feat(enrichment): flag COOP/COEP unsafe-none in iac-misconfig

[luciferlive112116]

Summary

Extends the existing iac-misconfig HTTP security-header rules (merged in #3387) with two zero-FP isolation-header checks, addressing #3538 review feedback by dropping the X-XSS-Protection: 0 and X-Frame-Options: ALLOWALL rules (modern guidance treats 0 as hardening; ALLOWALL is non-standard/low-signal).

kind	Trigger	risk
coop-unsafe-none	Cross-Origin-Opener-Policy … unsafe-none	cross-origin documents can retain window.opener access
coep-unsafe-none	Cross-Origin-Embedder-Policy … unsafe-none	disables cross-origin isolation requirements for embedded resources

Each rule requires its own header token on the same line as the weakening value, so unrelated lines (e.g. Cache-Control: max-age=0, bare unsafe-none = false) are not flagged.

Fixes #2096

Follow-up to the IaC-misconfig test-scaffold issue: the original deliverable (pure-scanner unit tests) landed in #2096; this PR completes the next slice of analyzer coverage requested in #2096#issuecomment-4886736482. If maintainers prefer a fresh open tracking issue instead of the closed parent, happy to retarget the closing reference.

Scope

• The PR title follows type(scope): short summary Conventional Commit format, for example fix(api): restore profile access checks.
• This PR is focused and does not mix unrelated backend, UI, MCP, docs, dependency, and deploy changes.
• This follows CONTRIBUTING.md and does not reintroduce GitHub Pages, VitePress, site/, or CNAME.
• I linked an issue, or this is small enough that the summary explains why an issue is not needed.

Validation

• git diff --check
• npm run actionlint — not applicable (review-enrichment only)
• npm run typecheck — not applicable (review-enrichment only)
• npm run test:coverage — not applicable (review-enrichment only)
• npm run test:workers — not applicable
• npm run build:mcp — not applicable
• npm run test:mcp-pack — not applicable
• npm run ui:openapi:check — not applicable
• npm run ui:lint — not applicable
• npm run ui:typecheck — not applicable
• npm run ui:build — not applicable
• npm audit --audit-level=moderate — not applicable
• New or changed behavior has unit/integration tests for new branches, fallback paths, and sanitizer boundaries

If any required check was skipped, explain why:

• Review-enrichment-only change; validated with npm --prefix review-enrichment run build and node --test review-enrichment/test/iac-misconfig.test.ts (22/22 pass). analyzer-metadata.json unchanged (no registry descriptor changes).

Safety

• No secrets, wallet details, hotkeys, coldkeys, user PATs, private keys, raw trust scores, private rankings, or private maintainer evidence are exposed.
• Public GitHub text stays sanitized, low-noise, and does not imply compensation guarantees or optimization tactics.
• Auth, cookie, CORS, GitHub App, Cloudflare, or session changes include negative-path tests.
• API/OpenAPI/MCP behavior is updated and tested where needed.
• UI changes use live API data or real empty/error/loading states, not production mock/demo fallbacks.
• Visible UI changes include a UI Evidence section below with JPG/JPEG or PNG screenshots arranged as organized, captioned, clickable thumbnails. SVG screenshots are not used as review evidence. Review-only screenshots or recordings are not committed to the repository.
• Public docs/changelogs are updated where needed; changelogs are only edited for release-prep PRs.

UI Evidence

N/A — no UI changes.

Notes

• Supersedes closed feat(enrichment): flag insecure HTTP security-header settings in iac-misconfig #3538 with a narrower, review-aligned rule set (COOP/COEP only).
• Negative tests cover secure header counterparts and near-misses (Cache-Control max-age=0, bare unsafe-none config key).

[superagent-security]

Superagent didn't find any vulnerabilities or security issues in this PR.

[loopover-orb]

Warning

🟨🟨🟨🟨🟨🟨🟨🟨🟨🟨🟨🟨

⏸️ Gittensory review result - manual review recommended

_{Review updated: 2026-07-05 16:41:13 UTC}

4 files · 1 AI reviewer · no blockers · readiness 80/100 · CI green · clean

⏸️ Suggested Action - Manual Review

Review summary
This PR adds two narrowly-scoped, zero-FP regex rules (coop-unsafe-none, coep-unsafe-none) to the existing iac-misconfig HTTP-header analyzer, following the exact established pattern (same-line header-token + weakening-value match, e.g. HSTS_DISABLED_RE/REFERRER_UNSAFE_URL_RE) with corresponding render.ts explanations, types.ts union additions, and both positive/negative test cases. The regexes are correctly anchored to require the specific header name and unsafe-none on the same line, so unrelated lines like a bare `unsafe-none = false` config key (explicitly tested) won't false-positive. The change is small, additive, well-tested, and consistent with prior art in the same file.

Nits — 4 non-blocking

• The PR description says it also drops the X-XSS-Protection:0 and X-Frame-Options:ALLOWALL rules per feat(enrichment): flag insecure HTTP security-header settings in iac-misconfig #3538 feedback, but the diff shown contains no removal of such rules — confirm those regexes don't still exist elsewhere in iac-misconfig.ts, or that this was already done in a prior PR, since the description otherwise overstates this diff's scope.
• review-enrichment/src/analyzers/iac-misconfig.ts is already flagged as a long-file smell (562 lines); consider whether the growing chain of near-identical `if (RE.test(body) && pushFinding(...))` blocks should be refactored into a table-driven loop at some point (not blocking for this PR).
• Consider adding a test case where COOP/COEP are set to a safe value alongside an unrelated `unsafe-none` token later in a wrapped/multi-directive line, to further stress-test the same-line requirement.
• If the X-XSS-Protection/X-Frame-Options removal mentioned in the description is meant to be part of this PR, include that diff hunk or clarify in the description that it was already merged separately.

Signal	Result	Evidence
Code review	✅ No blockers	1 reviewer
Linked issue	✅ Linked	#2096, #3538
Related work	✅ No active overlap found	No same-issue or scoped active PR overlap found.
Change scope	✅ 20/20	Low review scope from cached public metadata (2 linked issues).
Validation posture	❌ 5/25	Preflight is holding this PR: the review lane is unavailable, so it is not ready for automated review.
Contributor workload	✅ 10/10	Author activity: 166 registered-repo PR(s), 87 merged, 21 issue(s).
Contributor context	✅ Confirmed Gittensor contributor	luciferlive112116; Gittensor profile; 166 PR(s), 21 issue(s).
Gate result	✅ Passing	No configured blocker found.

Review context

• Author: luciferlive112116
• Role context: outside_contributor
• Public audience mode: oss maintainer
• Lane context: Repository registration is not available in the local Gittensory cache.
• Public profile languages: JavaScript, MDX, Python, Rust, TypeScript
• Official Gittensor activity: 166 PR(s), 21 issue(s).
• PR-specific overlap: none found.

Contributor next steps

• Await review-lane availability.
• Refresh registry data or choose a registered active repo.

Signal definitions

• Related work = same linked issue, overlapping active PRs, or title/path similarity.
• Change scope = cached public metadata such as size labels, draft state, and review-burden hints.
• Validation posture = whether the PR provides enough public validation/test evidence for maintainer review.
• Contributor workload = public contributor activity and cleanup pressure, not a repo-wide quality failure.
• Contributor context = public GitHub/Gittensor identity context; non-Gittensor status is not a blocker.

_{🟩 Safe / merged · 🟦 Advisory · 🟨 Held for review · 🟥 Blocked / closed}

---

💰 Earn for open-source contributions like this. Gittensor lets GitHub contributors earn for the work they already do — register to start earning →.

Checked by Gittensory, a quiet PR intelligence layer for OSS maintainers.

• Re-run Gittensory review

[loopover-orb]

Gittensory approves — the gate is satisfied and CI is green.