CLM Taxonomy Dashboard V4 — Security Assessment

Tag: S-2026-07-28-clm-security-assessment Type: report (security assessment) Author(s): not recorded on the available material Date of source: 2026-07-28 Date ingested: 2026-08-02 Authority weight: medium — the assessment is referenced and its findings dispositioned in a first-party build record, but the raw assessment document itself has not yet been ingested into /_raw_sources/; the summary below is reconstructed from the Business Glossary Reader project context, not read from the raw document. Raw file: not yet ingested — pending. (Schema §7 traceability for the finding claims is therefore incomplete; see Open questions.)

What it claims

The assessment evaluates the security posture of the CLM Taxonomy Dashboard V4 single-file HTML build (the self-regenerating, SheetJS-inlined, embedded-data dashboard described in CLM Taxonomy Dashboard — Production UI). It identifies at least six findings, numbered 1, 2, 3, 4, 6 and 7 in the material available to this page:

• Finding 1 — concerns the escaping of data injected into the HTML. The Reader’s disposition: mitigated by full HTML escaping on every injected value.
• Finding 2 — concerns the SheetJS import (the inlined xlsx library used to parse workbooks in-browser). The Reader’s disposition: not-applicable — the SheetJS import is removed entirely in the Business Glossary Reader.
• Finding 3 — concerns inline event handlers in the HTML. The Reader’s disposition: mitigated — no inline event handlers.
• Finding 4 — concerns export paths from the dashboard. The Reader’s disposition: not-applicable — all import/export/email/refresh controls are removed.
• Finding 6 — concerns outbound link URL schemes. The Reader’s disposition: mitigated by a URL-scheme allowlist.
• Finding 7 — concerns the Content Security Policy. The Reader’s disposition: mitigated by a CSP header/meta.

The Business Glossary Reader project closes the assessment against its own surface: Findings 1, 3, 6 and 7 are mitigated by shell-level controls (full escaping, no inline handlers, URL-scheme allowlist, CSP); Findings 2 and 4 are made not-applicable by removing the features that caused them (no SheetJS import, no exports).

Scope note. This page records what is known about the assessment from the Reader’s build context. The detailed finding text, severity ratings, and any recommendations beyond the dispositions listed above are not captured here because the raw assessment was not available to the agent that wrote this page. Do not treat the disposition list above as the assessment’s full content.

Notable quotes

No verbatim quotes are available — the raw assessment document was not in scope for this page’s author. (To be populated when the raw document is ingested.)

What’s speculative vs. asserted

Asserted (from the Business Glossary Reader build record, which carries executed-check evidence):

• That the Reader implements full escaping, no inline handlers, a URL-scheme allowlist and a CSP — these were verified by the swarm’s poisoned-workbook build and node --check (see the Reader project page).
• That the Reader removes the SheetJS import and all export/email/refresh controls, making Findings 2 and 4 not-applicable.
• That the assessment identifies findings numbered 1, 2, 3, 4, 6 and 7.

Speculative / not established from the raw document:

• The title, severity and exact wording of each finding is not known — only the numbers and the broad topic inferred from the mitigation applied. The topic labels above (e.g. “concerns the escaping…”) are inferred from the mitigation, not read from the assessment.
• The existence and content of any Finding 5 or findings beyond 7 is unknown — the available material references only 1, 2, 3, 4, 6, 7.
• The assessment’s author, methodology and scope are not recorded here.
• Whether the assessment’s dispositions apply identically to the V4 production dashboard (as opposed to the Reader) is not asserted here; this page records only how the Reader closed the findings.

Topics this feeds

• Business Glossary Reader — the project that dispositioned these findings (mitigated 1/3/6/7; made 2 and 4 not-applicable).
• CLM Taxonomy Dashboard — Production UI — the V4 dashboard the assessment was written against; its own disposition of the findings is not captured on this page.

Open questions raised

• Ingest the raw assessment document into /_raw_sources/S-2026-07-28-clm-security-assessment.* so this page can be rewritten from the source rather than from the Reader’s build context (schema §7 traceability is currently incomplete).
• What are the titles, severities and exact wording of Findings 1–7? Is there a Finding 5, or findings beyond 7?
• Who authored the assessment, and what was its methodology and scope (static review, dynamic, threat model)?
• How does the V4 production dashboard itself (not the Reader) disposition each finding? That is recorded on CLM Taxonomy Dashboard — Production UI only for the parts this Reader’s context touched.