Hartmut/CapaKraken
1
0
Fork 0
Code Issues 10 Pull Requests 1 Actions Packages Projects Releases Wiki Activity
Pulse Contributors Code Frequency Recent Commits

2026-02-15 - 2026-05-15
Period: 3 months
1 day 3 days 1 week 1 month 3 months 6 months 1 year

Overview

2 Active Pull Requests
58 Active Issues
1
Merged Pull Request 1
Proposed Pull Request 48
Closed Issues 58
New Issues
Excluding merges, 1 author has pushed 678 commits to main and 779 commits to all branches. On main, 2028 files have changed and there have been 465324 additions and 187380 deletions.

1 Release published by 1 user

Published pre-rename-backup 2026-03-27 12:36:47 +01:00

1 Pull request merged by 1 user

Merged #59 security: bound Zod inputs, add SSE per-user cap and tRPC body limit (#51) 2026-04-18 13:53:28 +02:00

1 Pull request proposed by 1 user

Proposed #60 security: reject common/weak passwords on every set-password path (#31) 2026-04-18 14:03:14 +02:00

48 Issues closed from 1 user

Closed #51 Security [MEDIUM]: Systematic Zod .max() audit — 202 unbounded z.string() sites 2026-04-18 13:53:28 +02:00

Closed #54 Security [MEDIUM]: Dispo workbook path unvalidated + image upload polyglot risk 2026-04-17 15:27:07 +02:00

Closed #55 Security [MEDIUM]: Audit log fire-and-forget drops entries on DB load + no prompt-input audit 2026-04-17 15:07:02 +02:00

Closed #56 Security [MEDIUM]: Password-policy client/server divergence + weak secret-entropy check 2026-04-17 14:57:17 +02:00

Closed #50 Security [HIGH]: Docker + Compose — hardcoded dev password, env-var secrets, placeholder secrets baked in prod image 2026-04-17 14:51:17 +02:00

Closed #57 Security [MEDIUM]: RBAC permissions cache 60 s — revocation propagates slowly across instances 2026-04-17 13:01:39 +02:00

Closed #53 Security [MEDIUM]: AI-tool error messages leak Prisma schema details to LLM 2026-04-17 09:40:18 +02:00

Closed #52 Security [MEDIUM]: Blueprint validator uses native RegExp — admin-set pattern enables ReDoS 2026-04-17 09:33:58 +02:00

Closed #58 Security [MEDIUM]: Dependency CVEs — upgrade dompurify, vite/esbuild, brace-expansion 2026-04-17 09:30:58 +02:00

Closed #46 Security [HIGH]: Pino logger has no redact paths — passwords/tokens logged cleartext 2026-04-17 09:29:43 +02:00

Closed #43 Security [HIGH]: MFA TOTP replay-race + missing backup codes 2026-04-17 09:29:25 +02:00

Closed #49 Security [HIGH]: SSRF guard misses IPv6 private ranges + webhook dispatcher lacks DNS-rebind protection 2026-04-17 09:29:06 +02:00

Closed #48 Security [HIGH]: Resource.dynamicFields JSONB merge accepts attacker-controlled keys + unbounded metadata 2026-04-17 09:29:05 +02:00

Closed #42 Security [HIGH]: E2E_TEST_MODE bypass must fail-fast in production 2026-04-17 09:29:04 +02:00

Closed #45 Security [HIGH]: CSP wildcards (*.openai.com, *.azure.com), unsafe-inline styles, SVG routes skip CSP 2026-04-17 09:29:04 +02:00

Closed #44 Security [HIGH]: API middleware default-allows /api/* — new routes inherit public access 2026-04-17 09:29:04 +02:00

Closed #41 Security [HIGH]: Session/Cookie hardening — Secure flag, concurrent-session enforcement, JTI exposure 2026-04-17 09:29:03 +02:00

Closed #40 Security [HIGH]: Login timing attack enables user-email enumeration 2026-04-17 09:29:03 +02:00

Closed #36 Security [CRITICAL]: Unbounded password inputs enable Argon2 DoS 2026-04-17 09:29:02 +02:00

Closed #37 Security [CRITICAL]: Rate-limiter only keys by email — IP-based brute-force and targeted lockout possible 2026-04-17 09:29:02 +02:00

Closed #39 Security [HIGH]: Prompt-injection guard trivially bypassable (regex-only, no Unicode normalization) 2026-04-17 09:29:02 +02:00

Closed #47 Security [HIGH]: Read-only proxy bypass via tRPC callers + missing $transaction/$queryRaw blocks 2026-04-17 09:28:15 +02:00

Closed #38 Security [HIGH]: Assistant chat message content unbounded — AI cost/memory DoS 2026-04-17 09:25:56 +02:00

Closed #27 CDP 35948515: HTML5 2026-04-16 10:07:35 +02:00

Closed #33 CDP 35948520/Checkliste HTML5: 19 Web App Security Checks 2026-04-16 10:07:35 +02:00

Closed #35 CDP 35948520/Checkliste ReactJs: 8 Web App Security Checks 2026-04-16 10:07:34 +02:00

Closed #26 CDP 35948517: ReactJs 2026-04-16 10:07:34 +02:00

Closed #30 CDP 35948516: NodeJS 2026-04-16 10:07:33 +02:00

Closed #34 CDP 35948520/Checkliste Node.js: 4 Web App Security Checks 2026-04-16 10:07:33 +02:00

Closed #29 CDP 35948518: Cloud 2026-04-16 10:07:33 +02:00

Closed #32 CDP 35948520/Checkliste Cloud: 7 Web App Security Checks 2026-04-16 10:06:38 +02:00

Closed #19 CDP 35948466: Enable Logging (app) 2026-04-16 10:02:27 +02:00

Closed #15 CDP 35948454: Maintain System Administrator Log (app) 2026-04-16 10:02:27 +02:00

Closed #14 CDP 35948458: Require Multi-Factor Authentication 2026-04-16 10:02:26 +02:00

Closed #12 CDP 35948470: Segregation of Duty Access (app) 2026-04-16 10:02:26 +02:00

Closed #13 CDP 35948455: Provide Role Related Access (app) 2026-04-16 10:02:26 +02:00

Closed #9 CDP 35948452: Confirm Uniqueness of IDs and Passwords (app/AI) 2026-04-16 10:02:25 +02:00

Closed #2 CDP 35948467: Application ID (app/AI) 2026-04-16 10:02:25 +02:00

Closed #5 CDP 35948474: Environment Access (app) 2026-04-16 10:02:25 +02:00

Closed #4 CDP 35948462: Confirm Business Continuity contractual requirements (app/AI) 2026-04-16 08:18:44 +02:00

Closed #23 CDP 35948460: Firefighter ID Password Change (app) 2026-04-16 08:16:51 +02:00

Closed #22 CDP 35948461: Business Need Approval (app) 2026-04-16 08:16:50 +02:00

Closed #21 CDP 35948453: Firefighter Activity Logging (app) 2026-04-16 08:16:50 +02:00

Closed #20 CDP 35948463: Mobilize subcontracting entities in CDP plan (app/AI) 2026-04-16 08:16:49 +02:00

Closed #18 CDP 35948465: Establish Firefighter ID Activation Procedure (app) 2026-04-16 08:16:48 +02:00

Closed #16 CDP 35948456: Require Reputable Courier for Third Party Transport (app/AI) 2026-04-16 08:16:47 +02:00

Closed #11 CDP 35948457: Encrypt Transmission of Client Data via Mobile (app/AI) 2026-04-16 08:16:46 +02:00

Closed #8 CDP 35948459: Log Chain of Custody (app/AI) 2026-04-16 08:16:45 +02:00

58 Issues created by 1 user

Opened #3 CDP 35948468: Provide Written Notification (app) 2026-04-16 08:16:44 +02:00

Opened #2 CDP 35948467: Application ID (app/AI) 2026-04-16 08:16:44 +02:00

Opened #1 CDP Compliance Epic — alle Controls 2026-04-16 08:16:44 +02:00

Opened #4 CDP 35948462: Confirm Business Continuity contractual requirements (app/AI) 2026-04-16 08:16:44 +02:00

Opened #7 CDP 35948472: Maintain current application inventory (dev) 2026-04-16 08:16:45 +02:00

Opened #5 CDP 35948474: Environment Access (app) 2026-04-16 08:16:45 +02:00

Opened #8 CDP 35948459: Log Chain of Custody (app/AI) 2026-04-16 08:16:45 +02:00

Opened #11 CDP 35948457: Encrypt Transmission of Client Data via Mobile (app/AI) 2026-04-16 08:16:45 +02:00

Opened #9 CDP 35948452: Confirm Uniqueness of IDs and Passwords (app/AI) 2026-04-16 08:16:45 +02:00

Opened #10 CDP 35948471: Deliver project specific CDP training (app/AI) 2026-04-16 08:16:45 +02:00

Opened #6 CDP 35948473: Implement Patching Process (app/AI) 2026-04-16 08:16:45 +02:00

Opened #12 CDP 35948470: Segregation of Duty Access (app) 2026-04-16 08:16:46 +02:00

Opened #13 CDP 35948455: Provide Role Related Access (app) 2026-04-16 08:16:46 +02:00

Opened #15 CDP 35948454: Maintain System Administrator Log (app) 2026-04-16 08:16:46 +02:00

Opened #14 CDP 35948458: Require Multi-Factor Authentication 2026-04-16 08:16:46 +02:00

Opened #16 CDP 35948456: Require Reputable Courier for Third Party Transport (app/AI) 2026-04-16 08:16:47 +02:00

Opened #17 CDP 35948464: General 2026-04-16 08:16:47 +02:00

Opened #20 CDP 35948463: Mobilize subcontracting entities in CDP plan (app/AI) 2026-04-16 08:16:48 +02:00

Opened #19 CDP 35948466: Enable Logging (app) 2026-04-16 08:16:48 +02:00

Opened #18 CDP 35948465: Establish Firefighter ID Activation Procedure (app) 2026-04-16 08:16:48 +02:00

Opened #21 CDP 35948453: Firefighter Activity Logging (app) 2026-04-16 08:16:49 +02:00

Opened #22 CDP 35948461: Business Need Approval (app) 2026-04-16 08:16:50 +02:00

Opened #24 CDP 35948469: Designate SPOC for Sharing Information (app/AI) 2026-04-16 08:16:51 +02:00

Opened #23 CDP 35948460: Firefighter ID Password Change (app) 2026-04-16 08:16:51 +02:00

Opened #25 CDP 35948520: Web Application 2026-04-16 08:16:52 +02:00

Opened #26 CDP 35948517: ReactJs 2026-04-16 08:16:52 +02:00

Opened #29 CDP 35948518: Cloud 2026-04-16 08:16:52 +02:00

Opened #28 CDP 35948519: Utilize a Secure DevOps environment supporting code scanning services 2026-04-16 08:16:52 +02:00

Opened #27 CDP 35948515: HTML5 2026-04-16 08:16:52 +02:00

Opened #30 CDP 35948516: NodeJS 2026-04-16 08:16:53 +02:00

Opened #31 CDP 35948520/Checkliste General: 35 Web App Security Checks 2026-04-16 09:56:08 +02:00

Opened #35 CDP 35948520/Checkliste ReactJs: 8 Web App Security Checks 2026-04-16 09:56:09 +02:00

Opened #34 CDP 35948520/Checkliste Node.js: 4 Web App Security Checks 2026-04-16 09:56:09 +02:00

Opened #32 CDP 35948520/Checkliste Cloud: 7 Web App Security Checks 2026-04-16 09:56:09 +02:00

Opened #33 CDP 35948520/Checkliste HTML5: 19 Web App Security Checks 2026-04-16 09:56:09 +02:00

Opened #38 Security [HIGH]: Assistant chat message content unbounded — AI cost/memory DoS 2026-04-16 22:05:08 +02:00

Opened #40 Security [HIGH]: Login timing attack enables user-email enumeration 2026-04-16 22:05:08 +02:00

Opened #37 Security [CRITICAL]: Rate-limiter only keys by email — IP-based brute-force and targeted lockout possible 2026-04-16 22:05:08 +02:00

Opened #36 Security [CRITICAL]: Unbounded password inputs enable Argon2 DoS 2026-04-16 22:05:08 +02:00

Opened #39 Security [HIGH]: Prompt-injection guard trivially bypassable (regex-only, no Unicode normalization) 2026-04-16 22:05:08 +02:00

Opened #44 Security [HIGH]: API middleware default-allows /api/* — new routes inherit public access 2026-04-16 22:05:09 +02:00

Opened #42 Security [HIGH]: E2E_TEST_MODE bypass must fail-fast in production 2026-04-16 22:05:09 +02:00

Opened #41 Security [HIGH]: Session/Cookie hardening — Secure flag, concurrent-session enforcement, JTI exposure 2026-04-16 22:05:09 +02:00

Opened #43 Security [HIGH]: MFA TOTP replay-race + missing backup codes 2026-04-16 22:05:09 +02:00

Opened #45 Security [HIGH]: CSP wildcards (*.openai.com, *.azure.com), unsafe-inline styles, SVG routes skip CSP 2026-04-16 22:05:10 +02:00

Opened #46 Security [HIGH]: Pino logger has no redact paths — passwords/tokens logged cleartext 2026-04-16 22:05:10 +02:00

Opened #47 Security [HIGH]: Read-only proxy bypass via tRPC callers + missing $transaction/$queryRaw blocks 2026-04-16 22:05:10 +02:00

Opened #49 Security [HIGH]: SSRF guard misses IPv6 private ranges + webhook dispatcher lacks DNS-rebind protection 2026-04-16 22:05:11 +02:00

Opened #50 Security [HIGH]: Docker + Compose — hardcoded dev password, env-var secrets, placeholder secrets baked in prod image 2026-04-16 22:05:11 +02:00

Opened #53 Security [MEDIUM]: AI-tool error messages leak Prisma schema details to LLM 2026-04-16 22:05:11 +02:00

Opened #51 Security [MEDIUM]: Systematic Zod .max() audit — 202 unbounded z.string() sites 2026-04-16 22:05:11 +02:00

Opened #48 Security [HIGH]: Resource.dynamicFields JSONB merge accepts attacker-controlled keys + unbounded metadata 2026-04-16 22:05:11 +02:00

Opened #52 Security [MEDIUM]: Blueprint validator uses native RegExp — admin-set pattern enables ReDoS 2026-04-16 22:05:11 +02:00

Opened #55 Security [MEDIUM]: Audit log fire-and-forget drops entries on DB load + no prompt-input audit 2026-04-16 22:05:12 +02:00

Opened #56 Security [MEDIUM]: Password-policy client/server divergence + weak secret-entropy check 2026-04-16 22:05:12 +02:00

Opened #54 Security [MEDIUM]: Dispo workbook path unvalidated + image upload polyglot risk 2026-04-16 22:05:12 +02:00

Opened #57 Security [MEDIUM]: RBAC permissions cache 60 s — revocation propagates slowly across instances 2026-04-16 22:05:12 +02:00

Opened #58 Security [MEDIUM]: Dependency CVEs — upgrade dompurify, vite/esbuild, brace-expansion 2026-04-16 22:05:12 +02:00