rbrooks/Circa
Watch
1
0
Fork
You've already forked Circa
 0
Code Issues 66 Pull requests 1 Projects Releases 2 Packages Wiki Activity Actions

v0.1.1

New issue

Security hardening. Everything that must be fixed before Circa is exposed on the network again. The app has been offline for some months, so nothing here is an active incident - but the audit of 2026-07-28 found an unauthenticated-to-RCE chain (any account the IdP accepts is auto-provisioned as reviewer; reviewer can reach POST /api/ingest; ingest writes attacker-controlled bytes to an attacker-controlled path). Exit criteria: every CRITICAL and HIGH security finding is closed, lockfiles are committed, and pip-audit/npm audit run clean in CI. Do not put the app back online until this milestone closes.

No due date
100% Completed
Branch protection and Renovate dependency automation
infra
security
1
#130 by claude-bot was closed 2026-07-30 23:09:05 +00:00
Require HTTPS for the OIDC discovery URL
backend
security
1
#127 by claude-bot was closed 2026-07-28 20:24:13 +00:00 0 / 3
No admin-only routes exist and the viewer role is unenforced
backend
security
1
#73 by claude-bot was closed 2026-07-30 18:21:01 +00:00 0 / 5
Commit lockfiles and wire pip-audit / npm audit into CI
infra
security
2
#72 by claude-bot was closed 2026-07-30 21:18:16 +00:00 0 / 4
require_role implements a threshold but reads as set membership
backend
security
1
#71 by claude-bot was closed 2026-07-28 20:24:13 +00:00 0 / 3
collection_id scoping is assumed rather than enforced on by-id routes
backend
security
1
#70 by claude-bot was closed 2026-07-30 20:52:25 +00:00 0 / 4
Unauthenticated API docs and OAuth error detail leakage
backend
security
1
#69 by claude-bot was closed 2026-07-28 20:33:21 +00:00 0 / 3
No rate limiting on authentication or expensive endpoints
backend
security
1
#68 by claude-bot was closed 2026-07-30 21:06:55 +00:00 0 / 3
Audit log is mutable and deletable through ordinary ORM access
backend
security
1
#67 by claude-bot was closed 2026-07-30 20:42:36 +00:00 0 / 3
Notes are overwritten with no history and an empty audit record
backend
bug
security
1
#66 by claude-bot was closed 2026-07-30 20:41:33 +00:00 0 / 4
Attacker-controlled images reach Pillow with no limits or isolation
backend
security
2
#65 by claude-bot was closed 2026-07-30 23:08:25 +00:00 0 / 4
No length limits on any request body
backend
security
1
#64 by claude-bot was closed 2026-07-28 20:33:21 +00:00 0 / 4
Upload MIME bypass plus missing nosniff enables stored XSS
backend
security
1
#63 by claude-bot was closed 2026-07-28 20:33:21 +00:00 0 / 5
No CSRF protection beyond SameSite=Lax
backend
security
1
#62 by claude-bot was closed 2026-07-28 20:33:21 +00:00 0 / 4
Logout does not invalidate the session; add server-side revocation
backend
security
1
#61 by claude-bot was closed 2026-07-30 20:41:33 +00:00 0 / 4
Require email_verified and make first-admin bootstrap run once
backend
security
1
#60 by claude-bot was closed 2026-07-28 20:24:13 +00:00 0 / 3
Pin ID token aud claim to the client id
backend
security
1
#59 by claude-bot was closed 2026-07-28 18:47:57 +00:00 0 / 3
Enable PKCE on the OAuth authorization code flow
backend
security
1
#58 by claude-bot was closed 2026-07-28 18:47:57 +00:00 0 / 3
API discloses other users UUIDs, enabling session forgery
backend
security
1
#57 by claude-bot was closed 2026-07-30 18:21:01 +00:00 0 / 4
Every OAuth login is auto-provisioned as reviewer
backend
bug
security
1
#56 by claude-bot was closed 2026-07-28 17:56:50 +00:00 0 / 4