Changes for the 27 findings across TrustWeave and TrustWeave SaaS. This report records implemented fixes and their verification scope. It does not assert a perfect score or a completed production release.
SA13: publish the SDK remediation commit, update the SaaS pin, and run the exact pair through Linux CI and staging checks. The new source-fingerprint gate prevents the older pinned SDK from silently standing in for the locally tested changes.
The historical review scores remain 79/100 SDK and 75/100 SaaS. They have not been recalculated during remediation. The final backend run and coverage gate passed.
Imports verify Ed25519 did:key issuer signatures, holder binding, supported algorithms and JWT time bounds before saving. Library copy distinguishes signature checks from live trust/status checks.
Validation: 12 wallet tests; forged signature rejection; real issuer/browser/verifier contract.
Encrypted disclosures retain their original bytes. Selected content keys are bound to disclosure digests inside the signed KB-JWT TrustWeave extension. The verifier authenticates the presentation before decrypting.
Validation: Real encryption regression checks exact disclosure bytes, digest membership, selected key release, and no key for withheld claims.
Multi-credential presentations containing SD-JWT credentials are refused. Missing/duplicate IDs fail, and selective claims start unchecked.
Validation: Concurrent-import and multi-SD-JWT rejection regression; actual verifier checks only selected claims.
Cloud list/statistics fail on storage/filter errors. Recovery is explicit, includes per-record failures, and propagates cancellation.
Validation: CloudRecoveryTest and existing cloud plugin suites.
CloudWallet implements CredentialRecordStorage and returns storage IDs independently of signed VC IDs.
Validation: Cloud plugin tests; stored-key reconstruction in listRecords/recovery.
New cursor capability bounds page sizes to 1-500 and preserves continuations for empty filtered pages. PostgreSQL uses indexed JSON containment for issuer/type/subject predicates. Legacy List behavior remains explicit.
Validation: 1,002-record H2 pagination regression and real PostgreSQL filtering/index-plan test pass. Production-scale performance benchmarking remains outside this local run.
Normal listings, record listings and statistics consistently fail on corrupt credentials or metadata; recoverRecords reports partial data explicitly.
Validation: File corruption/recovery and existing file-wallet tests.
Store/delete coordinate credential and metadata locks in stable order across wallet instances in the same JVM. Atomic replacement remains in use.
Validation: File wallet regression suite; record lock ordering reviewed. Cross-process distributed filesystem transactions are not claimed.
Bootstrap, imports, signing, deletion and reset share a Web Lock. Facade mutations are asynchronous; callers await them.
Validation: Real Chromium tabs concurrently import without lost updates; reload preserves both records and signing identity.
Credential collections and holder metadata receive runtime validation. Malformed data enters recovery without replacement; the Share page now displays recovery correctly.
Validation: Malformed JSON-shape regressions and production-page recovery browser test.
Runtime metadata can be generated from the capability catalog. Registry application requirements validate assessed operations; format checks fail closed. Assessed stub providers refuse construction; docs enumerate unassessed modules.
Validation: Common capability/registry tests and generated documentation drift check.
Added Chromium coverage for issuer/import/disclosure/verifier contracts, nonce failure, persistent non-extractable keys, cross-tab writes and recovery. CI runs these after building.
Validation: 3 Chromium tests and 12 wallet unit/crypto tests pass. Custody and custom encrypted-profile limits are documented.
Next.js, Vite, Vitest and browser-test tooling updated; dynamic route parameters migrated. Node 24 is the supported CI/runtime baseline.
Validation: Wallet audit reports 0 vulnerabilities; production build and typecheck pass.
Public credential IDs no longer expose expected holder IDs or raw credentials. Staged invitations and proof-bound OID4VCI remain the retrieval routes.
Validation: PublicCredentialOfferSecurityTest covers attacker and known-holder guesses without touching the credential repository.
A pessimistic database lock serializes redemption of one offer across calls while status and issuance are processed.
Validation: Backend compilation/integration validation; locked repository query used by the transactional redemption service.
Validation requires aud; azp cannot substitute. Blank audience configuration fails startup. Keycloak integration fixtures now add the API audience mapper.
Validation: AudienceValidatorTest and authenticated Keycloak controller integrations.
The verification DSL explicitly calls skipRevocation/skipExpiration when disabled, including allowlist verification.
Validation: Credential verifier and policy tests; complete backend suite.
Verification checks carry an evaluated flag. Disabled expiry/revocation/trust checks are shown as not evaluated, including neutral frontend indicators.
Validation: Frontend build/tests and backend verifier policy tests.
Strict verification refuses to produce a valid result when no trusted issuer can be evaluated.
Validation: Regression now expects a failed Strict result with a trusted-issuer configuration error.
The full-JSON profile requests preferred disclosure and communicates complete-credential disclosure in metadata and UI.
Validation: Verification request tests and frontend build.
Tenant history returns a bounded Page with no per-row writes. A history index supports ordering. Configurable 90-day retention deletes at most 500 expired records hourly.
Validation: History paging, retention cutoff and database purge tests; V22 migration.
Tenant-authorized cancellation becomes a terminal database state. The UI posts cancellation and uses the server result rather than only clearing local state.
Validation: Cancellation regression rejects later submission and checks tenant isolation; frontend tests/build.
Byte, depth, descriptor and credential-count bounds precede cryptography. Per-instance/per-tenant worker limits, a 15-second deadline and a 30-second database lease bound and deduplicate work.
Validation: Work gate duplicate/deadline tests and session regressions; deployment shared ingress quotas still require staging validation.
Unsupported signed subscription events return retryable failures, retain the verified payload in a recovery table, and do not keep a successful dedup marker. Successful retry removes recovery data.
Validation: Updated Stripe controller tests pass; V23 migration and privileged-operator recovery runbook.
Upgraded dependencies, replaced vulnerable npm SheetJS with the patched distribution, and moved workbook parsing to a worker with file/row/column/time bounds.
Validation: 0 audit vulnerabilities; 292 frontend tests, lint and production build pass; initial JavaScript remains below 500 KB.
CI now compares the checked-out SDK against the reviewed runtime-source fingerprint. Publishing the SDK commit, updating the immutable pin and running Linux/staging validation remain outstanding.
Validation: Local fingerprint check passes. No commit publication, Linux pipeline or staging ingress/shared-limit result is claimed.
Token issuance locks the offer, validates tenant/status/expiry and lifetime, and invalidates earlier unconsumed grants before issuing a replacement.
Validation: AccessTokenStore integration tests verify one-time consumption, grant rotation and invalid lifetimes.