Generated by a codebase audit on 2026-06-12 against commit 5b5c634. The full executable plan (with details and verification gates) lives locally at plans/004-frontend-security-hardening.md.
Summary
Two defensive-hardening changes to the FastHTML web UI:
- Bind to localhost by default. The UI currently listens on all network interfaces (
src/frontend/__main__.py). Change the default to 127.0.0.1, with a HINBOX_FRONTEND_HOST env var for deliberate LAN exposure.
- Sanitize rendered profile HTML. Entity profile text is LLM-generated from scraped article content (untrusted input) and is currently rendered without an HTML sanitization step. Add an allowlist-based sanitizer (
nh3) between markdown conversion and rendering, in a shared render_profile_html() helper used by all four entity detail routes, preserving citation superscript links.
Acceptance
- UI listens on
127.0.0.1:5001 by default; env override documented in README
- All profile rendering goes through the sanitizing helper; no raw markdown-to-
NotStr calls remain in src/frontend/
- New tests cover sanitization behavior and citation-link survival
just ci passes
Generated by a codebase audit on 2026-06-12 against commit
5b5c634. The full executable plan (with details and verification gates) lives locally atplans/004-frontend-security-hardening.md.Summary
Two defensive-hardening changes to the FastHTML web UI:
src/frontend/__main__.py). Change the default to127.0.0.1, with aHINBOX_FRONTEND_HOSTenv var for deliberate LAN exposure.nh3) between markdown conversion and rendering, in a sharedrender_profile_html()helper used by all four entity detail routes, preserving citation superscript links.Acceptance
127.0.0.1:5001by default; env override documented in READMENotStrcalls remain insrc/frontend/just cipasses