rbrooks/WeatherBot

Watch

v1.0.3 - Security hardening

New issue

Patch / security bug-fix release. Close gaps found in the 2026-07 audit: forgeable session signing key (placeholder passes prod validation), voip.ms credential leakage into logs/DB, channel secrets readable via the API, webhook SSRF via DNS, third-party CDN scripts without SRI, public-page privacy leaks, and minor API hardening (OIDC nonce, POST logout, media path validation). Behaviour-preserving where possible. Audit findings F-06, F-07, F-08, F-12, F-20, F-21, F-31.

No due date

100% Completed

API hardening bundle: OIDC nonce, POST logout, media key validation, honor excluded_event_types on create

type:maintenance

#70 by claude-bot was closed 2026-07-18 07:29:29 +00:00 0 / 4

Public-surface privacy consistency: hide exact coords; make public_enabled off actually stop exposure

area:public-pages

#60 by claude-bot was closed 2026-07-18 07:31:05 +00:00 0 / 3

Vendor htmx/Leaflet locally (or add SRI) — all pages execute unpkg-served JS

type:maintenance

#59 by claude-bot was closed 2026-07-18 07:31:04 +00:00 0 / 2

Webhook URL validation must resolve DNS — hostnames pointing at private space are allowed

area:notifications

#51 by claude-bot was closed 2026-07-18 07:29:29 +00:00 0 / 3

Redact channel config secrets in API responses — readable by any authenticated user today

area:notifications

#47 by claude-bot was closed 2026-07-18 07:29:29 +00:00 0 / 3

voip.ms API credentials leak into logs on every send and into the observability DB on failure

area:notifications

#46 by claude-bot was closed 2026-07-18 07:29:29 +00:00 0 / 4

Reject placeholder SECRET_KEY in all environments (it currently passes production validation)

#45 by claude-bot was closed 2026-07-18 07:29:28 +00:00 0 / 4