Block a user
Enforce TOTP second factor on SSO login (#31)
wtclaude
created branch bugfix/sso-totp-bypass-31 in RunicGateway/website
2026-07-04 22:22:54 -05:00
Fix SSO flow-token / session type confusion (#32)
wtclaude
created branch bugfix/sso-token-confusion-32 in RunicGateway/website
2026-07-04 21:55:11 -05:00
Implement web session/token revocation (#30)
wtclaude
created branch bugfix/session-revocation-30 in RunicGateway/website
2026-07-04 21:07:00 -05:00
Isolate internal bot-config route from the public listener (#33)
wtclaude
created branch bugfix/internal-token-endpoint-33 in RunicGateway/website
2026-07-04 17:35:16 -05:00
wtclaude
pushed to bugfix/internal-token-endpoint-33 at RunicGateway/website
2026-07-04 17:35:16 -05:00
[SECURITY AUDIT] Username enumeration via login timing side-channel (bcrypt runs only for existing users)
[SECURITY AUDIT] No Content-Security-Policy — stored-HTML XSS defense rests entirely on sanitization
[SECURITY AUDIT] Decrypted Discord bot token served from an endpoint on the public API router, guarded only by a shared secret
[SECURITY AUDIT] SSO flow token (sso_tx) validates as a session — token-type confusion in sessionFromDecoded
[SECURITY AUDIT] SSO login bypasses TOTP two-factor for accounts that have 2FA enabled
[SECURITY AUDIT] Session/token revocation is a non-functional stub — logout and password change do not invalidate existing JWTs
Add Discord bot: moderation, filters, scheduling, roles, invites, site integration