upaas

BUG: Race condition between manual deploy and webhook deploy on same app

#38 by clawbot was closed 2026-02-16 09:06:41 +01:00

1

BUG: App name not validated server-side, only client-side HTML pattern

#37 by clawbot was closed 2026-02-16 07:07:48 +01:00

1

SECURITY: Webhook secret exposed in plain text in app detail page and request logs

#36 by clawbot was closed 2026-02-16 07:01:37 +01:00

SECURITY: No validation on volume host paths allows arbitrary filesystem access

#35 by clawbot was closed 2026-02-16 07:09:03 +01:00

1

Fix all golangci-lint issues

#32 by clawbot was closed 2026-02-16 06:57:20 +01:00

1

MEDIUM: Setup endpoint race condition — multiple admin users can be created

#26 by clawbot was closed 2026-02-16 06:45:02 +01:00

1

MEDIUM: Port validation allows ports above 65535

#25 by clawbot was closed 2026-02-16 06:36:44 +01:00

1

LOW: Container log tail parameter not validated — passed directly to Docker API

#24 by clawbot was closed 2026-02-16 06:51:35 +01:00

1

MEDIUM: deploymentLogWriter.Close() doesn't wait for flush goroutine — data loss

#23 by clawbot was closed 2026-02-16 06:33:48 +01:00

1

MEDIUM: Session cookie missing Secure flag — transmitted over HTTP

#22 by clawbot was closed 2026-02-16 06:34:21 +01:00

1

MEDIUM: Unbounded request body read in webhook handler — denial of service

#21 by clawbot was closed 2026-02-16 06:32:16 +01:00

1

HIGH: Arbitrary host path mount via volume add — no path validation

#20 by clawbot was closed 2026-02-16 05:48:18 +01:00

1

HIGH: Missing ownership verification on env var, label, volume, and port deletion

#19 by clawbot was closed 2026-02-16 06:12:53 +01:00

1

CRITICAL: Command injection via branch/repoURL/commitSHA in git clone

#18 by clawbot was closed 2026-02-16 06:38:30 +01:00

1

Log viewer panes are not scrollable and build log does not auto-scroll

#17 by clawbot was closed 2026-02-16 05:51:12 +01:00

Bug: Webhook secret lookup via SQL is not constant-time (timing side-channel)

#13 by clawbot was closed 2026-02-16 05:55:46 +01:00

Bug: No rate limiting on login endpoint allows brute force

#12 by clawbot was closed 2026-02-16 06:15:49 +01:00

Bug: No CSRF protection on state-changing POST endpoints

#11 by clawbot was closed 2026-02-16 05:53:38 +01:00

Bug: Session cookie missing Secure flag, sent over HTTP in production

#5 by clawbot was closed 2026-02-16 05:58:22 +01:00

Bug: deploymentLogWriter.Close() does not wait for final flush to complete

#4 by clawbot was closed 2026-02-16 06:29:18 +01:00