Graham McIntire
97232117f5
- H12: session and remember-me cookies get http_only + secure (prod-only). Cookie can no longer be read via document.cookie (XSS exfil defense) and the Secure flag is set in production via config/prod.exs. - L2: 404 tracker uses EXPIRE … NX so a sustained probe can't keep refreshing the 60s window and dodge the threshold ban. - L5: vault only reads CLOAK_KEY when :env == :prod — a developer with a prod env var set in their shell won't accidentally encrypt local data with the production key. - L6: health endpoint no longer leaks the app version. - L8: Preseem.dismiss_insight/2 + InsightsLive uses it — dismissing now requires the insight to belong to the user's org (closes IDOR). - L10: SidebarCollapse JS hook stores its click handler and removes it in destroyed(); listeners no longer accumulate across LV navigation. - L11: WebMCP navigate tool rejects anything that isn't a same-origin absolute path (blocks javascript:, data:, off-site URLs). |
||
|---|---|---|
| .. | ||
| assets | ||
| integration | ||
| mix/tasks | ||
| snmpkit | ||
| support | ||
| towerops | ||
| towerops_web | ||
| test_helper.exs | ||
| towerops_native_test.exs | ||