From eadf4f727a7e9ab21d50745bd07a7bb126bbf870 Mon Sep 17 00:00:00 2001 From: Macky Date: Fri, 7 Aug 2026 16:10:02 +0700 Subject: [PATCH] docs: record reviewer-drive security fixes (mask sales_kit/report, ready-gate) in engineering log --- docs/engineering-log/2026-08-07-security-ux.md | 10 +++++++++- 1 file changed, 9 insertions(+), 1 deletion(-) diff --git a/docs/engineering-log/2026-08-07-security-ux.md b/docs/engineering-log/2026-08-07-security-ux.md index 739301f..080b68a 100644 --- a/docs/engineering-log/2026-08-07-security-ux.md +++ b/docs/engineering-log/2026-08-07-security-ux.md @@ -40,5 +40,13 @@ accessibility/touch/visual polish. Committed as `[verified]`. `camo.moreminimore.com/tabs` (HTTP 500) and cannot reach localhost. Rendered verification done via served-HTML/DIST inspection instead. +## Independent reviewer follow-up (requesting-code-review) +Reviewer verdict: `passed: true` — zero blocking security/logic issues. It raised 2 non-blocking +(pre-existing) suggestions, both applied in `ce6076f`: +- `get_group`: now masks `sales_kit` + `report` for trainees (they contain latent pain analysis). +- `get_persona`: now gates `status==ready` for trainees (parity with `list_personas`). +- Extended `test_security.py` with latent-leak + non-ready-gate assertions; all suites still pass. + ## Next -- Independent reviewer (requesting-code-review subagent) result pending → incorporate, then commit. +- Set a real `LLM_API_KEY` (and provider) and run a live smoke test of analyze→personas→chat→judge. +- Push to Gitea remote (repo currently local, no remote yet); validate Docker build on EasyPanel.