Commits

b07d8cb

Harden .env loader against Superglobal overwrite (Host Header Injection)

2026-07-13T06:55:08+00:00

Anton Barinov <55404783+Anton-Barinov@users.noreply.github.com>

Files: 2 | core 0 | module 0 | forbidden 0

Flags:

40a8ef5

Revert "fix: re-apply taskKeyPrefixExists fix (null !== false always true)"

2026-07-12T23:46:28+00:00

Anton Barinov <55404783+Anton-Barinov@users.noreply.github.com>

Files: 2 | core 0 | module 0 | forbidden 0

Flags:

e5a52ec

Merge security-fixes into main: cycle 4 audit fixes + cleared SECURITY-FIXES.md template

2026-07-12T23:16:45+00:00

Anton Barinov <55404783+Anton-Barinov@users.noreply.github.com>

Files: 0 | core 0 | module 0 | forbidden 0

Flags:

877ca51

fix: re-apply taskKeyPrefixExists fix, all 216 REST API tests pass

2026-07-12T22:52:30+00:00

Anton Barinov <55404783+Anton-Barinov@users.noreply.github.com>

Files: 2 | core 0 | module 0 | forbidden 0

Flags:

ff4299d

fix: re-apply taskKeyPrefixExists fix (null !== false always true)

2026-07-12T22:48:53+00:00

Anton Barinov <55404783+Anton-Barinov@users.noreply.github.com>

Files: 4 | core 0 | module 0 | forbidden 0

Flags:

2696869

Clear SECURITY-FIXES.md to template for next audit cycle

2026-07-12T22:43:51+00:00

Anton Barinov <55404783+Anton-Barinov@users.noreply.github.com>

Files: 2 | core 0 | module 0 | forbidden 0

Flags:

672e143

Add per-request CSP nonce infrastructure and root .htaccess hardening

2026-07-12T22:38:54+00:00

Anton Barinov <55404783+Anton-Barinov@users.noreply.github.com>

Files: 6 | core 0 | module 0 | forbidden 0

Flags:

c4eb122

Add global e() escape helper; require in web bootstrap; migrate bare echoes in admin module + ideas pages

2026-07-12T22:29:39+00:00

Anton Barinov <55404783+Anton-Barinov@users.noreply.github.com>

Files: 10 | core 0 | module 0 | forbidden 0

Flags:

8bada2c

Validate module archive magic bytes; use atomic lock creation in installer

2026-07-12T22:12:48+00:00

Anton Barinov <55404783+Anton-Barinov@users.noreply.github.com>

Files: 4 | core 0 | module 0 | forbidden 0

Flags:

a8f9e6b

Require APP_KEY for 2FA signing; close concurrent-worker race on .env writes

2026-07-12T22:05:16+00:00

Anton Barinov <55404783+Anton-Barinov@users.noreply.github.com>

Files: 4 | core 0 | module 0 | forbidden 0

Flags:

522cdfd

Harden template variable injection in web core, sanitize CLI parse_str targets

2026-07-12T21:51:52+00:00

Anton Barinov <55404783+Anton-Barinov@users.noreply.github.com>

Files: 4 | core 0 | module 0 | forbidden 0

Flags:

4dda65d

Document cycle 4 security audit findings and remediation roadmap

2026-07-12T21:44:32+00:00

Anton Barinov <55404783+Anton-Barinov@users.noreply.github.com>

Files: 2 | core 0 | module 0 | forbidden 0

Flags:

2081ccf

docs: update mcp.md - 86/89 tests pass, list 20 undocumented tools, fix webhook bug

2026-07-12T21:36:35+00:00

Anton Barinov <55404783+Anton-Barinov@users.noreply.github.com>

Files: 2 | core 0 | module 0 | forbidden 0

Flags:

04e87d7

test: add MCP CRUD test suite (86/89 pass) + fix webhook/title bugs

2026-07-12T21:34:08+00:00

Anton Barinov <55404783+Anton-Barinov@users.noreply.github.com>

Files: 4 | core 0 | module 0 | forbidden 0

Flags:

b222415

docs: update mcp.md with audit results, 14 CRUD entities verified, webhook bug fixed

2026-07-12T21:17:28+00:00

Anton Barinov <55404783+Anton-Barinov@users.noreply.github.com>

Files: 2 | core 0 | module 0 | forbidden 0

Flags:

095da4f

Add superglobals protection to ModuleMailer skip list

2026-07-12T21:17:25+00:00

Anton Barinov <55404783+Anton-Barinov@users.noreply.github.com>

Files: 2 | core 0 | module 0 | forbidden 0

Flags:

42bd473

Add superglobals protection to ModuleMailer skip list

2026-07-12T21:17:07+00:00

Anton Barinov <55404783+Anton-Barinov@users.noreply.github.com>

Files: 2 | core 0 | module 0 | forbidden 0

Flags:

9f74a7e

Add skip-list to prevent overwriting existing variables and superglobals in ModuleMailer

2026-07-12T21:16:23+00:00

Anton Barinov <55404783+Anton-Barinov@users.noreply.github.com>

Files: 2 | core 0 | module 0 | forbidden 0

Flags:

777a329

Fix extract() in ModuleMailer, replace with controlled variable creation

2026-07-12T21:14:27+00:00

Anton Barinov <55404783+Anton-Barinov@users.noreply.github.com>

Files: 2 | core 0 | module 0 | forbidden 0

Flags:

12e9c4a

Replace extract() with controlled variable creation in ModuleMailer to prevent variable injection

2026-07-12T21:14:08+00:00

Anton Barinov <55404783+Anton-Barinov@users.noreply.github.com>

Files: 2 | core 0 | module 0 | forbidden 0

Flags:

6bce53a

Clear SECURITY-FIXES.md for next audit cycle

2026-07-12T21:10:51+00:00

Anton Barinov <55404783+Anton-Barinov@users.noreply.github.com>

Files: 2 | core 0 | module 0 | forbidden 0

Flags:

759e368

Merge cycle3: Permissions-Policy, IP masking in impersonation logs, session cookie flags, gitleaks config

2026-07-12T21:09:08+00:00

Anton Barinov <55404783+Anton-Barinov@users.noreply.github.com>

Files: 2 | core 0 | module 0 | forbidden 0

Flags:

77f6e02

fix: MCP webhook create/update pass title to service, add title to update field list

2026-07-12T21:08:52+00:00

Anton Barinov <55404783+Anton-Barinov@users.noreply.github.com>

Files: 4 | core 0 | module 0 | forbidden 0

Flags:

54027dc

Merge cycle3: Permissions-Policy, IP masking in impersonation logs, session cookie flags, gitleaks config

2026-07-12T21:08:46+00:00

Anton Barinov <55404783+Anton-Barinov@users.noreply.github.com>

Files: 0 | core 0 | module 0 | forbidden 0

Flags:

2827c36

Add Permissions-Policy header; mask IP and user-agent in impersonation security logs; set explicit session cookie flags; create gitleaks config

2026-07-12T21:08:24+00:00

Anton Barinov <55404783+Anton-Barinov@users.noreply.github.com>

Files: 6 | core 0 | module 0 | forbidden 0

Flags:

f1ccc12

fix: MCP webhook create/update used 'url' but service expects 'endpoint'

2026-07-12T21:04:43+00:00

Anton Barinov <55404783+Anton-Barinov@users.noreply.github.com>

Files: 6 | core 0 | module 0 | forbidden 0

Flags:

2357ea1

docs: add test suite info, update audit results with 7 bugs fixed, 216 tests passing

2026-07-12T20:54:39+00:00

Anton Barinov <55404783+Anton-Barinov@users.noreply.github.com>

Files: 2 | core 0 | module 0 | forbidden 0

Flags:

b7bb164

Clear SECURITY-FIXES.md for next audit cycle

2026-07-12T20:54:36+00:00

Anton Barinov <55404783+Anton-Barinov@users.noreply.github.com>

Files: 2 | core 0 | module 0 | forbidden 0

Flags:

8f98a1b

Merge security-fixes-cycle2: MCP prompt injection blocking, HSTS, IP masking

2026-07-12T20:52:07+00:00

Anton Barinov <55404783+Anton-Barinov@users.noreply.github.com>

Files: 4 | core 0 | module 0 | forbidden 0

Flags:

42ef4a5

Merge security-fixes-cycle2: MCP prompt injection blocking, HSTS, IP masking in logs

2026-07-12T20:51:53+00:00

Anton Barinov <55404783+Anton-Barinov@users.noreply.github.com>

Files: 0 | core 0 | module 0 | forbidden 0

Flags:

b7af0ed

Add active prompt injection blocking for MCP tools; add HSTS includeSubDomains header; mask IP addresses in logs for non-root users

2026-07-12T20:51:36+00:00

Anton Barinov <55404783+Anton-Barinov@users.noreply.github.com>

Files: 4 | core 0 | module 0 | forbidden 0

Flags:

e926ea3

fix: taskKeyPrefixExists always returned true (null !== false is always true)

2026-07-12T20:44:36+00:00

Anton Barinov <55404783+Anton-Barinov@users.noreply.github.com>

Files: 6 | core 0 | module 0 | forbidden 0

Flags:

1b6cce2

Fix CSP report-uri relative URL

2026-07-12T20:39:35+00:00

Anton Barinov <55404783+Anton-Barinov@users.noreply.github.com>

Files: 2 | core 0 | module 0 | forbidden 0

Flags:

b69d0ab

Fix CSP report-uri to use relative URL, avoid undefined variable

2026-07-12T20:39:13+00:00

Anton Barinov <55404783+Anton-Barinov@users.noreply.github.com>

Files: 2 | core 0 | module 0 | forbidden 0

Flags:

14c2ba3

Fix container key name for RateLimitService in TwoFactorController

2026-07-12T20:36:07+00:00

Anton Barinov <55404783+Anton-Barinov@users.noreply.github.com>

Files: 4 | core 0 | module 0 | forbidden 0

Flags:

6b41715

Security fixes: 2FA rate limiting, CSP report-uri, log query string masking

2026-07-12T20:32:55+00:00

Anton Barinov <55404783+Anton-Barinov@users.noreply.github.com>

Files: 4 | core 0 | module 0 | forbidden 0

Flags:

2f227c9

Merge security-fixes: 2FA rate limiting, CSP report-uri, log query string masking

2026-07-12T20:32:23+00:00

Anton Barinov <55404783+Anton-Barinov@users.noreply.github.com>

Files: 0 | core 0 | module 0 | forbidden 0

Flags:

8e699ae

Add IP-based and user-based rate limiting for 2FA verify; add CSP report-uri; add query string masking in logs

2026-07-12T20:31:52+00:00

Anton Barinov <55404783+Anton-Barinov@users.noreply.github.com>

Files: 4 | core 0 | module 0 | forbidden 0

Flags:

c26bfdb

update

2026-07-12T20:20:45+00:00

Anton Barinov <55404783+Anton-Barinov@users.noreply.github.com>

Files: 2 | core 0 | module 0 | forbidden 0

Flags:

0fa0fc5

update

2026-07-12T20:18:22+00:00

Anton Barinov <55404783+Anton-Barinov@users.noreply.github.com>

Files: 4 | core 0 | module 0 | forbidden 0

Flags:

acea999

Tighten .gitignore pattern to only track storage_api/secrets/.htaccess

2026-07-12T20:18:06+00:00

Anton Barinov <55404783+Anton-Barinov@users.noreply.github.com>

Files: 2 | core 0 | module 0 | forbidden 0

Flags:

96b831a

Add .htaccess to storage_api/secrets/ for defense-in-depth access control

2026-07-12T20:17:33+00:00

Anton Barinov <55404783+Anton-Barinov@users.noreply.github.com>

Files: 2 | core 0 | module 0 | forbidden 0

Flags:

8750f83

Add per-tool rate limiting for MCP controller (30 req/min per tool per user)

2026-07-12T20:13:45+00:00

Anton Barinov <55404783+Anton-Barinov@users.noreply.github.com>

Files: 6 | core 0 | module 0 | forbidden 0

Flags:

de18f25

Complete two-factor login in web interface

2026-07-12T20:11:18+00:00

Anton Barinov <55404783+Anton-Barinov@users.noreply.github.com>

Files: 6 | core 0 | module 0 | forbidden 0

Flags:

231eae8

Harden two-factor verification

2026-07-12T20:07:43+00:00

Anton Barinov <55404783+Anton-Barinov@users.noreply.github.com>

Files: 4 | core 0 | module 0 | forbidden 0

Flags:

3ebb6a8

Avoid module schema checks on every request

2026-07-12T20:05:38+00:00

Anton Barinov <55404783+Anton-Barinov@users.noreply.github.com>

Files: 2 | core 0 | module 0 | forbidden 0

Flags:

b3b655f

update

2026-07-12T20:04:50+00:00

Anton Barinov <55404783+Anton-Barinov@users.noreply.github.com>

Files: 2 | core 0 | module 0 | forbidden 0

Flags:

9df76e7

Add 2FA TOTP verification: encrypted secrets, two-step login flow, backup code consumption

2026-07-12T20:04:19+00:00

Anton Barinov <55404783+Anton-Barinov@users.noreply.github.com>

Files: 16 | core 0 | module 0 | forbidden 0

Flags:

f0e43f0

Store full module configuration payloads

2026-07-12T19:58:26+00:00

Anton Barinov <55404783+Anton-Barinov@users.noreply.github.com>

Files: 2 | core 0 | module 0 | forbidden 0

Flags:

c56140e

Handle concurrent project key prefix conflicts

2026-07-12T19:56:37+00:00

Anton Barinov <55404783+Anton-Barinov@users.noreply.github.com>

Files: 8 | core 0 | module 0 | forbidden 0

Flags: