What's pending across every project
3 open · sorted by priority then due-date
Filtered by tag database clear
blocker
urgent
Lock down core-service /db/execStoredProc: public, no auth, runs any schema.function as postgres
The crypto538-core-service-production endpoint is reachable by anyone: Cloud Run ingress is "all" and allUsers has run.invoker. The handler (stored_proc.go handleExecStoredProc) has no authentication and no allowlist. It accepts any "schema.function" name plus arguments and runs it on the shared Cloud SQL instance as postgres, which is also used by AdaptiveSAT, Vajra and CitrineOS. That includes the dynamic-DDL routines (table_creation_package, tb_*_generator, sp_initialdata_generator). Not exploited or tested. Suggested fix: allowlist the procs actually used plus a shared-secret or IAM check, or remove the route if unused. Validate callers first, per the cleanup rule.
crypto538-core-service/stored_proc.go:135crypto538-core-service/main.go:494
CoinTrends.ai
· cointrends
· by saravanan@scrumclaw.ai
6d ago
10-20 12:44
10-20 12:44
todo
high
Create a dedicated least-privilege DB user for ml-training before scheduling Batch training
Batch training currently connects as `postgres`, the admin of the shared Cloud SQL instance crypto-track-321e8b45, which other products also use. Before scheduling, create a user with access to only the CryptoTrack_Prod objects training needs: getcryptodata, cryptomaster, cryptopredictionslicemaster and updatetracking. Store its password in a new secret and point batch/*.json at it.
HopewellPartners/ml-training batch/*.json#83-#87
CoinTrends.ai
· cointrends
· by saravanan@scrumclaw.ai
7d ago
10-20 02:16
10-20 02:16
todo
high
PR "Coin Roster": make cryptomaster the only coin list; onboard any coin with dbo.onboard_coin()
8 steps, one PR per layer: DB onboarding function; DB collection; DB readers; core-service roster cache; ml-core-service; webapp; ml-training Batch task count; end-to-end proof with a new coin. Full instructions: cointrends/plans/PR-coin-roster.md (also in the project docs as claude/PR-coin-roster.md). Open questions: ship before or after Locked Door (#129); how DDL gets executed; which repo holds DB migrations.
plans/PR-coin-roster.md#129#118
CoinTrends.ai
· cointrends
· by saravanan@scrumclaw.ai
💬 2 comments
6d ago
10-20 12:53
10-20 12:53