Minerva / ops: confirm `NTFY_TOKEN` scope is publish-only on `minerva-*` topics #3

New issue

Closed

opened 2026-04-20 17:22:19 +00:00 by claude-bot · 1 comment

claude-bot commented

2026-04-20 17:22:19 +00:00

Collaborator

Context

Surfaced while reviewing Minerva PR #253 (security-reviewer lane). The NTFY_TOKEN Forgejo repo secret is used by every success/failure ntfy notification across .forgejo/workflows/*.yml. It posts to topics minerva-ci, minerva-db, minerva-ops on ntfy.athenalytix.com.

Security-reviewer flagged: a compromised Forgejo runner could use this token for more than posting fake messages if its ntfy ACLs grant read or admin rights. Worth confirming the token is scoped publish-only on the minerva-* topic family.

What to check

Log into the ntfy admin at ntfy.athenalytix.com (or wherever token management lives for this instance).
Inspect the ACL on the token value currently stored in Minerva's Forgejo repo secrets (as NTFY_TOKEN).
Confirm permissions are:
- Write: minerva-ci, minerva-db, minerva-ops (and any other minerva-* subtopics in use)
- Read: denied
- Admin: denied

If over-scoped, rotate to a publish-only token and replace in the Forgejo repo secret.

Out of scope

Migrating to per-topic tokens (unnecessary for this threat model — single publish-only key is fine)
Changes to the notify-ntfy composite action

Not blocking

Minerva issue #251 / PR #253 does not introduce this risk — the token already exists and is used by every existing ntfy workflow. This ticket closes the loop on the security-reviewer's audit flag.

## Context Surfaced while reviewing Minerva PR #253 (security-reviewer lane). The `NTFY_TOKEN` Forgejo repo secret is used by every success/failure ntfy notification across `.forgejo/workflows/*.yml`. It posts to topics `minerva-ci`, `minerva-db`, `minerva-ops` on `ntfy.athenalytix.com`. Security-reviewer flagged: a compromised Forgejo runner could use this token for more than posting fake messages if its ntfy ACLs grant read or admin rights. Worth confirming the token is scoped publish-only on the `minerva-*` topic family. ## What to check 1. Log into the ntfy admin at `ntfy.athenalytix.com` (or wherever token management lives for this instance). 2. Inspect the ACL on the token value currently stored in Minerva's Forgejo repo secrets (as `NTFY_TOKEN`). 3. Confirm permissions are: - **Write**: `minerva-ci`, `minerva-db`, `minerva-ops` (and any other `minerva-*` subtopics in use) - **Read**: denied - **Admin**: denied If over-scoped, rotate to a publish-only token and replace in the Forgejo repo secret. ## Out of scope - Migrating to per-topic tokens (unnecessary for this threat model — single publish-only key is fine) - Changes to the notify-ntfy composite action ## Not blocking Minerva issue #251 / PR #253 does not introduce this risk — the token already exists and is used by every existing ntfy workflow. This ticket closes the loop on the security-reviewer's audit flag.

claude-bot commented

2026-04-20 18:29:03 +00:00

Author

Collaborator

Re-routed to mike/Minerva#273 — the token is Minerva's repo secret, topics are minerva-*, and any rotation remediation updates Minerva-owned infrastructure. Closing here.

Re-routed to `mike/Minerva#273` — the token is Minerva's repo secret, topics are `minerva-*`, and any rotation remediation updates Minerva-owned infrastructure. Closing here.

claude-bot closed this issue

2026-04-20 18:29:11 +00:00