authorize_repo_read (crates/gitlawb-node/src/api/mod.rs:54-56) drops a quarantined repo before the visibility gate, so a quarantined mirror is hidden from every reader as if it did not exist. The three encrypted-blob handlers (api/encrypted.rs:21-31, 48-58, 84-93) and withheld_paths (api/visibility.rs:213-229) hand-roll the gate with get_repo + visibility_check and never call is_repo_quarantined.
Impact: a quarantined mirror's OID/CID index, and the full ciphertext of every withheld blob via GET .../encrypted-blob/{oid}, are still served, while clone, /ipfs/{cid} and every authorize_repo_read route return 404.
Repro: GET /api/v1/repos/{owner}/{repo}/encrypted-blobs against a quarantined mirror returns 200 with data.
Fix: route these handlers through authorize_repo_read, or add the quarantine check to the hand-rolled gate. Per AGENTS.md, add deny-path tests proving the quarantined repo now 404s on each.
Found in the Oct 2 2026 audit (A2) at bfc44f9.
authorize_repo_read(crates/gitlawb-node/src/api/mod.rs:54-56) drops a quarantined repo before the visibility gate, so a quarantined mirror is hidden from every reader as if it did not exist. The three encrypted-blob handlers (api/encrypted.rs:21-31, 48-58, 84-93) andwithheld_paths(api/visibility.rs:213-229) hand-roll the gate withget_repo+visibility_checkand never callis_repo_quarantined.Impact: a quarantined mirror's OID/CID index, and the full ciphertext of every withheld blob via
GET .../encrypted-blob/{oid}, are still served, while clone,/ipfs/{cid}and everyauthorize_repo_readroute return 404.Repro:
GET /api/v1/repos/{owner}/{repo}/encrypted-blobsagainst a quarantined mirror returns 200 with data.Fix: route these handlers through
authorize_repo_read, or add the quarantine check to the hand-rolled gate. Per AGENTS.md, add deny-path tests proving the quarantined repo now 404s on each.Found in the Oct 2 2026 audit (A2) at bfc44f9.