Graham McIntire ca7bb75472 fix: 11 critical security/correctness bugs from code audit ... - C1: Replace innerHTML template literals with DOM textContent in sites_map.ts - C2: Derive user_id from current_scope instead of client params in policy consent - C3: Fix broken halt() in GDPR data export (orphaned _ = ... halt()) - C4: Add owner/admin authorization check to MembersController update/delete - C5: Require HMAC signature on agent release webhook (was optional) - C6: Fix Repo.all_by/2 (not a real Ecto function) → Repo.all with query - C7: Move auth exemption to before_send callback in BruteForceProtection - C8: Block </style>/<script injection in status page custom_css validation - C9: Create secrets.example.yaml with placeholders; secrets.yaml already gitignored - C10: Load Stripe key from STRIPE_SECRET_KEY env var instead of hardcoded value - C13: Remove credentials from PubSub backup broadcast; channel resolves them C11 (no force_ssl): by design — Cloudflared terminates TLS C12 (device quota race): false positive — FOR UPDATE serializes correctly		2026-05-12 10:20:52 -05:00
..
channels	fix: 11 critical security/correctness bugs from code audit	2026-05-12 10:20:52 -05:00
components	test: lift coverage from 85.84% → 86.28%	2026-05-08 17:44:18 -05:00
controllers	fix: 11 critical security/correctness bugs from code audit	2026-05-12 10:20:52 -05:00
endpoint	test: add LiveView tests following testing-liveview patterns	2026-05-07 12:55:39 -05:00
graphql	test: GraphQL.Resolvers.Schedule and Device coverage	2026-05-09 14:16:21 -05:00
helpers	test: lift coverage from 85.84% → 86.28%	2026-05-08 17:44:18 -05:00
integration	Merge remote-tracking branch 'origin/main' into feature/preseem-integration	2026-02-13 09:11:45 -06:00
live	fix: API token access control, admin form crash, MIB validation, CSP dedup	2026-05-12 09:08:57 -05:00
plugs	fix: 11 critical security/correctness bugs from code audit	2026-05-12 10:20:52 -05:00
changelog_parser_test.exs	remove-gleam (#218)	2026-03-29 11:03:20 -05:00
graphql_socket_test.exs	add mobile token auth to GraphQL endpoint (#48)	2026-03-16 15:23:07 -05:00
permissions_test.exs	fix snmp v3 test	2026-02-06 10:21:54 -06:00
plug_exceptions_test.exs	handle exceptions gracefully on api endpoints	2026-02-04 12:18:14 -06:00
remote_ip_test.exs	dialyzer: replace suppressions with real fixes where possible	2026-04-21 11:01:30 -05:00
telemetry_filter_test.exs	Add GeoIP import HTTP tests	2026-03-10 16:02:49 -05:00
telemetry_test.exs	feat(llm): per-insight-type prompt hints + flake fixes	2026-05-09 17:36:07 -05:00
user_auth_test.exs	perf(tests): remove/reduce Process.sleep calls for faster tests	2026-03-06 07:57:30 -06:00