[erayd]

Security review of Parcel v1.0.8 (merged: kimi-k3 + mimo-v2.6-pro)

Independent two-phase reviews of v1.0.8 (commit f34f710, exactly at tag v1.0.8) were conducted by two models and merged by glm-5.3. No CRITICAL or HIGH vulnerabilities were found. The merged record carries 11 findings (1 MEDIUM, 8 LOW, 2 INFORMATIONAL). All host-side enforcement controls (whitelist, passkey content-marker backstop, rpId/allowCredentials binding, rate-limiter state lock, signer blacklist, host-version ratchet) and all previously-fixed findings verified intact under both models' adversarial testing; the full test suite passes (615/615, 35 suites) and the built chrome/firefox bundles were verified byte-identical to src/ apart from the documented manifest transforms.

Full report: security-review/reviews/v1.0.8/merged-glm-5.3.md

Summary table of findings

#	Severity	Vulnerability
F68M	🟡 MEDIUM	Chrome: fill message without origin key skips the F34M destination-origin guard and the F6T warning (mimo-v2.6-pro only; not reproduced by kimi-k3)
F69L	⚪ LOW	collect_roots textual-only dedup: ancestor-pointing store symlinks cause unbounded root-queue growth, permanently wedging the host (requires allowLinks)
F70L	⚪ LOW	Rule pattern valid in JS but invalid in jq's Oniguruma (or malformed in both) silently wedges action_list - no response is ever sent
F71L	⚪ LOW	Popup-spam guard bypassed by ceremony supersede/abort paths, which settle without counting as dismissals (severity disputed: mimo-v2.6-pro M, kimi-k3 L)
F72L	⚪ LOW	make extension/chrome/firefox silently skip the Prettier step and execute write(1) instead
F73L	⚪ LOW	SECURITY.md:87 overstates fail-closed behaviour: malformed BLACKLIST_SIGNERS/MINIMUM_HOST_VERSION/path values are ignored with a log note, not refused
F74L	⚪ LOW	Passkey/HTTP-auth consent guarantees phrased as absolutes that do not hold under the accepted TM2 posture
F75L	⚪ LOW	Rule-less entry aborts the whole popup render batch (mimo-v2.6-pro only; not reproduced by kimi-k3)
F76L	⚪ LOW	Timestamp rules let a stale src/dist (incl. parcel-host.asc) ship (mimo-v2.6-pro only; not reproduced by kimi-k3)
F77I	⚪ LOW	Comment overstates the constrain-height token's forgery protection - the page can read the token from the popup iframe's src
F78I	⚪ LOW	window.open help link vs "no network access, for any reason" (mimo-v2.6-pro only; classification disputed by kimi-k3)

Notes on the table

• F77I and F78I are labelled INFORMATIONAL by the review (shown with the LOW indicator above).
• The F71L severity dispute and the four finding-level disputes (F68M, F75L, F76L, F78I - all mimo-v2.6-pro reports) are recorded verbatim in the merged file under "Disagreements", with kimi-k3's positions preserved; the maintainer may take either position when responding.
• Unlike v1.0.7, the two models' phase-1 outputs were fully disjoint; every dual-source finding was discovered by one model in phase 1 and independently reproduced by the other in phase 2.

Task Tracking

• F68M: Seed the origin from the tab #234
• F69L: Guard against symlink recursion #233
• F70L: Properly handle jq-only regex failures #235
• F71L: Also increment the spam counter on abort #238
• F72L: ec0e14a
• F73L: Make malformed BLACKLIST_SIGNERS or MINIMUM_HOST_VERSION fatal #239
• F74L: Status quo is acceptable; TM2 is out-of-context for that wording.
• F75L: Add conditional guard for regex engine mismatch #240
• F76L: Status quo is acceptable; this is a local-dev-only footgun.
• F77I: Rejected; the iframe is inside a closed shadow root, so the page cannot read src.
• F78I: Rejected; this is the user clicking a link, not network access by the extension.