2.3 KiB
2.3 KiB
Criticality and Risk Analysis of werkkompass
The section "Required Checks" of agentic-workflow.md requires this document. Only the human sets or changes the criticality.
Criticality
low, set by the human on 2026-10-14, as a deviation from the table of the workflow (see below).
- werkkompass is one static HTML file, served by the web server of javagil.de.
- It has no server code, no dependencies, no forms and no requests to other hosts.
- It handles no data of users and no credentials; its state lives only in the open page.
So a known vulnerability of a dependency would fail the build from CVSS 9.
What werkkompass Handles
- The texts and the model of the demo, all part of
index.html. - No cookies, no
localStorage, no tracking.
Who Reaches It
- Anyone on the internet reads the page at https://javagil.de/vibe-engineering.
- Only the human installs a new version, with
install-vibe-engineering-webappover SSH.
What a Breach Would Cost
- A changed page on javagil.de, e.g. defaced, or with a script that attacks its visitors. That needs write access to the web server, which werkkompass does not grant.
- No data of users, no money, no other systems.
Risks
| Risk | Measure |
|---|---|
| a script or a resource from another host enters the page | no foreign scripts; a new one is a new dependency and needs the human's consent |
| a text rendered as HTML from input | the page renders only its own texts; review category xss |
| a link in a framed view leads to a page that refuses to be framed | target="_top" on such links; review |
the installer deletes the checked-out index.html |
README and AGENTS.md say to install a copy |
Deviations from the Defaults of the Required Checks
- Criticality low although reachable from the internet: the table of the workflow rates a repository reachable from the internet as high. werkkompass is a static page without dependencies and without data of others, so a vulnerability cannot reach more than the page itself.
- No checks of vulnerabilities and licenses yet: there are no dependencies to check. The first dependency or build tool brings these checks along.
- No mutation tests: werkcrappit measures Kotlin and Java; werkkompass has neither.