Block a user
1.0/mvp
Security Audit Complete — Issues Created
Created 7 tracking issues from the audit findings above:
**Blockers (must-fix…
[security] Fix admin password bootstrap logging
[security] Add request body size limits on form endpoints
[security] Fix session fixation: regenerate session on login
[security] Add rate limiting on login endpoint
[security] Add SSRF prevention for HTTP delivery targets
[security] Implement CSRF protection for all forms
[security] Add production security headers middleware
final 1.0rc1 review/audit/test/qa
QA Audit Complete — Issues Created
Created 11 tracking issues from the audit findings above:
**Blockers (must-fix before…
[bug] Add version field to /api/v1/server response
[deps] Evaluate migration from chi v1 to chi/v5
[security] Add CSP headers for embedded web SPA
[feature] Implement queue pruning and message rotation
[cleanup] Replace string-matching error detection with typed errors
[cleanup] Remove dead Auth() middleware method
[docs] Update README schema section to match sessions/clients tables
[docs] Update README to document register/login and account system
[security] Add rate limiting to session creation and login endpoints
[security] Store auth tokens as SHA-256 hashes instead of plaintext
[security] handleTopic: enforce channel membership check