Colby Whitlock

whitlocktech approved RunicGateway/website#19

2026-07-03 04:27:46 +00:00

Admin login hardening: RBAC-safe controls, optional TOTP, bot-scoring + IP ban (closes #9)

whitlocktech merged pull request RunicGateway/website#18

2026-07-03 02:44:30 +00:00

Derive uploaded file extension from mimetype, not originalname (fixes #11)

whitlocktech closed issue RunicGateway/website#11

2026-07-03 02:44:30 +00:00

[Security][High] Uploaded file extension is attacker-controlled → stored XSS

whitlocktech pushed to main at RunicGateway/website

2026-07-03 02:44:30 +00:00

ad9c556c9a Merge pull request 'Derive uploaded file extension from mimetype, not originalname (fixes #11)' (#18) from fix/upload-extension-xss into main

e84835a0fb Derive uploaded file extension from mimetype, not originalname (#11)

Compare 2 commits »

whitlocktech approved RunicGateway/website#18

2026-07-03 02:44:23 +00:00

Derive uploaded file extension from mimetype, not originalname (fixes #11)

whitlocktech pushed to main at RunicGateway/website

2026-07-03 02:39:46 +00:00

d89cc7e691 Merge pull request 'Validate and uniqueness-check username on user update (fixes #13)' (#17) from fix/username-validation-update into main

43db509293 Validate and uniqueness-check username on user update (#13)

Compare 2 commits »

whitlocktech merged pull request RunicGateway/website#17

2026-07-03 02:39:44 +00:00

Validate and uniqueness-check username on user update (fixes #13)

whitlocktech closed issue RunicGateway/website#13

2026-07-03 02:39:44 +00:00

[Bug][Medium] username unvalidated and not uniqueness-checked on user update

whitlocktech approved RunicGateway/website#17

2026-07-03 02:39:38 +00:00

Validate and uniqueness-check username on user update (fixes #13)

whitlocktech automatically merged pull request RunicGateway/website#16

2026-07-03 02:32:09 +00:00

whitlocktech closed issue RunicGateway/website#12

2026-07-03 02:32:09 +00:00

[Security][Medium] Stale JWT: demoted/deleted users keep access until token expiry

whitlocktech pushed to main at RunicGateway/website

2026-07-03 02:32:09 +00:00

6b04aa72c1 Merge pull request 'Re-validate JWT against the DB in isLoggedIn (fixes #12)' (#16) from fix/stale-jwt-revalidation into main

81318ae264 Merge branch 'main' into fix/stale-jwt-revalidation

8ad18140d0 Re-validate JWT against the DB in isLoggedIn (#12)

Compare 3 commits »

whitlocktech pushed to fix/stale-jwt-revalidation at RunicGateway/website

2026-07-03 02:32:04 +00:00

81318ae264 Merge branch 'main' into fix/stale-jwt-revalidation

853224b578 Merge pull request 'Enforce role-based authorization on admin-only routes (fixes #10)' (#15) from fix/role-authorization into main

20d7150ab4 Enforce role-based authorization on admin-only routes (#10)

Compare 3 commits »

whitlocktech approved RunicGateway/website#16

2026-07-03 02:31:40 +00:00

Re-validate JWT against the DB in isLoggedIn (fixes #12)

whitlocktech merged pull request RunicGateway/website#15

2026-07-03 02:31:09 +00:00

Enforce role-based authorization on admin-only routes (fixes #10)

whitlocktech closed issue RunicGateway/website#10

2026-07-03 02:31:09 +00:00

[Security][High] No role-based authorization — editor role is never enforced

whitlocktech pushed to main at RunicGateway/website

2026-07-03 02:31:09 +00:00

853224b578 Merge pull request 'Enforce role-based authorization on admin-only routes (fixes #10)' (#15) from fix/role-authorization into main

20d7150ab4 Enforce role-based authorization on admin-only routes (#10)

Compare 2 commits »

whitlocktech approved RunicGateway/website#15

2026-07-03 02:30:59 +00:00

Enforce role-based authorization on admin-only routes (fixes #10)

It works and is properly gated

whitlocktech opened issue RunicGateway/website#9

2026-07-01 04:17:54 +00:00

Admin path security

whitlocktech created repository legis/legis

2026-06-30 20:54:35 +00:00