Add CENTINELA_SHUN_ON_VERDICT so one verdict need not shun a client #11

Merged

james merged 2 commits from verdict-shun-setting into main

2026-10-09 22:31:03 +00:00

james commented

2026-10-09 02:28:39 +00:00

Owner

Problem

A single model verdict could shun a client for CENTINELA_SHUN_TTL. An authenticated user posting a triage note to a vulnerability tracker's API was shunned twice this way. The note is prose about a Dockerfile's ENV block; CRS scored it 18 on its unix command rules and the model answered command_injection=0.94. Every later request from that address, reads included, was refused on every host for 15 minutes.

Change

New setting CENTINELA_SHUN_ON_VERDICT, default true (current behaviour).

With false, a shun verdict is applied as a block:

that request is refused, as before
the block counts toward CENTINELA_SHUN_AFTER, which becomes the only thing that shuns
with CENTINELA_SHUN_AFTER unset, nothing shuns

What this gives up

A client whose single request is judged command injection is no longer banned on the spot. It is banned after CENTINELA_SHUN_AFTER blocked requests in the window. Each such request is still refused.

What this does not fix

The false positive itself: the note is still refused.
Shuns follow the address, and verdicts are reached before any authentication. A page that makes a visitor's browser send payload-looking requests to a proxied host can get that visitor's address shunned. This setting raises the cost from one request to CENTINELA_SHUN_AFTER of them; it does not remove it.

Tests

TestVerdictShunSetting uses the note body that caused the incident. By default the note shuns and the next read is refused. With the setting off the note is blocked, the next read is allowed, a repeat is refused from the cache as a block, and blocks still add up to a repeat-offender shun. Config default and false are covered.

make vet, make build and make test (race detector) pass.

Merging to main runs build-and-push, which tags and publishes the next patch version.

## Problem A single model verdict could shun a client for `CENTINELA_SHUN_TTL`. An authenticated user posting a triage note to a vulnerability tracker's API was shunned twice this way. The note is prose about a Dockerfile's ENV block; CRS scored it 18 on its unix command rules and the model answered `command_injection=0.94`. Every later request from that address, reads included, was refused on every host for 15 minutes. ## Change New setting `CENTINELA_SHUN_ON_VERDICT`, default `true` (current behaviour). With `false`, a shun verdict is applied as a block: - that request is refused, as before - the block counts toward `CENTINELA_SHUN_AFTER`, which becomes the only thing that shuns - with `CENTINELA_SHUN_AFTER` unset, nothing shuns ## What this gives up A client whose single request is judged command injection is no longer banned on the spot. It is banned after `CENTINELA_SHUN_AFTER` blocked requests in the window. Each such request is still refused. ## What this does not fix - The false positive itself: the note is still refused. - Shuns follow the address, and verdicts are reached before any authentication. A page that makes a visitor's browser send payload-looking requests to a proxied host can get that visitor's address shunned. This setting raises the cost from one request to `CENTINELA_SHUN_AFTER` of them; it does not remove it. ## Tests `TestVerdictShunSetting` uses the note body that caused the incident. By default the note shuns and the next read is refused. With the setting off the note is blocked, the next read is allowed, a repeat is refused from the cache as a block, and blocks still add up to a repeat-offender shun. Config default and `false` are covered. `make vet`, `make build` and `make test` (race detector) pass. Merging to `main` runs `build-and-push`, which tags and publishes the next patch version.

james added 1 commit

2026-10-09 02:28:40 +00:00

Add CENTINELA_SHUN_ON_VERDICT so one verdict need not shun a client

test / go (pull_request) Successful in 3m41s

Details

security-scan / security-scan (pull_request) Successful in 6m19s

Details

96140a5cbd

A single model verdict could shun a client for CENTINELA_SHUN_TTL. An
authenticated user posting a triage note to a vulnerability tracker's
API was shunned twice this way: the note is prose about a Dockerfile's
ENV block, CRS scored it 18 on its unix command rules, and the model
answered command_injection=0.94. Every later request from that address,
reads included, was refused for 15 minutes.

With CENTINELA_SHUN_ON_VERDICT=false a shun verdict is applied as a
block: the request is refused and counts toward CENTINELA_SHUN_AFTER,
which is then the only thing that shuns. The default, true, keeps the
current behaviour.

This limits what a false positive costs. It does not stop the false
positive: the note is still refused.