fix(security): authenticate vulnerability-status JSON media type

[seonghobae]

Purpose

Harden the read-only private-vulnerability-reporting evidence adapter so JSON-looking bytes cannot become operational setting evidence unless GitHub's response identifies itself with an exact JSON media-type token.

Exact identities

• protected/live base: 4573a6f7eaf904e19a6e3198c8cabcfd4be40c40
• original RED head: e8266f38eebbe1761ed389a090c4745172e2cd1b
• current restacked GREEN head: d4020e3c7b1490d3108965debc0099f620ff82d8
• branch: fix/private-vulnerability-json-media-type

GREEN implementation

readBoundedJson() now parses only the media-type token before parameters and accepts exact application/json or application/vnd.github+json, case-insensitively. Missing or misleading media types fail closed before declared-length processing or response-body access. Existing 16 KiB streaming bounds, fatal UTF-8 decoding, exact HTTP 200 requirement, redirect refusal, credential omission, boolean-setting evaluation, and read-only evidence semantics remain unchanged.

The focused tests prove:

• ordinary parameters and case normalization are accepted for GitHub JSON media types;
• text/plain; profile=application/json is rejected before body access;
• a missing media type is rejected;
• existing oversized-stream and invalid-UTF-8 protections remain intact.

Restack and verification boundary

The branch was merged with protected main after #272, #266, and #275. The current merge tree overlays only scripts/private-vulnerability-reporting-audit.mjs and test/private-vulnerability-reporting-adapter.test.ts on current protected-main bytes.

Historical predecessor results do not transfer. Application ci, reviewer-ci, protected-base-eligible Security Scan, and fresh review must complete successfully on unchanged current head d4020e3c7b1490d3108965debc0099f620ff82d8 before merge. Pending, queued, skipped, absent, neutral, failed, cancelled, stale, predecessor, status-only, model-only, or rate-limited evidence is non-passing.

This evidence-plane hardening does not prove that private vulnerability reporting is enabled, that reporter UI or notifications work, or that response staffing and end-to-end exercises are complete; issue #73 retains those operational requirements.

No repair/self-modifying workflow, protection weakening, secret/reviewer invention, audit waiver, release, or deployment claim.

[coderabbitai]

Warning

Review limit reached

@seonghobae, you've reached your PR review limit, so we couldn't start this review.

Next review available in: 61 minutes

You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository.

How can I continue?

After more reviews become available, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews.

How do review limits work?

CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability.

For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window.

Please refer docs for additional details.

Review details

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: c5c8f9df-44f9-4ca8-9193-6b37d3af80dc

📥 Commits

Reviewing files that changed from the base of the PR and between 4573a6f and d4020e3.

📒 Files selected for processing (2)

• scripts/private-vulnerability-reporting-audit.mjs
• test/private-vulnerability-reporting-adapter.test.ts

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[seonghobae]

@coderabbitai review

Review exact current head d4020e3c7b1490d3108965debc0099f620ff82d8 against protected base 4573a6f7eaf904e19a6e3198c8cabcfd4be40c40. Verify exact GitHub JSON media-type authentication occurs before body access, preserves bounded fatal-UTF-8 parsing, and does not overstate private-vulnerability-reporting operational readiness. Do not transfer conclusions from predecessor heads.

[coderabbitai]

Rate Limit Exceeded

@seonghobae have exceeded the limit for the number of chat messages per hour. Please wait 21 minutes and 38 seconds before sending another message.