Two consecutive security audits (hive PRD-010 F-4, PRD-011 F-1, 2026-07-04) flagged the same Medium: state-changing loopback POSTs (honeycomb /setup/tenancy/select, /setup/tenancy/workspaces, pre-existing /api/* mutations) reached via hive's BFF proxy accept requests without an Origin/Referer check (CWE-352). A page in the operator's browser could in principle drive a local-mode mutation.
Not fixed inline because the fix is systemic: an Origin allowlist rewrites behavior for every pre-existing proxied mutation, exceeding any one feature branch's blast radius. Impact bounded today (local-mode self-gate; tenancy selects validate against the caller's own enumerated lists; select needs a live ~10-minute pending window), so it stayed documented Medium.
Ask: enforce an Origin/Referer allowlist (loopback dashboard origin) on all state-changing methods, once, at a well-tested chokepoint (hive proxy plus honeycomb daemon-side defense-in-depth on the /setup/* mutation routes), then stop re-flagging per audit. Refs: hive library/qa/security/2026-07-04-security-audit-prd-011-onboarding-tenancy.md (F-1) and the PRD-010 audit (F-4).
Two consecutive security audits (hive PRD-010 F-4, PRD-011 F-1, 2026-07-04) flagged the same Medium: state-changing loopback POSTs (honeycomb /setup/tenancy/select, /setup/tenancy/workspaces, pre-existing /api/* mutations) reached via hive's BFF proxy accept requests without an Origin/Referer check (CWE-352). A page in the operator's browser could in principle drive a local-mode mutation.
Not fixed inline because the fix is systemic: an Origin allowlist rewrites behavior for every pre-existing proxied mutation, exceeding any one feature branch's blast radius. Impact bounded today (local-mode self-gate; tenancy selects validate against the caller's own enumerated lists; select needs a live ~10-minute pending window), so it stayed documented Medium.
Ask: enforce an Origin/Referer allowlist (loopback dashboard origin) on all state-changing methods, once, at a well-tested chokepoint (hive proxy plus honeycomb daemon-side defense-in-depth on the /setup/* mutation routes), then stop re-flagging per audit. Refs: hive library/qa/security/2026-07-04-security-audit-prd-011-onboarding-tenancy.md (F-1) and the PRD-010 audit (F-4).