Block a user
wtclaude
created branch bugfix/session-revocation-30 in RunicGateway/website
2026-07-05 02:07:00 +00:00
Isolate internal bot-config route from the public listener (#33)
wtclaude
created branch bugfix/internal-token-endpoint-33 in RunicGateway/website
2026-07-04 22:35:16 +00:00
wtclaude
pushed to bugfix/internal-token-endpoint-33 at RunicGateway/website
2026-07-04 22:35:16 +00:00
[SECURITY AUDIT] Username enumeration via login timing side-channel (bcrypt runs only for existing users)
[SECURITY AUDIT] No Content-Security-Policy — stored-HTML XSS defense rests entirely on sanitization
[SECURITY AUDIT] Decrypted Discord bot token served from an endpoint on the public API router, guarded only by a shared secret
[SECURITY AUDIT] SSO flow token (sso_tx) validates as a session — token-type confusion in sessionFromDecoded
[SECURITY AUDIT] SSO login bypasses TOTP two-factor for accounts that have 2FA enabled
[SECURITY AUDIT] Session/token revocation is a non-functional stub — logout and password change do not invalidate existing JWTs
Add Discord bot: moderation, filters, scheduling, roles, invites, site integration
Hero editor: fullscreen landing, remove two-card row, quick links into hero
wtclaude
pushed to feature/hero-fullscreen-landing at RunicGateway/website
2026-07-04 02:49:52 +00:00
wtclaude
created branch feature/hero-fullscreen-landing in RunicGateway/website
2026-07-04 02:49:51 +00:00
Add Swagger/OpenAPI API docs (swagger-ui + swagger-autogen)
Hero editor: scale text-block fonts with the resize handle (#25)