website

Sign in with Steam (a built-in provider, as Google and Discord)

#214 by wtclaude was closed 2026-10-20 10:26:03 -05:00 Steam sign-in 1 / 1

events: core.lease drops a module's retry: false from read/apply refusals

#206 by wtclaude was closed 2026-11-02 05:21:55 -06:00 1 / 1

side ways scrolling section on hero page.

#60 by ksfixitman was closed 2026-08-04 14:02:24 -05:00

hero page layout

#59 by ksfixitman was closed 2026-07-17 04:45:05 -05:00

2

Homepage Teaser

bug

#48 by whitlocktech was closed 2026-07-11 11:09:54 -05:00

[SECURITY AUDIT] Username enumeration via login timing side-channel (bcrypt runs only for existing users)

severity:low

#35 by wtclaude was closed 2026-08-04 14:03:19 -05:00

[SECURITY AUDIT] No Content-Security-Policy — stored-HTML XSS defense rests entirely on sanitization

severity:low

#34 by wtclaude was closed 2026-08-04 14:02:12 -05:00

[SECURITY AUDIT] Decrypted Discord bot token served from an endpoint on the public API router, guarded only by a shared secret

severity:medium

#33 by wtclaude was closed 2026-07-04 17:50:08 -05:00

[SECURITY AUDIT] SSO flow token (sso_tx) validates as a session — token-type confusion in sessionFromDecoded

bug

severity:medium

#32 by wtclaude was closed 2026-07-04 21:56:34 -05:00

[SECURITY AUDIT] SSO login bypasses TOTP two-factor for accounts that have 2FA enabled

severity:medium

#31 by wtclaude was closed 2026-07-04 22:34:52 -05:00

[SECURITY AUDIT] Session/token revocation is a non-functional stub — logout and password change do not invalidate existing JWTs

bug

severity:medium

#30 by wtclaude was closed 2026-07-04 21:08:18 -05:00

On the front page/hero page

enhancement

#25 by ksfixitman was closed 2026-07-03 15:01:52 -05:00 enhancement/hero

2

[Bug][Medium] Server boots with no JWT_SECRET (only a warning)

bug

#14 by wtclaude was closed 2026-07-03 00:58:18 -05:00

[Bug][Medium] username unvalidated and not uniqueness-checked on user update

#13 by wtclaude was closed 2026-07-02 21:39:44 -05:00

[Security][Medium] Stale JWT: demoted/deleted users keep access until token expiry

#12 by wtclaude was closed 2026-07-02 21:32:09 -05:00

[Security][High] Uploaded file extension is attacker-controlled → stored XSS

#11 by wtclaude was closed 2026-07-02 21:44:30 -05:00

[Security][High] No role-based authorization — editor role is never enforced

#10 by wtclaude was closed 2026-07-02 21:31:09 -05:00

Admin path security

#9 by whitlocktech was closed 2026-07-02 23:27:53 -05:00 main

wiki editor.

#6 by ksfixitman was closed 2026-06-30 13:49:24 -05:00

Hero button bug

#5 by ksfixitman was closed 2026-07-02 23:45:27 -05:00