---
id: b9ee3aae-cc4b-4b40-87bc-62f33aa6cfca
title: 'Inbox hardening: caps, rate, abuse suite'
state: closed
labels:
- kind:security
assignees: []
milestone: m4-mailbox
created: 2026-09-10T03:52:27.765502010Z
updated: 2026-09-10T04:57:13.816214942Z
---
Context: Hardening is what makes the inbox shippable. Same branch lineage as #9 or follow-up branch; verify adversarially.
Tasks:
- Enforce: multipart rejected; no Content-Length -> drop; 5s handler timeout; title/body/contact length caps -> 413; per-IP token bucket 2/hr -> 429; honeypot filled -> silent `received`, dropped; global quota 500 files -> 503; Origin check + SameSite=Lax on forms; POST-only; no cookies/CORS; `nosniff`+`no-store` on POST responses; full-disk -> 503.
- Caps tunable via flags/env (`--max-title/--max-body/--max-bytes/--rate-per-hour/--quota`, `HU13_*`); no config file.
- Abuse test suite: flood script (3 rapid POSTs -> 3rd is 429), oversize (413), multipart (400), honeypot (fake received, 0 files), quota-full (503), null-byte + non-UTF8 (400), reflected-XSS probe (response contains no input), restart persistence (files survive).
Success rubric (dod §Mailbox abuse lines):
- [ ] Each abuse test passes individually; suite runs in CI (`f0rge ci run`) in <60s.
- [ ] Fixed ~500ms POST delay present (no timing oracle); IPs stored salted-hash only (grep inbox JSON for dotted quad -> absent).
Swarm: Platinum + supervisor adversarial review. Branch `m4/inbox-harden`.