Security: review the public webhook + transformer surface #11

Backlog: Security & deployment hardening

Problem

FileMill exposes a public webhook and runs attacker-influenced input (emailed attachments) through transformer subprocesses. Before it carries anything sensitive, the internet-facing surface deserves a focused review.

Scope

Review, at minimum:

• Trust boundary (internal/mailgun/verify.go): HMAC signature, timestamp/replay window, size limits, sender allowlist, recipient routing — confirm each is enforced before any side effect.
• Attachment handling (internal/mailgun/intake.go): temp-file path safety (basename sanitization is in place), size enforcement, cleanup on all paths.
• Transformer invocation (internal/app): a transformer receives attacker-controlled file content but not attacker-controlled arguments (command comes from config) — confirm no injection path; confirm the workspace sandbox (input read-only convention, output-only writes, path-escape rejection in readResult).
• Resource limits: transformer timeout (10 min) exists; consider max attachment count / total size, and the rate-limiting issue.
• Secrets handling: keys are env vars, not in email.yaml — confirm nothing logs them.

Notes

• The repo ships a /security-review workflow; run it against the current branch as a starting point, then track findings here.
• Do before broadening senders beyond the allowlist or moving to a production domain.