle); IPs stored salted-hash only (grep inbox JSON for dotted quad -> absent).
Swarm: Platinum + supervisor adversarial review. Branch
m4/inbox-harden.