fix(security): restack vulnerability response media type on current main

[seonghobae]

Purpose

Create a clean current-protected-main successor for #277 after its application CI correctly failed the live-base drift guard. This successor preserves only the reviewed private-vulnerability-reporting response media-type hardening and its focused adapter regressions. No predecessor CI, scanner, review, model, or operational evidence transfers.

Exact construction identity

• protected main immediately before construction: e60eff4c71dc4997b9990a79daa5069d6f5e2037;
• predecessor fix(security): authenticate vulnerability-status JSON media type #277 exact unchanged head: d4020e3c7b1490d3108965debc0099f620ff82d8;
• successor exact head: 72b47a90a46aae44ce72c5da707d54993a0eb4e7;
• successor tree: f98166a3b67d9a17bc52b0455ce5f93a73d1a1c0;
• ancestry: one commit directly on current protected main, 1 ahead / 0 behind, merge base exactly the protected head;
• scope: exactly two paths: scripts/private-vulnerability-reporting-audit.mjs and test/private-vulnerability-reporting-adapter.test.ts.

RCA and preserved security behavior

#277's exact-head checkout and package-manager verification succeeded; application CI then failed only at verify live pull-request base before lockfile control because protected main had advanced. The predecessor's reviewer-ci and protected-base Security Scan were terminal success, but those results are historical only.

The successor retains the reviewed fail-closed boundary:

• parse only the media-type token before parameters;
• accept exact application/json and application/vnd.github+json, case-insensitively;
• reject missing or misleading media types such as text/plain; profile=application/json before declared-length processing or response-body access;
• preserve the 16 KiB streaming cap, fatal UTF-8 decoder, exact HTTP 200 collection contract, redirect refusal, credential omission, boolean-setting evaluation, and read-only evidence semantics;
• focused regressions cover ordinary parameters/case normalization, misleading and missing media types, bounded streaming, and declared-size refusal.

#277 has no formal reviews or inline review threads at the latest pre-write refetch.

Evidence boundary

Keep Draft until this unchanged exact head has fresh terminal-success application ci, reviewer-ci, protected-base-eligible central Security Scan, exact 100% owned production statement/branch/function/line coverage with realistic tests, and zero valid unresolved findings. Pending, queued, skipped, absent, neutral, failed, cancelled, stale, predecessor, status-only, model-only, or rate-limited evidence is non-passing.

Immediately before Ready or merge, re-resolve protected main, exact head/ref/ancestry, workflow checkout SHAs, live rulesets, exact central .github Security Scan authority, reviews, threads, and active-writer state. Current live Noema policy requires the central Security Scan workflow and does not currently impose an independent formal-approval rule; no synthetic approval requirement is introduced.

This change hardens setting evidence only. It does not prove that private vulnerability reporting is enabled, exposed to reporters, monitored, staffed, or exercised end to end; issue #73 retains those operational acceptance requirements. It does not weaken gates, create a repair workflow, publish/deploy, invent evidence, or select an outbound license.

Supersedes #277 only after fresh exact-head verification.

[coderabbitai]

Important

Review skipped

Draft detected.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 607cf236-64de-4dbb-9537-3cec4df08bef

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}