-
Notifications
You must be signed in to change notification settings - Fork 0
All issues
Issue creation is restricted in this repository
Issues
is:issue state:open
is:issue state:open
Search results
[Security] Add optional TOTP/2FA (at least for admin accounts)
area: authAuthentication, sessions, registrationAuthentication, sessions, registrationseverity: lowLow / info severityLow / info severitystatus: needs-triageAwaiting initial reviewAwaiting initial reviewtype: featureNew capabilityNew capabilitytype: securitySecurity vulnerability or hardeningSecurity vulnerability or hardeningStatus: Open.#298 In Unitae/unitae;[Security] Prefix formula-trigger characters in exported spreadsheet cells
area: settingsSettings and configurationSettings and configurationseverity: lowLow / info severityLow / info severitystatus: needs-triageAwaiting initial reviewAwaiting initial reviewtype: securitySecurity vulnerability or hardeningSecurity vulnerability or hardeningStatus: Open.#297 In Unitae/unitae;[Security] Enforce session-secret length/entropy at boot; support rotation
area: authAuthentication, sessions, registrationAuthentication, sessions, registrationseverity: lowLow / info severityLow / info severitystatus: needs-triageAwaiting initial reviewAwaiting initial reviewtype: securitySecurity vulnerability or hardeningSecurity vulnerability or hardeningStatus: Open.#295 In Unitae/unitae;[Security] Add Origin/Referer check on mutations; move email verify off GET
area: authAuthentication, sessions, registrationAuthentication, sessions, registrationseverity: lowLow / info severityLow / info severitystatus: needs-triageAwaiting initial reviewAwaiting initial reviewtype: securitySecurity vulnerability or hardeningSecurity vulnerability or hardeningStatus: Open.#294 In Unitae/unitae;[Security] Pin explicit scrypt parameters (N=2^17)
area: authAuthentication, sessions, registrationAuthentication, sessions, registrationseverity: lowLow / info severityLow / info severitystatus: needs-triageAwaiting initial reviewAwaiting initial reviewtype: securitySecurity vulnerability or hardeningSecurity vulnerability or hardeningStatus: Open.#293 In Unitae/unitae;[Security] Enforce a consistent minimum password policy
area: authAuthentication, sessions, registrationAuthentication, sessions, registrationseverity: lowLow / info severityLow / info severitystatus: needs-triageAwaiting initial reviewAwaiting initial reviewtype: securitySecurity vulnerability or hardeningSecurity vulnerability or hardeningStatus: Open.#292 In Unitae/unitae;[Security] Remove the tenant-enumeration oracle from /register
area: authAuthentication, sessions, registrationAuthentication, sessions, registrationseverity: mediumMedium severityMedium severitystatus: needs-triageAwaiting initial reviewAwaiting initial reviewtype: securitySecurity vulnerability or hardeningSecurity vulnerability or hardeningStatus: Open.#291 In Unitae/unitae;[Security] Rate-limit, CAPTCHA and email-gate tenant registration (/register abuse)
area: authAuthentication, sessions, registrationAuthentication, sessions, registrationseverity: mediumMedium severityMedium severitystatus: needs-triageAwaiting initial reviewAwaiting initial reviewtype: securitySecurity vulnerability or hardeningSecurity vulnerability or hardeningStatus: Open.#290 In Unitae/unitae;[Security] Pin axios >=1.18.0 and bump vulnerable dependencies
severity: mediumMedium severityMedium severitystatus: needs-triageAwaiting initial reviewAwaiting initial reviewtype: dependenciesDependency updatesDependency updatestype: securitySecurity vulnerability or hardeningSecurity vulnerability or hardeningStatus: Open.#289 In Unitae/unitae;[Security] Validate import storageKey against tenant prefix + path traversal
area: settingsSettings and configurationSettings and configurationseverity: mediumMedium severityMedium severitystatus: needs-triageAwaiting initial reviewAwaiting initial reviewtype: securitySecurity vulnerability or hardeningSecurity vulnerability or hardeningStatus: Open.#288 In Unitae/unitae;[Security] Equalize auth timing to prevent account enumeration
area: authAuthentication, sessions, registrationAuthentication, sessions, registrationseverity: mediumMedium severityMedium severitystatus: needs-triageAwaiting initial reviewAwaiting initial reviewtype: securitySecurity vulnerability or hardeningSecurity vulnerability or hardeningStatus: Open.#287 In Unitae/unitae;[Security] Revoke sessions on password change/reset (session epoch)
area: authAuthentication, sessions, registrationAuthentication, sessions, registrationseverity: mediumMedium severityMedium severitystatus: needs-triageAwaiting initial reviewAwaiting initial reviewtype: securitySecurity vulnerability or hardeningSecurity vulnerability or hardeningStatus: Open.#286 In Unitae/unitae;