Warden Sweep fb25aef5: 20 findings across 1401 files

[phacops]

Warden Sweep fb25aef5

Metric	Count
Files scanned	1401
Files timed out	5
Files errored	0
Total findings	22
Verified	20
Rejected	2

Verified Findings

Severity	Skill	File	Title
MEDIUM	wrdn-pii	snuba/admin/auth.py	Admin user email used as Redis cache key
MEDIUM	wrdn-pii	snuba/admin/google.py	Admin user email written into exception logs
MEDIUM	wrdn-pii	snuba/admin/static/index.tsx	Real user email sent to Sentry user context
MEDIUM	wrdn-pii	snuba/admin/static/index.tsx	Session replay captures unmasked admin UI text containing customer identifiers
MEDIUM	security-review	snuba/query/allocation_policies/__init__.py	Client-controlled cross_org_query flag bypasses allocation quotas
HIGH	wrdn-pii	snuba/query/allocation_policies/bytes_scanned_window_policy.py	Full query result object logged on missing bytes scanned
MEDIUM	wrdn-data-exfil	snuba/query/allocation_policies/bytes_scanned_window_policy.py	Full QueryResult logged when progress_bytes is missing
MEDIUM	wrdn-pii	snuba/query/formatters/tracing.py	Tracing query formatter emits unredacted literals into Sentry
HIGH	wrdn-pii	snuba/query/snql/parser.py	Full SnQL query body written to warning logs on parse failure
MEDIUM	wrdn-pii	snuba/request/validation.py	Raw SNQL request body sent to Sentry spans and breadcrumbs
HIGH	wrdn-authz	snuba/subscriptions/data.py	RPC subscription build_request does not re-bind project/org scope
MEDIUM	wrdn-data-exfil	snuba/web/rpc/__init__.py	RPCAllocationPolicyException returns full routing to_log_dict() to clients
MEDIUM	wrdn-data-exfil	snuba/web/rpc/storage_routing/routing_strategies/storage_routing.py	to_log_dict internals returned in RPC error details
MEDIUM	security-review	snuba/web/rpc/v1/resolvers/R_eap_items/heatmap_builder.py	Heatmap bucket limit only enforced for TYPE_INT attributes
HIGH	wrdn-pii	tests/admin/test_migration_policies.py	Real staff email committed in test fixture
HIGH	security-review	snuba/web/views.py	Unauthenticated /tests/*/drop truncates datasets and flushes Redis
LOW	wrdn-data-exfil	snuba/web/views.py	InternalServerError handler returns raw exception text to clients
HIGH	wrdn-data-exfil	snuba/admin/production_queries/prod_queries.py	AND-of-OR project filters still bypass ADMIN_ALLOWED_PROD_PROJECTS
HIGH	wrdn-authz	snuba/admin/views.py	force_overwrite_migration_status skips migration group/policy authorization
HIGH	security-review	snuba/admin/views.py	Force migration status overwrite bypasses group policy checks

Skills Run

security-review, wrdn-authz, wrdn-code-execution, wrdn-data-exfil, wrdn-pii

Generated by Warden Sweep. PRs referencing this issue will appear below.

[linear-code]

EAP-723

[phacops]

Sweep Complete

PRs Created	PRs Skipped (existing)	PRs Failed	Security Findings
8	2	0	4

PRs

• fix: Client-controlled cross_org_query flag bypasses allocation quotas #8363 - fix: Client-controlled cross_org_query flag bypasses allocation quotas (MEDIUM)
• fix: Full query result object logged on missing bytes scanned #8364 - fix: Full query result object logged on missing bytes scanned (HIGH)
• fix: Full SnQL query body written to warning logs on parse failure #8365 - fix: Full SnQL query body written to warning logs on parse failure (HIGH)
• fix: RPC subscription build_request does not re-bind project/org scope #8366 - fix: RPC subscription build_request does not re-bind project/org scope (HIGH)
• fix: Heatmap bucket limit only enforced for TYPE_INT attributes #8367 - fix: Heatmap bucket limit only enforced for TYPE_INT attributes (MEDIUM)
• fix: Real staff email committed in test fixture #8368 - fix: Real staff email committed in test fixture (HIGH)
• fix: Unauthenticated /tests/*/drop truncates datasets and flushes Redis #8369 - fix: Unauthenticated /tests/*/drop truncates datasets and flushes Redis (HIGH)
• fix: AND-of-OR project filters still bypass ADMIN_ALLOWED_PROD_PROJECTS #8370 - fix: AND-of-OR project filters still bypass ADMIN_ALLOWED_PROD_PROJECTS (HIGH)

Security Findings

• fix: Client-controlled cross_org_query flag bypasses allocation quotas #8363 - Client-controlled cross_org_query flag bypasses allocation quotas (MEDIUM)
• fix: Heatmap bucket limit only enforced for TYPE_INT attributes #8367 - Heatmap bucket limit only enforced for TYPE_INT attributes (MEDIUM)
• fix: Unauthenticated /tests/*/drop truncates datasets and flushes Redis #8369 - Unauthenticated /tests/*/drop truncates datasets and flushes Redis (HIGH)