Skip to content

v2.0.1

Choose a tag to compare

View all tags
@tdrabikdev tdrabikdev released this 12 Jul 13:18
v2.0.1
b105608
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

Security hardening from an OWASP audit.

  • SSRF guard on OIDC discovery (#600) — https-only + block localhost/private/reserved/link-local before every outbound fetch; closes an SSRF that could exfiltrate the client_secret via a hostile token_endpoint.
  • CORS allowlist + SSO route throttling (#601) — no more '*'-with-credentials default; SSO/SAML routes rate-limited (30/min/IP).
  • Removed a dead unauthorized DocumentController (#602) — latent IDOR (unrouted, no authz).

Full suite 1153 passed / 1 skipped. PHPStan 0-new. Pint clean. No migrations.

Assets 2
Loading