docs: Document broken auth vulnerability in Aether upload handler

[Vaiditya2207]

This commit adds a detailed security vulnerability report to SECURITY_ISSUE.md detailing the broken authentication vulnerability found in syscore/src/server/aether.rs where upload_handler falls back to a hardcoded default credential if the AETHER_UPLOAD_KEY environment variable is not set. It also logs this architectural finding in .jules/sentinel.md as per Sentinel's constraints, without modifying the source code.

---

PR created automatically by Jules for task 2087285229215044997 started by @Vaiditya2207

Summary by CodeRabbit

• Documentation
  • Added security advisories documenting vulnerabilities related to file path handling and API authentication, including remediation guidance for users.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
okernel	Ready	Preview, Comment	May 31, 2026 9:52pm

[google-labs-jules]

👋 Jules, reporting for duty! I'm here to lend a hand with this pull request.

When you start a review, I'll add a 👀 emoji to each comment to let you know I've read it. I'll focus on feedback directed at me and will do my best to stay out of conversations between you and other bots or reviewers to keep the noise down.

I'll push a commit with your requested changes shortly after. Please note there might be a delay between these steps, but rest assured I'm on the job!

For more direct control, you can switch me to Reactive Mode. When this mode is on, I will only act on comments where you specifically mention me with @jules. You can find this option in the Pull Request section of your global Jules UI settings. You can always switch back!

New to Jules? Learn more at jules.google/docs.

---

For security, I will only act on instructions from the user who triggered this task.

[coderabbitai]

📝 Walkthrough

Walkthrough

PR adds security audit notes to .jules/sentinel.md documenting two vulnerabilities: unsafe PathBuf::join with absolute path injection and weak credential fallback. A detailed public security advisory is appended to SECURITY_ISSUE.md describing the hardcoded API key issue in the Aether upload handler, with reproduction and remediation guidance.

Changes

Security Documentation

Layer / File(s)	Summary
Internal security audit trail .jules/sentinel.md	Sentinel audit file expanded with two new entries: one flagging arbitrary file write risk from PathBuf::join when absolute user-controlled paths are appended (multipart filenames), and another flagging broken authentication from weak hardcoded credential fallback ("update_me_please") when AETHER_UPLOAD_KEY is missing.
Public security advisory SECURITY_ISSUE.md	New security advisory section documenting "Broken Auth: Hardcoded default API key in Aether upload handler," describing how the vulnerability enables unauthorized /api/v1/aether access, including severity assessment, exploitation steps, and remediation that removes the fallback and fails closed on missing environment variable.

Estimated code review effort

🎯 1 (Trivial) | ⏱️ ~3 minutes

Possibly related PRs

• Vaiditya2207/OKernel#156: Addresses the same PathBuf::join arbitrary file write and hardcoded credential vulnerabilities in the Aether upload handler that these documentation updates describe.

Suggested labels

documentation

Poem

🐰 Audit notes and warnings bright,
Hardcoded keys exposed to light,
Path traversal risks laid bare,
Security documented with care! 🔐

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title accurately summarizes the main change: documentation of a broken authentication vulnerability in the Aether upload handler.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch sentinel-broken-auth-report-2087285229215044997

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[coderabbitai]

🧹 Nitpick comments (1)

SECURITY_ISSUE.md (1)

75-82: ⚡ Quick win

Consider validating the environment variable at application startup.

The proposed remediation correctly removes the weak default fallback, but returning a 500 error at request time means the misconfiguration is only discovered when the endpoint is first accessed.

A more robust approach would be to validate that AETHER_UPLOAD_KEY is set during application initialization and fail to start if it's missing. This ensures the misconfiguration is caught immediately during deployment rather than in production.

Alternative approach: Startup validation

Consider validating the environment variable during server initialization:

// During server startup/initialization
let aether_upload_key = std::env::var("AETHER_UPLOAD_KEY")
    .expect("AETHER_UPLOAD_KEY environment variable must be set");

// Store in application state for later use in handlers

This approach ensures fail-fast behavior and prevents the misconfigured service from starting.

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@SECURITY_ISSUE.md` around lines 75 - 82, The code currently defers detecting
a missing AETHER_UPLOAD_KEY until request time; instead, read and validate
AETHER_UPLOAD_KEY during application startup (e.g., in main, server
initialization, or the function that constructs AppState) and fail fast if
absent (use expect or propagate an Err to prevent starting); store the validated
key on your application state struct (e.g., AppState, SharedState, or whatever
holds config) and update handlers (the upload handler or functions that
previously called std::env::var("AETHER_UPLOAD_KEY")) to use the value from that
state rather than re-reading the environment.

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Nitpick comments:
In `@SECURITY_ISSUE.md`:
- Around line 75-82: The code currently defers detecting a missing
AETHER_UPLOAD_KEY until request time; instead, read and validate
AETHER_UPLOAD_KEY during application startup (e.g., in main, server
initialization, or the function that constructs AppState) and fail fast if
absent (use expect or propagate an Err to prevent starting); store the validated
key on your application state struct (e.g., AppState, SharedState, or whatever
holds config) and update handlers (the upload handler or functions that
previously called std::env::var("AETHER_UPLOAD_KEY")) to use the value from that
state rather than re-reading the environment.

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro

Run ID: bd03f46f-f795-4603-aaf1-c3cd7b990f39

📥 Commits

Reviewing files that changed from the base of the PR and between ffef955 and 91f27c5.

📒 Files selected for processing (2)

• .jules/sentinel.md
• SECURITY_ISSUE.md