vvzvlad/gitmost
1
0
Fork 0
Code Issues 14 Pull Requests 12 Packages Projects Releases Activity
Labels Milestones New Issue
0 Open 18 Closed
Label
Clear labels
bug
documentation
duplicate
enhancement
epic
feature
good first issue
help wanted
idea
invalid
needs-human
question
refactor
review/approved
review/changes-requested
review/needs
security
status/blocked
status/done
status/in-progress
status/ready
test
wontfix
Milestone
No milestone
Projects
Clear projects
Open Projects
Ukuetis
Assignee
Clear assignees
No assignee
agent_coder
agent_reviewer
vvzvlad
[security][audit] Red-team аудит (85db20f9..HEAD): потеря страниц, утечка title шара, ИИ правит не ту страницу, кап стоимости, CI bug security test
#159 by Ghost was closed 2026-06-26 17:43:56 +03:00
test: export + unit-test resolveTrustProxy (#61) security test
#105 by Ghost was closed 2026-06-21 14:10:36 +03:00
test: cover resolveShareAiMaxOutputTokens output-token cap (#60) security test
#104 by Ghost was closed 2026-06-21 14:10:35 +03:00
test: drive the non-text message-part rejection 400 path (#63) security test
#103 by Ghost was closed 2026-06-21 14:10:35 +03:00
test: cover movePage server-side cycle guard (#67) security test
#102 by Ghost was closed 2026-06-21 14:10:35 +03:00
Null-password (SSO/LDAP-only) accounts: bcrypt throw → 500 on /api/auth/login, leaky 401 + brute-force-limiter evasion on /mcp bug security
#70 by Ghost was closed 2026-06-21 14:10:30 +03:00
fix(mcp): pin Bearer workspaceId to the default workspace (RT-16) bug security
#69 by Ghost was closed 2026-06-21 03:02:08 +03:00
fix(ai): sandwich SAFETY_FRAMEWORK around role persona (RT-32) bug security
#68 by Ghost was closed 2026-06-21 14:10:30 +03:00
fix(page): server-side cycle check in movePage (RT-21) bug security
#67 by Ghost was closed 2026-06-21 14:10:30 +03:00
fix(share-ai): reject non-text message parts to close size-cap bypass (RT-19) bug security
#63 by Ghost was closed 2026-06-21 14:10:29 +03:00
fix(share-ai): fail-closed workspace limiter + lower default cap (RT-6.3) bug security
#62 by Ghost was closed 2026-06-21 14:25:22 +03:00
fix(security): make trustProxy safe so per-IP throttle can't be XFF-spoofed (RT-6.2) bug security
#61 by Ghost was closed 2026-06-21 14:10:28 +03:00
feat(share-ai): cap per-request output with maxOutputTokens (RT-6.1) enhancement security
#60 by Ghost was closed 2026-06-21 14:10:28 +03:00
transclusion: cycle-guard в collectPageEmbedsFromPmJson bug security
#55 by Ghost was closed 2026-06-21 14:10:27 +03:00
page-embed: серверный guard глубины/циклов раскрытия bug security
#54 by Ghost was closed 2026-06-21 14:10:27 +03:00
ws: restriction-cache не инвалидируется — 30-секундное окно утечки bug security
#53 by Ghost was closed 2026-06-21 14:10:27 +03:00
ai-roles: нет серверной валидации модели роли + дрейф enum драйверов bug security
#52 by Ghost was closed 2026-06-21 05:47:05 +03:00
html-embed: close collab broadcast window (transient embed executes in concurrent editors before persist strip) bug security
#26 by Ghost was closed 2026-06-21 03:02:06 +03:00