From e96d077fdb3f5dfa58d84112462447d8616f12fd Mon Sep 17 00:00:00 2001 From: Graham McIntire Date: Tue, 12 May 2026 10:24:15 -0500 Subject: [PATCH] =?UTF-8?q?remove=20C11=20and=20C12=20from=20bugs.md=20?= =?UTF-8?q?=E2=80=94=20not=20actual=20bugs?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- bugs.md | 24 ------------------------ 1 file changed, 24 deletions(-) diff --git a/bugs.md b/bugs.md index d86543fd..9322ac1c 100644 --- a/bugs.md +++ b/bugs.md @@ -180,30 +180,6 @@ tokens_to_expire = Repo.all_by(UserToken, user_id: user.id) --- -### C11. BY DESIGN — No `force_ssl` in Production - -**File:** `config/prod.exs:41` — relies on Cloudflared proxy - -**Severity:** CRITICAL — HTTP downgrade / cleartext traffic risk - -**Description:** If Cloudflared is misconfigured, traffic arrives over plain HTTP with no redirect. No HSTS headers. Session cookies / API tokens sent in cleartext. - -**Fix:** Enable `force_ssl: [hsts: true]` in production endpoint config. - ---- - -### C12. FALSE POSITIVE — Race Condition in Device Quota Check - -**Files:** `lib/towerops/devices.ex:539-578, 586-598` - -**Severity:** CRITICAL — Concurrent device creation bypasses subscription limits - -**Description:** `create_device` locks org row with `FOR UPDATE` but this doesn't serialize inserts into the `devices` table. Two concurrent calls both pass quota check (same count), then both insert. - -**Fix:** Use `pg_advisory_xact_lock` keyed on `organization_id`, or move device count into the organization row. - ---- - ### C13. ✓ FIXED — MikroTik Credentials Broadcast Over PubSub **File:** `lib/towerops/workers/mikrotik_backup_worker.ex:95-98`