rbrooks/Quest-Board

Watch

v3.3.0 - Hardening: Bugs & Security

New issue

P1. Correctness and security fixes from the July 2026 full-project review (docs/.internal/project-review-2026-07.md, sections 2-3): confirmed bugs, the webhook SSRF gap, recording authorization, DB privilege enforcement, and stale-doc corrections. Ships before new feature work.

No due date

100% Completed

[Hardening] Correct stale documentation: recording architecture, DB roles, stack versions

#113 by claude-bot was closed 2026-07-14 21:34:54 +00:00

[Hardening] Bot HTTP server: default bind to 127.0.0.1 and cap /notify request size

#111 by claude-bot was closed 2026-07-14 21:33:26 +00:00

[Hardening] Escape HTML in recap emails; stop echoing raw LLM errors from /ask

#109 by claude-bot was closed 2026-07-14 21:34:09 +00:00

[Hardening] Reject placeholder and weak secrets at startup

#106 by claude-bot was closed 2026-07-14 21:34:08 +00:00

[Hardening] Enforce DML-only privileges for the app DB user; remove orphaned init.sql

#102 by claude-bot was closed 2026-07-14 21:34:52 +00:00

[Hardening] Require authorization for /record and verify session↔guild ownership on bot audio endpoints

#100 by claude-bot was closed 2026-07-14 21:34:54 +00:00

[Hardening] Validate campaign discord_webhook_url against a Discord host allowlist (SSRF)

#97 by claude-bot was closed 2026-07-14 21:34:07 +00:00

[Hardening] Budget Discord embed total size (6000 chars) across all bot embeds

#94 by claude-bot was closed 2026-07-14 21:33:25 +00:00

[Hardening] Proxy /public/ so the public analytics share page works

#92 by claude-bot was closed 2026-07-14 21:34:51 +00:00

[Hardening] Remove duplicate reminder delivery on session reschedule

#90 by claude-bot was closed 2026-07-14 21:34:06 +00:00

[Hardening] Replace builtin hash() with a deterministic digest in lore match chunk indexing

#88 by claude-bot was closed 2026-07-14 21:34:05 +00:00

[Hardening] Stop on_ready audio_temp cleanup from deleting recordings queued for processing

#85 by claude-bot was closed 2026-07-14 21:33:24 +00:00

[Hardening] Fix /record start guard leak that permanently locks out recording for a guild

#83 by claude-bot was closed 2026-07-14 21:33:23 +00:00

Elapsed time does not match captured time.

#1 by rbrooks was closed 2026-07-14 20:14:28 +00:00