All remaining unfixed issues from 3-round exhaustive audit are now
resolved. 8 Medium + 16 Low = 24 items.
== Medium (8) ==
M1: GetLogs timestamp always time.Now()
mihomo/service.go GetLogs now parses RFC3339 prefix from stored log
lines, infers level (ERROR/WARN/INFO/DEBUG) from payload prefix.
M2: Cron parser silently ignores */N and range
telegram/scheduler.go cronFieldMatches now supports */N (step),
A-B (range), A-B/N (stepped range) in addition to * and comma.
M3: findExistingProcesses holds pm.mu during /proc scan
mihomo/process.go start() now calls findExistingProcesses() BEFORE
acquiring pm.mu. Logs/Status/Stop no longer blocked during scan.
M4: Cluster HealthCheckAll sequential (N*12s)
cluster/service.go now fans out goroutines with WaitGroup. Worst
case drops from N*12s to ~12s.
M5: Panel settings PUT not transactional
router/panel_settings.go PUT handler now wraps create/update loop
in db.Transaction(). Partial failure rolls back.
M6: Cluster api_token no validation at save time
cluster/service.go Create/Update now validate JWT shape (starts
with 'ey', 3 dot-separated parts). Clear error message guides
operator to POST /api/v1/auth/login.
M7: Disk full — stale config warning not prominent
app/app.go soft-fail warnings changed to [WARNING] prefix + hint
to check listener configs.
M8: Telegram bot retries forever on 401
telegram/bot.go loop now detects 401/Unauthorized, switches to
5-minute retry interval (was 5s). Clears on success.
== Low (16) ==
L1: Scheduler/Bot Start() idempotent via sync.Once
L2: Container.Shutdown() method added
L3: Enforcer lastBlocked prunes deleted users
L4: traffic.Service first-call rate skipped (was bogus spike)
L5: strings.HasPrefix replaces path[:4]=="/api"
L6: ActiveCredentialsByListener batch-load (N+1→1 query)
L7: Telegram bot commands check DB errors
L8: Cluster health save error logged
L9: Collector continues on AddSample failure (was return)
L10: user.Create logs warning instead of returning error after
successful DB write
L11-L14: Documentation comments for known limitations (HTTP-01
goroutine, GlobalConfig thread-safety, credentialsChanged
thread-safety, SubToken TOCTOU)
L15: useAuth.ts calls fetchMe() to refresh mustChangePassword
L16: Verified access-tokens/client-access endpoints are NOT dead
Verification: go build/vet/test PASS, npm run build PASS, gofmt clean.
fix(all-remaining): 24 audit findings — Medium + Low severity
All remaining unfixed issues from 3-round exhaustive audit are now
resolved. 8 Medium + 16 Low = 24 items.
== Medium (8) ==
M1: GetLogs timestamp always time.Now()
mihomo/service.go GetLogs now parses RFC3339 prefix from stored log
lines, infers level (ERROR/WARN/INFO/DEBUG) from payload prefix.
M2: Cron parser silently ignores */N and range
telegram/scheduler.go cronFieldMatches now supports */N (step),
A-B (range), A-B/N (stepped range) in addition to * and comma.
M3: findExistingProcesses holds pm.mu during /proc scan
mihomo/process.go start() now calls findExistingProcesses() BEFORE
acquiring pm.mu. Logs/Status/Stop no longer blocked during scan.
M4: Cluster HealthCheckAll sequential (N*12s)
cluster/service.go now fans out goroutines with WaitGroup. Worst
case drops from N*12s to ~12s.
M5: Panel settings PUT not transactional
router/panel_settings.go PUT handler now wraps create/update loop
in db.Transaction(). Partial failure rolls back.
M6: Cluster api_token no validation at save time
cluster/service.go Create/Update now validate JWT shape (starts
with 'ey', 3 dot-separated parts). Clear error message guides
operator to POST /api/v1/auth/login.
M7: Disk full — stale config warning not prominent
app/app.go soft-fail warnings changed to [WARNING] prefix + hint
to check listener configs.
M8: Telegram bot retries forever on 401
telegram/bot.go loop now detects 401/Unauthorized, switches to
5-minute retry interval (was 5s). Clears on success.
== Low (16) ==
L1: Scheduler/Bot Start() idempotent via sync.Once
L2: Container.Shutdown() method added
L3: Enforcer lastBlocked prunes deleted users
L4: traffic.Service first-call rate skipped (was bogus spike)
L5: strings.HasPrefix replaces path[:4]=="/api"
L6: ActiveCredentialsByListener batch-load (N+1→1 query)
L7: Telegram bot commands check DB errors
L8: Cluster health save error logged
L9: Collector continues on AddSample failure (was return)
L10: user.Create logs warning instead of returning error after
successful DB write
L11-L14: Documentation comments for known limitations (HTTP-01
goroutine, GlobalConfig thread-safety, credentialsChanged
thread-safety, SubToken TOCTOU)
L15: useAuth.ts calls fetchMe() to refresh mustChangePassword
L16: Verified access-tokens/client-access endpoints are NOT dead
Verification: go build/vet/test PASS, npm run build PASS, gofmt clean.
fix(all-remaining): 24 audit findings — Medium + Low severity
All remaining unfixed issues from 3-round exhaustive audit are now
resolved. 8 Medium + 16 Low = 24 items.
== Medium (8) ==
M1: GetLogs timestamp always time.Now()
mihomo/service.go GetLogs now parses RFC3339 prefix from stored log
lines, infers level (ERROR/WARN/INFO/DEBUG) from payload prefix.
M2: Cron parser silently ignores */N and range
telegram/scheduler.go cronFieldMatches now supports */N (step),
A-B (range), A-B/N (stepped range) in addition to * and comma.
M3: findExistingProcesses holds pm.mu during /proc scan
mihomo/process.go start() now calls findExistingProcesses() BEFORE
acquiring pm.mu. Logs/Status/Stop no longer blocked during scan.
M4: Cluster HealthCheckAll sequential (N*12s)
cluster/service.go now fans out goroutines with WaitGroup. Worst
case drops from N*12s to ~12s.
M5: Panel settings PUT not transactional
router/panel_settings.go PUT handler now wraps create/update loop
in db.Transaction(). Partial failure rolls back.
M6: Cluster api_token no validation at save time
cluster/service.go Create/Update now validate JWT shape (starts
with 'ey', 3 dot-separated parts). Clear error message guides
operator to POST /api/v1/auth/login.
M7: Disk full — stale config warning not prominent
app/app.go soft-fail warnings changed to [WARNING] prefix + hint
to check listener configs.
M8: Telegram bot retries forever on 401
telegram/bot.go loop now detects 401/Unauthorized, switches to
5-minute retry interval (was 5s). Clears on success.
== Low (16) ==
L1: Scheduler/Bot Start() idempotent via sync.Once
L2: Container.Shutdown() method added
L3: Enforcer lastBlocked prunes deleted users
L4: traffic.Service first-call rate skipped (was bogus spike)
L5: strings.HasPrefix replaces path[:4]=="/api"
L6: ActiveCredentialsByListener batch-load (N+1→1 query)
L7: Telegram bot commands check DB errors
L8: Cluster health save error logged
L9: Collector continues on AddSample failure (was return)
L10: user.Create logs warning instead of returning error after
successful DB write
L11-L14: Documentation comments for known limitations (HTTP-01
goroutine, GlobalConfig thread-safety, credentialsChanged
thread-safety, SubToken TOCTOU)
L15: useAuth.ts calls fetchMe() to refresh mustChangePassword
L16: Verified access-tokens/client-access endpoints are NOT dead
Verification: go build/vet/test PASS, npm run build PASS, gofmt clean.
fix(all-remaining): 24 audit findings — Medium + Low severity
All remaining unfixed issues from 3-round exhaustive audit are now
resolved. 8 Medium + 16 Low = 24 items.
== Medium (8) ==
M1: GetLogs timestamp always time.Now()
mihomo/service.go GetLogs now parses RFC3339 prefix from stored log
lines, infers level (ERROR/WARN/INFO/DEBUG) from payload prefix.
M2: Cron parser silently ignores */N and range
telegram/scheduler.go cronFieldMatches now supports */N (step),
A-B (range), A-B/N (stepped range) in addition to * and comma.
M3: findExistingProcesses holds pm.mu during /proc scan
mihomo/process.go start() now calls findExistingProcesses() BEFORE
acquiring pm.mu. Logs/Status/Stop no longer blocked during scan.
M4: Cluster HealthCheckAll sequential (N*12s)
cluster/service.go now fans out goroutines with WaitGroup. Worst
case drops from N*12s to ~12s.
M5: Panel settings PUT not transactional
router/panel_settings.go PUT handler now wraps create/update loop
in db.Transaction(). Partial failure rolls back.
M6: Cluster api_token no validation at save time
cluster/service.go Create/Update now validate JWT shape (starts
with 'ey', 3 dot-separated parts). Clear error message guides
operator to POST /api/v1/auth/login.
M7: Disk full — stale config warning not prominent
app/app.go soft-fail warnings changed to [WARNING] prefix + hint
to check listener configs.
M8: Telegram bot retries forever on 401
telegram/bot.go loop now detects 401/Unauthorized, switches to
5-minute retry interval (was 5s). Clears on success.
== Low (16) ==
L1: Scheduler/Bot Start() idempotent via sync.Once
L2: Container.Shutdown() method added
L3: Enforcer lastBlocked prunes deleted users
L4: traffic.Service first-call rate skipped (was bogus spike)
L5: strings.HasPrefix replaces path[:4]=="/api"
L6: ActiveCredentialsByListener batch-load (N+1→1 query)
L7: Telegram bot commands check DB errors
L8: Cluster health save error logged
L9: Collector continues on AddSample failure (was return)
L10: user.Create logs warning instead of returning error after
successful DB write
L11-L14: Documentation comments for known limitations (HTTP-01
goroutine, GlobalConfig thread-safety, credentialsChanged
thread-safety, SubToken TOCTOU)
L15: useAuth.ts calls fetchMe() to refresh mustChangePassword
L16: Verified access-tokens/client-access endpoints are NOT dead
Verification: go build/vet/test PASS, npm run build PASS, gofmt clean.
fix(all-remaining): 24 audit findings — Medium + Low severity
All remaining unfixed issues from 3-round exhaustive audit are now
resolved. 8 Medium + 16 Low = 24 items.
== Medium (8) ==
M1: GetLogs timestamp always time.Now()
mihomo/service.go GetLogs now parses RFC3339 prefix from stored log
lines, infers level (ERROR/WARN/INFO/DEBUG) from payload prefix.
M2: Cron parser silently ignores */N and range
telegram/scheduler.go cronFieldMatches now supports */N (step),
A-B (range), A-B/N (stepped range) in addition to * and comma.
M3: findExistingProcesses holds pm.mu during /proc scan
mihomo/process.go start() now calls findExistingProcesses() BEFORE
acquiring pm.mu. Logs/Status/Stop no longer blocked during scan.
M4: Cluster HealthCheckAll sequential (N*12s)
cluster/service.go now fans out goroutines with WaitGroup. Worst
case drops from N*12s to ~12s.
M5: Panel settings PUT not transactional
router/panel_settings.go PUT handler now wraps create/update loop
in db.Transaction(). Partial failure rolls back.
M6: Cluster api_token no validation at save time
cluster/service.go Create/Update now validate JWT shape (starts
with 'ey', 3 dot-separated parts). Clear error message guides
operator to POST /api/v1/auth/login.
M7: Disk full — stale config warning not prominent
app/app.go soft-fail warnings changed to [WARNING] prefix + hint
to check listener configs.
M8: Telegram bot retries forever on 401
telegram/bot.go loop now detects 401/Unauthorized, switches to
5-minute retry interval (was 5s). Clears on success.
== Low (16) ==
L1: Scheduler/Bot Start() idempotent via sync.Once
L2: Container.Shutdown() method added
L3: Enforcer lastBlocked prunes deleted users
L4: traffic.Service first-call rate skipped (was bogus spike)
L5: strings.HasPrefix replaces path[:4]=="/api"
L6: ActiveCredentialsByListener batch-load (N+1→1 query)
L7: Telegram bot commands check DB errors
L8: Cluster health save error logged
L9: Collector continues on AddSample failure (was return)
L10: user.Create logs warning instead of returning error after
successful DB write
L11-L14: Documentation comments for known limitations (HTTP-01
goroutine, GlobalConfig thread-safety, credentialsChanged
thread-safety, SubToken TOCTOU)
L15: useAuth.ts calls fetchMe() to refresh mustChangePassword
L16: Verified access-tokens/client-access endpoints are NOT dead
Verification: go build/vet/test PASS, npm run build PASS, gofmt clean.
fix(all-remaining): 24 audit findings — Medium + Low severity
All remaining unfixed issues from 3-round exhaustive audit are now
resolved. 8 Medium + 16 Low = 24 items.
== Medium (8) ==
M1: GetLogs timestamp always time.Now()
mihomo/service.go GetLogs now parses RFC3339 prefix from stored log
lines, infers level (ERROR/WARN/INFO/DEBUG) from payload prefix.
M2: Cron parser silently ignores */N and range
telegram/scheduler.go cronFieldMatches now supports */N (step),
A-B (range), A-B/N (stepped range) in addition to * and comma.
M3: findExistingProcesses holds pm.mu during /proc scan
mihomo/process.go start() now calls findExistingProcesses() BEFORE
acquiring pm.mu. Logs/Status/Stop no longer blocked during scan.
M4: Cluster HealthCheckAll sequential (N*12s)
cluster/service.go now fans out goroutines with WaitGroup. Worst
case drops from N*12s to ~12s.
M5: Panel settings PUT not transactional
router/panel_settings.go PUT handler now wraps create/update loop
in db.Transaction(). Partial failure rolls back.
M6: Cluster api_token no validation at save time
cluster/service.go Create/Update now validate JWT shape (starts
with 'ey', 3 dot-separated parts). Clear error message guides
operator to POST /api/v1/auth/login.
M7: Disk full — stale config warning not prominent
app/app.go soft-fail warnings changed to [WARNING] prefix + hint
to check listener configs.
M8: Telegram bot retries forever on 401
telegram/bot.go loop now detects 401/Unauthorized, switches to
5-minute retry interval (was 5s). Clears on success.
== Low (16) ==
L1: Scheduler/Bot Start() idempotent via sync.Once
L2: Container.Shutdown() method added
L3: Enforcer lastBlocked prunes deleted users
L4: traffic.Service first-call rate skipped (was bogus spike)
L5: strings.HasPrefix replaces path[:4]=="/api"
L6: ActiveCredentialsByListener batch-load (N+1→1 query)
L7: Telegram bot commands check DB errors
L8: Cluster health save error logged
L9: Collector continues on AddSample failure (was return)
L10: user.Create logs warning instead of returning error after
successful DB write
L11-L14: Documentation comments for known limitations (HTTP-01
goroutine, GlobalConfig thread-safety, credentialsChanged
thread-safety, SubToken TOCTOU)
L15: useAuth.ts calls fetchMe() to refresh mustChangePassword
L16: Verified access-tokens/client-access endpoints are NOT dead
Verification: go build/vet/test PASS, npm run build PASS, gofmt clean.
fix(all-remaining): 24 audit findings — Medium + Low severity
All remaining unfixed issues from 3-round exhaustive audit are now
resolved. 8 Medium + 16 Low = 24 items.
== Medium (8) ==
M1: GetLogs timestamp always time.Now()
mihomo/service.go GetLogs now parses RFC3339 prefix from stored log
lines, infers level (ERROR/WARN/INFO/DEBUG) from payload prefix.
M2: Cron parser silently ignores */N and range
telegram/scheduler.go cronFieldMatches now supports */N (step),
A-B (range), A-B/N (stepped range) in addition to * and comma.
M3: findExistingProcesses holds pm.mu during /proc scan
mihomo/process.go start() now calls findExistingProcesses() BEFORE
acquiring pm.mu. Logs/Status/Stop no longer blocked during scan.
M4: Cluster HealthCheckAll sequential (N*12s)
cluster/service.go now fans out goroutines with WaitGroup. Worst
case drops from N*12s to ~12s.
M5: Panel settings PUT not transactional
router/panel_settings.go PUT handler now wraps create/update loop
in db.Transaction(). Partial failure rolls back.
M6: Cluster api_token no validation at save time
cluster/service.go Create/Update now validate JWT shape (starts
with 'ey', 3 dot-separated parts). Clear error message guides
operator to POST /api/v1/auth/login.
M7: Disk full — stale config warning not prominent
app/app.go soft-fail warnings changed to [WARNING] prefix + hint
to check listener configs.
M8: Telegram bot retries forever on 401
telegram/bot.go loop now detects 401/Unauthorized, switches to
5-minute retry interval (was 5s). Clears on success.
== Low (16) ==
L1: Scheduler/Bot Start() idempotent via sync.Once
L2: Container.Shutdown() method added
L3: Enforcer lastBlocked prunes deleted users
L4: traffic.Service first-call rate skipped (was bogus spike)
L5: strings.HasPrefix replaces path[:4]=="/api"
L6: ActiveCredentialsByListener batch-load (N+1→1 query)
L7: Telegram bot commands check DB errors
L8: Cluster health save error logged
L9: Collector continues on AddSample failure (was return)
L10: user.Create logs warning instead of returning error after
successful DB write
L11-L14: Documentation comments for known limitations (HTTP-01
goroutine, GlobalConfig thread-safety, credentialsChanged
thread-safety, SubToken TOCTOU)
L15: useAuth.ts calls fetchMe() to refresh mustChangePassword
L16: Verified access-tokens/client-access endpoints are NOT dead
Verification: go build/vet/test PASS, npm run build PASS, gofmt clean.
fix(all-remaining): 24 audit findings — Medium + Low severity
All remaining unfixed issues from 3-round exhaustive audit are now
resolved. 8 Medium + 16 Low = 24 items.
== Medium (8) ==
M1: GetLogs timestamp always time.Now()
mihomo/service.go GetLogs now parses RFC3339 prefix from stored log
lines, infers level (ERROR/WARN/INFO/DEBUG) from payload prefix.
M2: Cron parser silently ignores */N and range
telegram/scheduler.go cronFieldMatches now supports */N (step),
A-B (range), A-B/N (stepped range) in addition to * and comma.
M3: findExistingProcesses holds pm.mu during /proc scan
mihomo/process.go start() now calls findExistingProcesses() BEFORE
acquiring pm.mu. Logs/Status/Stop no longer blocked during scan.
M4: Cluster HealthCheckAll sequential (N*12s)
cluster/service.go now fans out goroutines with WaitGroup. Worst
case drops from N*12s to ~12s.
M5: Panel settings PUT not transactional
router/panel_settings.go PUT handler now wraps create/update loop
in db.Transaction(). Partial failure rolls back.
M6: Cluster api_token no validation at save time
cluster/service.go Create/Update now validate JWT shape (starts
with 'ey', 3 dot-separated parts). Clear error message guides
operator to POST /api/v1/auth/login.
M7: Disk full — stale config warning not prominent
app/app.go soft-fail warnings changed to [WARNING] prefix + hint
to check listener configs.
M8: Telegram bot retries forever on 401
telegram/bot.go loop now detects 401/Unauthorized, switches to
5-minute retry interval (was 5s). Clears on success.
== Low (16) ==
L1: Scheduler/Bot Start() idempotent via sync.Once
L2: Container.Shutdown() method added
L3: Enforcer lastBlocked prunes deleted users
L4: traffic.Service first-call rate skipped (was bogus spike)
L5: strings.HasPrefix replaces path[:4]=="/api"
L6: ActiveCredentialsByListener batch-load (N+1→1 query)
L7: Telegram bot commands check DB errors
L8: Cluster health save error logged
L9: Collector continues on AddSample failure (was return)
L10: user.Create logs warning instead of returning error after
successful DB write
L11-L14: Documentation comments for known limitations (HTTP-01
goroutine, GlobalConfig thread-safety, credentialsChanged
thread-safety, SubToken TOCTOU)
L15: useAuth.ts calls fetchMe() to refresh mustChangePassword
L16: Verified access-tokens/client-access endpoints are NOT dead
Verification: go build/vet/test PASS, npm run build PASS, gofmt clean.
fix(all-remaining): 24 audit findings — Medium + Low severity
All remaining unfixed issues from 3-round exhaustive audit are now
resolved. 8 Medium + 16 Low = 24 items.
== Medium (8) ==
M1: GetLogs timestamp always time.Now()
mihomo/service.go GetLogs now parses RFC3339 prefix from stored log
lines, infers level (ERROR/WARN/INFO/DEBUG) from payload prefix.
M2: Cron parser silently ignores */N and range
telegram/scheduler.go cronFieldMatches now supports */N (step),
A-B (range), A-B/N (stepped range) in addition to * and comma.
M3: findExistingProcesses holds pm.mu during /proc scan
mihomo/process.go start() now calls findExistingProcesses() BEFORE
acquiring pm.mu. Logs/Status/Stop no longer blocked during scan.
M4: Cluster HealthCheckAll sequential (N*12s)
cluster/service.go now fans out goroutines with WaitGroup. Worst
case drops from N*12s to ~12s.
M5: Panel settings PUT not transactional
router/panel_settings.go PUT handler now wraps create/update loop
in db.Transaction(). Partial failure rolls back.
M6: Cluster api_token no validation at save time
cluster/service.go Create/Update now validate JWT shape (starts
with 'ey', 3 dot-separated parts). Clear error message guides
operator to POST /api/v1/auth/login.
M7: Disk full — stale config warning not prominent
app/app.go soft-fail warnings changed to [WARNING] prefix + hint
to check listener configs.
M8: Telegram bot retries forever on 401
telegram/bot.go loop now detects 401/Unauthorized, switches to
5-minute retry interval (was 5s). Clears on success.
== Low (16) ==
L1: Scheduler/Bot Start() idempotent via sync.Once
L2: Container.Shutdown() method added
L3: Enforcer lastBlocked prunes deleted users
L4: traffic.Service first-call rate skipped (was bogus spike)
L5: strings.HasPrefix replaces path[:4]=="/api"
L6: ActiveCredentialsByListener batch-load (N+1→1 query)
L7: Telegram bot commands check DB errors
L8: Cluster health save error logged
L9: Collector continues on AddSample failure (was return)
L10: user.Create logs warning instead of returning error after
successful DB write
L11-L14: Documentation comments for known limitations (HTTP-01
goroutine, GlobalConfig thread-safety, credentialsChanged
thread-safety, SubToken TOCTOU)
L15: useAuth.ts calls fetchMe() to refresh mustChangePassword
L16: Verified access-tokens/client-access endpoints are NOT dead
Verification: go build/vet/test PASS, npm run build PASS, gofmt clean.
fix(all-remaining): 24 audit findings — Medium + Low severity
All remaining unfixed issues from 3-round exhaustive audit are now
resolved. 8 Medium + 16 Low = 24 items.
== Medium (8) ==
M1: GetLogs timestamp always time.Now()
mihomo/service.go GetLogs now parses RFC3339 prefix from stored log
lines, infers level (ERROR/WARN/INFO/DEBUG) from payload prefix.
M2: Cron parser silently ignores */N and range
telegram/scheduler.go cronFieldMatches now supports */N (step),
A-B (range), A-B/N (stepped range) in addition to * and comma.
M3: findExistingProcesses holds pm.mu during /proc scan
mihomo/process.go start() now calls findExistingProcesses() BEFORE
acquiring pm.mu. Logs/Status/Stop no longer blocked during scan.
M4: Cluster HealthCheckAll sequential (N*12s)
cluster/service.go now fans out goroutines with WaitGroup. Worst
case drops from N*12s to ~12s.
M5: Panel settings PUT not transactional
router/panel_settings.go PUT handler now wraps create/update loop
in db.Transaction(). Partial failure rolls back.
M6: Cluster api_token no validation at save time
cluster/service.go Create/Update now validate JWT shape (starts
with 'ey', 3 dot-separated parts). Clear error message guides
operator to POST /api/v1/auth/login.
M7: Disk full — stale config warning not prominent
app/app.go soft-fail warnings changed to [WARNING] prefix + hint
to check listener configs.
M8: Telegram bot retries forever on 401
telegram/bot.go loop now detects 401/Unauthorized, switches to
5-minute retry interval (was 5s). Clears on success.
== Low (16) ==
L1: Scheduler/Bot Start() idempotent via sync.Once
L2: Container.Shutdown() method added
L3: Enforcer lastBlocked prunes deleted users
L4: traffic.Service first-call rate skipped (was bogus spike)
L5: strings.HasPrefix replaces path[:4]=="/api"
L6: ActiveCredentialsByListener batch-load (N+1→1 query)
L7: Telegram bot commands check DB errors
L8: Cluster health save error logged
L9: Collector continues on AddSample failure (was return)
L10: user.Create logs warning instead of returning error after
successful DB write
L11-L14: Documentation comments for known limitations (HTTP-01
goroutine, GlobalConfig thread-safety, credentialsChanged
thread-safety, SubToken TOCTOU)
L15: useAuth.ts calls fetchMe() to refresh mustChangePassword
L16: Verified access-tokens/client-access endpoints are NOT dead
Verification: go build/vet/test PASS, npm run build PASS, gofmt clean.
fix(all-remaining): 24 audit findings — Medium + Low severity
All remaining unfixed issues from 3-round exhaustive audit are now
resolved. 8 Medium + 16 Low = 24 items.
== Medium (8) ==
M1: GetLogs timestamp always time.Now()
mihomo/service.go GetLogs now parses RFC3339 prefix from stored log
lines, infers level (ERROR/WARN/INFO/DEBUG) from payload prefix.
M2: Cron parser silently ignores */N and range
telegram/scheduler.go cronFieldMatches now supports */N (step),
A-B (range), A-B/N (stepped range) in addition to * and comma.
M3: findExistingProcesses holds pm.mu during /proc scan
mihomo/process.go start() now calls findExistingProcesses() BEFORE
acquiring pm.mu. Logs/Status/Stop no longer blocked during scan.
M4: Cluster HealthCheckAll sequential (N*12s)
cluster/service.go now fans out goroutines with WaitGroup. Worst
case drops from N*12s to ~12s.
M5: Panel settings PUT not transactional
router/panel_settings.go PUT handler now wraps create/update loop
in db.Transaction(). Partial failure rolls back.
M6: Cluster api_token no validation at save time
cluster/service.go Create/Update now validate JWT shape (starts
with 'ey', 3 dot-separated parts). Clear error message guides
operator to POST /api/v1/auth/login.
M7: Disk full — stale config warning not prominent
app/app.go soft-fail warnings changed to [WARNING] prefix + hint
to check listener configs.
M8: Telegram bot retries forever on 401
telegram/bot.go loop now detects 401/Unauthorized, switches to
5-minute retry interval (was 5s). Clears on success.
== Low (16) ==
L1: Scheduler/Bot Start() idempotent via sync.Once
L2: Container.Shutdown() method added
L3: Enforcer lastBlocked prunes deleted users
L4: traffic.Service first-call rate skipped (was bogus spike)
L5: strings.HasPrefix replaces path[:4]=="/api"
L6: ActiveCredentialsByListener batch-load (N+1→1 query)
L7: Telegram bot commands check DB errors
L8: Cluster health save error logged
L9: Collector continues on AddSample failure (was return)
L10: user.Create logs warning instead of returning error after
successful DB write
L11-L14: Documentation comments for known limitations (HTTP-01
goroutine, GlobalConfig thread-safety, credentialsChanged
thread-safety, SubToken TOCTOU)
L15: useAuth.ts calls fetchMe() to refresh mustChangePassword
L16: Verified access-tokens/client-access endpoints are NOT dead
Verification: go build/vet/test PASS, npm run build PASS, gofmt clean.
fix(all-remaining): 24 audit findings — Medium + Low severity
All remaining unfixed issues from 3-round exhaustive audit are now
resolved. 8 Medium + 16 Low = 24 items.
== Medium (8) ==
M1: GetLogs timestamp always time.Now()
mihomo/service.go GetLogs now parses RFC3339 prefix from stored log
lines, infers level (ERROR/WARN/INFO/DEBUG) from payload prefix.
M2: Cron parser silently ignores */N and range
telegram/scheduler.go cronFieldMatches now supports */N (step),
A-B (range), A-B/N (stepped range) in addition to * and comma.
M3: findExistingProcesses holds pm.mu during /proc scan
mihomo/process.go start() now calls findExistingProcesses() BEFORE
acquiring pm.mu. Logs/Status/Stop no longer blocked during scan.
M4: Cluster HealthCheckAll sequential (N*12s)
cluster/service.go now fans out goroutines with WaitGroup. Worst
case drops from N*12s to ~12s.
M5: Panel settings PUT not transactional
router/panel_settings.go PUT handler now wraps create/update loop
in db.Transaction(). Partial failure rolls back.
M6: Cluster api_token no validation at save time
cluster/service.go Create/Update now validate JWT shape (starts
with 'ey', 3 dot-separated parts). Clear error message guides
operator to POST /api/v1/auth/login.
M7: Disk full — stale config warning not prominent
app/app.go soft-fail warnings changed to [WARNING] prefix + hint
to check listener configs.
M8: Telegram bot retries forever on 401
telegram/bot.go loop now detects 401/Unauthorized, switches to
5-minute retry interval (was 5s). Clears on success.
== Low (16) ==
L1: Scheduler/Bot Start() idempotent via sync.Once
L2: Container.Shutdown() method added
L3: Enforcer lastBlocked prunes deleted users
L4: traffic.Service first-call rate skipped (was bogus spike)
L5: strings.HasPrefix replaces path[:4]=="/api"
L6: ActiveCredentialsByListener batch-load (N+1→1 query)
L7: Telegram bot commands check DB errors
L8: Cluster health save error logged
L9: Collector continues on AddSample failure (was return)
L10: user.Create logs warning instead of returning error after
successful DB write
L11-L14: Documentation comments for known limitations (HTTP-01
goroutine, GlobalConfig thread-safety, credentialsChanged
thread-safety, SubToken TOCTOU)
L15: useAuth.ts calls fetchMe() to refresh mustChangePassword
L16: Verified access-tokens/client-access endpoints are NOT dead
Verification: go build/vet/test PASS, npm run build PASS, gofmt clean.
Z User
f14e95b684