This page exists so you don't have to take "secure" on faith. Every finding below came from running the real extracted code against real or synthetic input, not from reading a design document. Fixed findings were re-tested after the fix, with the same attack, to confirm it actually holds.
One boot menu entry boots directly to a root shell via the single kernel parameter. No GRUB password, no superuser list, no gate of any kind. Confirmed by reading the generated GRUB config — not theoretical.
Mitigation: set a GRUB superuser password before production use; see the enterprise page. This is also a documented, intentional disaster-recovery path, so the fix is a deployment decision, not a code patch.
sudo's default 15-minute timestamp cache means a second privileged action in that window skips re-checking TOTP. Confirmed by reproducing the exact sudoers/PAM configuration with the real sudo binary.
Mitigation: add Defaults timestamp_timeout=0 to force a fresh TOTP check on every sudo call.
The SSH and inbound-connection detectors both match IPv4 address patterns only. A single IPv6 source, at any volume, currently goes counted — confirmed by replaying 50 failed logins from one IPv6 address against the real detector code: zero detections.
1,000 source IPs, 2 attempts each, never crossed the per-source threshold. Re-run against the patched detector (a global/distinct-source counter): fired correctly.
480 connections per 30 seconds, sustained, never crossed the short-window limit. Re-run against the patched detector (a long-window counter): fired at 12 minutes in.
Blank input, malformed input, and a correctly-formatted-but-wrong code were all tested against the real verification script. All three failed closed before reaching the cryptographic check.
| Not yet verified | Why it matters |
|---|---|
Full ISO build (lb bootstrap/lb binary) and boot on real hardware | Integration bugs — ordering, paths, missing dependencies — can't be seen from extracted functions alone. |
| Dashboard UI code in full | Reviewed its command dispatch and auth boundary closely; not every line. |
| GPG secrets-sealing flow under real hardware conditions | Logic reviewed; not exercised against a real TPM/console-presence check. |
| systemd unit ordering under real boot timing | Can only be confirmed by an actual boot. |
If you're evaluating this for production, the honest summary is: the detection and authentication logic has been tested hard and held up well where it mattered. Treat this page as current, not as a one-time audit — it gets updated as findings are closed or new ones are found.