🛡️ Sentinel: [CRITICAL] hmac DoS(서비스 거부) 취약점 수정

[seonghobae]

Verified succession

Exact predecessor 64f747c48d6cc4b367dce79af187b41f3b939eb2의 유효 요구사항은 raw b'\xff' API-key 입력이 인증 경계에서 예외를 만들지 않고 401로 거절되어야 한다는 것입니다. Canonical #520 exact cf730d007543ee828b7b8e77c9473288924047d4가 raw ASGI header bytes를 직접 비교하므로 이 입력을 decode/re-encode하지 않고 안전하게 거절하며, valid Unicode credential success·invalid Unicode rejection·duplicate-header fail-closed까지 executable contract로 보유합니다.

#502의 .encode('utf-8', errors='replace')는 framework-decoded credential을 lossy하게 바꾸는 별도 회귀 가능성이 있어 승계할 유효 source delta가 아닙니다. 동일한 errors='replace' blanket 지침도 credential byte identity를 보존하지 못하므로 canonical .jules guidance에서 채택하지 않았습니다. 모든 유효 behavior/test contract는 stronger successor #520에 완전 승계됐고, #520은 protected main@90717c6e9954bf3b7a351137995ebe89975e46c2 대비 behind_by=0인 non-force descendant입니다.

[google-labs-jules]

👋 Jules, reporting for duty! I'm here to lend a hand with this pull request.

When you start a review, I'll add a 👀 emoji to each comment to let you know I've read it. I'll focus on feedback directed at me and will do my best to stay out of conversations between you and other bots or reviewers to keep the noise down.

I'll push a commit with your requested changes shortly after. Please note there might be a delay between these steps, but rest assured I'm on the job!

For more direct control, you can switch me to Reactive Mode. When this mode is on, I will only act on comments where you specifically mention me with @jules. You can find this option in the Pull Request section of your global Jules UI settings. You can always switch back!

New to Jules? Learn more at jules.google/docs.

---

For security, I will only act on instructions from the user who triggered this task.

[coderabbitai]

Warning

Review limit reached

Next included review available in 57 minutes.

View limit details

Limit details: You’ve used the included review currently available.

You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository.

Learn how review limits work.

Review configuration:

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 2feb8dc6-5507-4506-bc17-ef475ed21b89

📥 Commits

Reviewing files that changed from the base of the PR and between a8e4956 and 64f747c.

📒 Files selected for processing (3)

• .jules/sentinel.md
• saas_web.py
• tests/test_saas_web.py

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[devin-ai-integration]

Devin Review found 1 potential issue.

[devin-ai-integration]

🟨 API keys bypass credential registry

Each authenticated request still loads API keys through get_configured_api_keys from the process environment. Runtime secrets remain exposed outside the mandated credential registry.

---

Was this helpful? React with 👍 or 👎 to provide feedback.