fix(config): close Sep 2026 Gunicorn worker-scan bypass gaps (#254–#257)

[cursor]

Security review (2026-09-20)

Closes gaps in the static gunicorn.conf.py worker scan that allowed import-time workers mutations while startup still accepted memory:// rate-limit storage.

Severity	Location	Impact	Remediation
Medium	config.py	Login rate limits can be bypassed across Gunicorn workers when config uses Thread.run(), asyncio.run(asyncio.to_thread(...)), ThreadPool.apply_async().get(), or ThreadPool imap/starmap to bump workers after a static workers = 1 assignment	Treat these import-time execution paths as dynamic worker assignments (fail closed on memory://)

Issues

• Gunicorn config Thread.run() synchronous target bypasses startup rate-limit and session guards #254 — Thread.run()
• Gunicorn config asyncio.run(asyncio.to_thread(...)) bypasses startup rate-limit and session guards #255 — asyncio.to_thread
• Gunicorn config ThreadPool apply_async().get() bypasses startup rate-limit and session guards #256 — apply_async().get()
• Gunicorn config ThreadPool imap/starmap bypasses startup rate-limit and session guards #257 — imap / starmap

Tests

Regression parametrized cases in tests/test_gunicorn_indirect_workers_bypass.py.

CI should run the full pytest suite (especially test_gunicorn_indirect_workers_bypass.py and test_app.py config worker detection).

  

---

Note

High Risk
Changes static security analysis for Gunicorn worker count; incorrect detection could still allow cross-worker login rate-limit bypass with memory:// storage.

Overview
Extends the static gunicorn.conf.py worker scan so more import-time execution paths are treated as dynamic (fail closed on memory:// rate-limit storage).

Threading: Detects Thread.start() and Thread.run() (including class-level threading.Thread.run(t)), with shared logic via _thread_class_reference_is_active / _thread_call_starts_mutating_target.

ThreadPool: map-style detection now covers imap, imap_unordered, and starmap; adds apply_async (task plus callback / error_callback) and flags imap iterators as risky lazy iterators when consumed. Pool callbacks can also mutate workers when they reference namespace updates (e.g. globals().update).

Asyncio: Collects asyncio / run / to_thread import alias events and flags asyncio.run(asyncio.to_thread(...)) when the threaded target mutates workers.

Regression parametrized tests in tests/test_gunicorn_indirect_workers_bypass.py cover these bypass patterns.

^{Reviewed by Cursor Bugbot for commit 0abfe12. Bugbot is set up for automated code reviews on this repo. Configure here.}

[coderabbitai]

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Advanced

Run ID: 5aa1c85c-f421-4132-bc12-bcad251cdb75

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[AlexanderWagnerDev]

@codex review

[cursor]

Bugbot couldn't run - usage limit reached

Bugbot is counted against Cursor usage for this user or team, and this run hit a usage or spend limit.

A user or team admin can review and increase usage limits in the Cursor dashboard.

(requestId: serverGenReqId_a271c85a-19e7-4b4a-8233-d52b68342dae)

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: a9ef02a742

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[cursor]

Bugbot couldn't run - usage limit reached

Bugbot is counted against Cursor usage for this user or team, and this run hit a usage or spend limit.

A user or team admin can review and increase usage limits in the Cursor dashboard.

(requestId: serverGenReqId_439f87bd-1f41-4e6f-9b3c-9acaed752ae6)

[cursor]

Bugbot couldn't run - usage limit reached

Bugbot is counted against Cursor usage for this user or team, and this run hit a usage or spend limit.

A user or team admin can review and increase usage limits in the Cursor dashboard.

(requestId: serverGenReqId_b1b902ca-a8a7-4a23-91c5-3b16bbae779c)

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud