From ccab0e2a35515208e6884ed263f451ca613db9a4 Mon Sep 17 00:00:00 2001
From: "hacktron-app-stg[bot]"
 <229423810+hacktron-app-stg[bot]@users.noreply.github.com>
Date: Thu, 23 Jul 2026 18:19:28 +0900
Subject: [PATCH] fix: remove full host filesystem hostPath mount from web
 deployment

The web container mounted the host root (`hostPath: /`) at `/host`,
granting read/write access to the entire node filesystem and enabling
full host compromise. Removed the volume and its volumeMount since no
code referenced it.
---
 deployment.yaml | 8 --------
 1 file changed, 8 deletions(-)

diff --git a/deployment.yaml b/deployment.yaml
index 0f389fa..c1aaea0 100644
--- a/deployment.yaml
+++ b/deployment.yaml
@@ -30,11 +30,3 @@ spec:
             # VULN 3: hardcoded secret embedded directly in the manifest
             - name: DB_PASSWORD
               value: "Pa$$w0rd!2024"
-          volumeMounts:
-            - name: host-root
-              mountPath: /host
-      volumes:
-        # VULN 6: mounts the entire host filesystem into the container
-        - name: host-root
-          hostPath:
-            path: /