Security package SA: startup hooks off, inherited .NET settings named, launch-path variables from trusted sources

[donislawdev]

First package of the security review: what an elevated process inherits from the account that started it.

What changes

• Startup hooks are off for every project (StartupHookSupport in Directory.Build.props). StartupHookGuards asks the running test host whether System.StartupHookProvider.IsSupported is on, and refuses any project that sets the property itself. The published single-file bws.exe carries false in its embedded runtimeconfig.
• An elevated session names the .NET settings it inherits - profiler, EventPipe file, mini dump, diagnostic ports, and for the window the native-library unpacking folder. A program cannot switch these off for itself. The command line prints one sentence on stderr before reading anything (exit code unchanged), the window shows it in the red line under the list. Nothing changes without administrator rights.
• Launch-path variables no longer come from this process's environment. Injected names (ProgramFiles, ProgramData, PUBLIC, SystemDrive and the x86 variants) come from sources measured not to follow the environment, and the machine block is read raw from the registry because Environment.GetEnvironmentVariables(Machine) expands it with this process's variables. A name nothing here knows stays as written, and a file not found under it is "not read" rather than "missing".
• Documented, not closed: the window unpacks its native WPF libraries to the account's temporary folder (README Honest limits, FAQ in both languages, SECURITY.md).

No contract change: no JSON field, switch, exit code or snapshot schema.

How it was checked

• Narrow test run: core 58/58, CLI 5/5, window 38/38, architecture 185/185, site 26/26.
• Mutation entries for every new behaviour plus one re-anchored entry and neighbours: 15/15 caught.
• tools/compat against the previous CLI build: 801 entries, identical field for field on an ordinary environment.
• The published CLI with a dump switch set only for the child process prints the sentence and exits 0, and without it prints nothing.

Not checked

• The window's sentence on a live window (test host only).
• The new environment reading under a restricted token.

🤖 Generated with Claude Code

[coderabbitai]

Important

• 🔍 Trigger review

This repository does not receive automatic reviews because it has fewer than 10 stars.

⚙️ Run configuration

• Configuration used: Repository UI (base), Organization UI (inherited)
• Review profile: ASSERTIVE
• Plan: Advanced
• Run ID: 93f2d322-2617-4bd5-9a5e-9bbbdbaff401

• Autopilot · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}