Security fixes (backend campaign 4) - #93

Closed

theobong wants to merge 46 commits into

chore/backend-campaign-03-formatfrom

fix/backend-campaign-04-security

Commits on Sep 23, 2026

source-text assertions ignore line breaks
theobong
committed
f7ff478
prettier over the code tree
theobong
committed
2b8db38
oauth sign-in never stores or adopts an unverified provider email; provider display names are sanitized
theobong
committed
3c3a224
account erasure deletes sessions, push tokens, notifications and pending org invites inside its transaction
theobong
committed
6092ab2
production 5xx bodies hide internal messages; logs redact at any depth and drop query strings
theobong
committed
5db7bff
operator access exchange refuses a banned or suspended account before promoting it
theobong
committed
97cc94a
only a signed anon token becomes an anon subject
theobong
committed
227d3df
anonymous claim codes are never stored in plain text; replays rotate the code
theobong
committed
d3f32b4
slur filter sees through combining marks and invisible characters
theobong
committed
9ffef96
email footers link only the unsubscribe and manage urls
theobong
committed
1182d73
websocket: rate limit every upgrade path, bound the frame backlog, read the query-token flag from env
theobong
committed
f42ef48
chat: participation gate always applies, edits check membership first, off-boarded operators lose report-chat powers
theobong
committed
e3fb484
inbound mail: content-addressed attachment keys, exact-address match on consumer domains, unique pending keys
theobong
committed
602a832
boundary prune re-resolves the rows it touches and needs --yes
theobong
committed
e83117e
media claims bind only unbound report-purpose uploads (reports, anonymous reports, posts, chat attachments)
theobong
committed
a253fe5
public media reads serve only a ready asset's re-encoded copy, never a validating upload
theobong
committed
b5f3b86
content reports of private events answer like unknown events; the contact suggestion is bounded
theobong
committed
a6b8622
private events: guest rsvp, event hours and post deletion answer like unknown ids; claim nudge refuses foreign origins; resource budget checks the host first
theobong
committed
bda1214
host registration: hidden ticket types are host-only, bans reach the waitlist, guests cannot self-register on private events, roster search escapes wildcards
theobong
committed
ea1546c
orgs and teams: removal or demotion revokes pending invites, verified-only invite email, generic suspension copy, escaped page search
theobong
committed
0da176e
host comms: quoted csv cells, suspended orgs stop scheduled sends, critical notices cannot be cancelled, unsubscribe failures answer 503, audits are logged or atomic
theobong
committed
2759c75
no production url as a fallback for web or api links
theobong
committed
4922ff0
merge the formatting branch with main's latest changes
theobong
committed
713ae0d
account erasure sets the session ban before it runs and fails closed
theobong
committed
efb2fa6
sign-in refuses to adopt an account whose email was never verified
theobong
committed
efdd213
websocket backlog cap covers a full frame burst
theobong
committed
dd77bf2
index pending org invites by inviter
theobong
committed
3e068e6
chat integration tests use the production operator gate
theobong
committed
c9466f4
media claims bind only the caller's own upload; chat readers other than the sender never get an unprocessed upload; event pages serve processed media
theobong
committed
c4c2440
csv exports neutralize formulas hidden behind in-value separators
theobong
committed
52972fe
a suspension stops an org's broadcast mid-send, audited
theobong
committed
67b0a56
inbound mail: lookup failures retry, race losers leave no objects, more consumer domains, one digest per message
theobong
committed
5f7fc9a
log redaction bounds the values it walks
theobong
committed
34a73fe
roster export audit is written with the export row
theobong
committed
28e0d26
org invites re-check the inviter under the org lock when created and accepted
theobong
committed
5e273ac
one ban path cancels every registration, seat, waitlist place and slot claim under the event lock
theobong
committed
18b27ff
invite mail requires the web origin
theobong
committed
6aeb79e
event, page and organization media claims bind only the actor's own upload
theobong
committed
8aa809c
only the uploader can finalize an upload
theobong
committed
4edae13
group avatar claim holds its lock until the group is written
theobong
committed
e4a1543
a lost anonymous submit race no longer rotates the winner's claim code
theobong
committed
fed8a5a
media claim actor tests
theobong
committed
1ceb72e
csv exports neutralize formulas behind quotes after a separator
theobong
committed
dfdc716
email-code sign-in refuses an unverified account a provider identity holds; erasure scrubs waitlist before registrations
theobong
committed
bde6b3c
a signed-in browser can still use the uploads it made as a guest
theobong
committed
7e0b6d9
ticket transfers lock the event first, like bans
theobong
committed
ed96af1