Class: cross-forge information disclosure in the hosted placement.
A hosted child is a second App in the parent's process, and its owner is its admin. Some admin views read state kept per process rather than per App: the egress connection table and totals (apps/egress.tsegressSnapshot, egressTotals, npmTopRepoLastHour), and the cell counters (apps/contain.tscellCounters, read in metrics/app_sources.ts). They reach /metrics, the capacity page and the terminal's egress screen. A hosted child's admin then sees the parent's and the other children's cell labels (repository and app names, private ones too) and their destinations.
Wanted: on a hosted child those views show only that child's own rows, or none. Test: a hosted child's /metrics and capacity page name nothing of the parent's.
Found in the child-forge isolation audit, 2026-11-10.
Class: cross-forge information disclosure in the hosted placement.
A hosted child is a second App in the parent's process, and its owner is its admin. Some admin views read state kept per process rather than per App: the egress connection table and totals (
apps/egress.tsegressSnapshot,egressTotals,npmTopRepoLastHour), and the cell counters (apps/contain.tscellCounters, read inmetrics/app_sources.ts). They reach/metrics, the capacity page and the terminal's egress screen. A hosted child's admin then sees the parent's and the other children's cell labels (repository and app names, private ones too) and their destinations.Wanted: on a hosted child those views show only that child's own rows, or none. Test: a hosted child's
/metricsand capacity page name nothing of the parent's.Found in the child-forge isolation audit, 2026-11-10.