🛡️ Sentinel: [HIGH] hmac.compare_digest() 비-ASCII 문자열 비교 오류로 인한 잠재적 DoS 취약점 수정

.coveragerc

@@ -1,6 +1,5 @@
 [run]
 source =
-    audio_library
     chapters
     diarize
     job_store

.github/workflows/ci.yml

@@ -43,28 +43,3 @@ jobs:
 
       - name: Verify console entry point
         run: codec-carver --help
-
-  rust:
-    runs-on: ${{ matrix.os }}
-    strategy:
-      fail-fast: false
-      matrix:
-        os: [ubuntu-latest, macos-latest]
-    steps:
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-        with:
-          persist-credentials: false
-
-      - name: Install Rust 1.88.0 with rustfmt
-        run: rustup toolchain install 1.88.0 --profile minimal --component rustfmt
-
-      - name: Report Rust toolchain
-        run: |
-          rustup run 1.88.0 rustc --version --verbose
-          rustup run 1.88.0 cargo --version --verbose
-
-      - name: Check Rust formatting
-        run: rustup run 1.88.0 cargo fmt --manifest-path rust-core/Cargo.toml -- --check
-
-      - name: Test Rust backend
-        run: rustup run 1.88.0 cargo test --locked --all-targets --manifest-path rust-core/Cargo.toml

.gitignore

@@ -23,6 +23,3 @@ leak-*
 
 # Generated conversion outputs / reports
 under_2gb/
-
-# Rust build outputs
-rust-core/target/

.jules/sentinel.md

@@ -1,8 +1,3 @@
-## 2026-07-25 - [Cross-platform upload basename normalization]
-**Behavior:** Upload metadata now interprets both forward slashes and backslashes as path separators before extracting a basename.
-**Learning:** On POSIX systems, `pathlib.Path(filename).name` retains backslashes because they are ordinary characters there. That caused inconsistent manifest and converter filenames for Windows-style client paths. The upload itself is still written inside a trusted temporary workspace, and batch archive entry names are generated outputs; this change does not establish a filesystem traversal or archive-entry escape.
-**Prevention:** Normalize client path separators before extracting a basename, retain the existing empty/`.`/`..` fallback, and test the persisted source name and manifest metadata. Treat the normalization as cross-platform consistency and defense in depth, not as evidence of a demonstrated Zip Slip exploit.
-
 ## 2026-05-28 - [Sentinel Fixes: Temp Files & Injection]
 **Vulnerability:** Predictable Temp Files (CWE-377) and Insecure Default Permissions (CWE-276), plus Command Injection via FFmpeg Filtergraph (CWE-20).
 **Learning:** Python's `Path.with_name` plus a suffix string to make a temp file opens a race condition because it's predictable and the permissions default to system `umask` which might expose secret `0600` data. Additionally, interpolating variables directly into FFmpeg filtergraph strings allows arbitrary filter injection.
@@ -65,3 +60,7 @@
 **Vulnerability:** Path traversal in `media_shrinker.py` via unresolved `..` segments or symlink escapes before deriving conversion output paths.
 **Learning:** `Path.relative_to()` is only a lexical containment check unless both the source and root have first been resolved into canonical absolute paths. Relative paths and symlinks can otherwise bypass root-boundary assumptions.
 **Prevention:** Resolve both source and root once, reject sources outside the resolved root with a sanitized `MediaShrinkerError`, and derive `rel_source` from the resolved paths before planning outputs.
+## 2026-08-14 - [Sentinel: Insecure Default Authentication]
+**취약점:** `saas_web.py`의 `require_api_key` 미들웨어에서 API 키(`CODEC_CARVER_API_KEYS`)가 구성되지 않은 경우 인증을 완전히 건너뛰는 기본적으로 허용(open-by-default)되는 취약점이 발견되었습니다. 이는 인증되지 않은 사용자가 리소스를 소모하게 만들 수 있습니다.
+**학습:** 보안 기능은 선택 사항(opt-in)이어서는 안 됩니다. 환경 변수가 없거나 잘못 구성된 경우 기본적으로 애플리케이션은 가장 안전한 상태(fail-secure)인 모든 요청 거부로 돌아가야 합니다.
+**예방:** 미들웨어는 키 구성 여부에 관계없이 `GET /`를 제외한 모든 엔드포인트에서 항상 인증을 요구하도록 설정(secure-by-default)되어야 하며, 키가 설정되지 않은 경우에도 401 오류를 반환해야 합니다.

CHANGELOG.md

@@ -11,4 +11,3 @@
 
 ### Fixed
 - 단일·일괄 대상 크기 입력을 비웠을 때 이전 custom validity와 `aria-invalid` 상태를 즉시 초기화해 현재 필수 입력 상태를 정확히 전달합니다.
-- 업로드 파일명의 경로 구분자를 정규화하여 POSIX에서도 Windows 형식의 클라이언트 경로가 일관된 basename으로 기록되도록 수정했습니다.