Graham McIntie
34fe5d7e49
CRITICAL fixes: - Mask SNMP community string in agent channel logs (CRITICAL-1) - Remove snmpv3 passwords from REST API responses, return _set booleans (CRITICAL-2) - Replace snmp_community with snmp_community_set in GraphQL type (CRITICAL-3) HIGH fixes: - Fix cookie same_site from invalid 'Towerops' to 'Lax' (HIGH-4) - Remove unsafe-eval from CSP script-src (HIGH-6) - Block GraphQL introspection queries in production (HIGH-7) - Sanitize LIKE wildcards in SNMP device name search (HIGH-8) - Reject webhooks when no secret configured instead of accepting (HIGH-9) MEDIUM fixes: - Hash mobile session tokens (SHA-256) before DB storage (MEDIUM-10) - Apply security headers in all environments, not just prod (MEDIUM-14) - Add GraphQL query complexity limit (500) in production (MEDIUM-16) - Fix X-Frame-Options to DENY to match frame-ancestors 'none' (MEDIUM-13) |
||
|---|---|---|
| .. | ||
| api_auth.ex | ||
| brute_force_protection.ex | ||
| capture_timezone.ex | ||
| check_policy_consent.ex | ||
| detect_eu_user.ex | ||
| graphql_introspection.ex | ||
| mobile_auth.ex | ||
| rate_limit.ex | ||
| remote_ip_logger.ex | ||
| security_headers.ex | ||
| update_session_activity.ex | ||
| webhook_auth.ex | ||