Problem. service_apikeys.go:278-285 updates last-used in a go func() with context.Background() on every authenticated request — no concurrency bound, detached from request cancellation; a revoked-but-presented key logs "not found" on every request.
Evidence. service_apikeys.go:278-285. Report 03 (H2). Violates feedback_semaphore_at_api_call / feedback_ctx_cancel_terminal.
Impact. Resource exhaustion + log flooding on a security-critical path.
Suggested fix. Bound the work (single-flight / small worker pool / debounce to at most once per N seconds per key), or update synchronously with a short derived timeout. Demote "key not found" to debug + rate-limit.
References. Source: report 03 (H2). Related #672/PR #859 (recover() in fire-and-forget goroutines — complementary, not the same fix).
Filed from automated adversarial code review (see docs/code-review/). Source finding(s): 03-H2.
Problem.
service_apikeys.go:278-285updates last-used in ago func()withcontext.Background()on every authenticated request — no concurrency bound, detached from request cancellation; a revoked-but-presented key logs "not found" on every request.Evidence.
service_apikeys.go:278-285. Report 03 (H2). Violatesfeedback_semaphore_at_api_call/feedback_ctx_cancel_terminal.Impact. Resource exhaustion + log flooding on a security-critical path.
Suggested fix. Bound the work (single-flight / small worker pool / debounce to at most once per N seconds per key), or update synchronously with a short derived timeout. Demote "key not found" to debug + rate-limit.
References. Source: report 03 (H2). Related #672/PR #859 (recover() in fire-and-forget goroutines — complementary, not the same fix).
Filed from automated adversarial code review (see docs/code-review/). Source finding(s): 03-H2.