Hartmut
0 Followers · 0 Following
  • Joined on 2026-04-12
Repositories
2
 Projects Packages Public Activity Starred Repositories
Hartmut opened issue Hartmut/Nexus#52 2026-04-16 22:05:11 +02:00
Security [MEDIUM]: Blueprint validator uses native RegExp — admin-set pattern enables ReDoS
Hartmut opened issue Hartmut/Nexus#53 2026-04-16 22:05:11 +02:00
Security [MEDIUM]: AI-tool error messages leak Prisma schema details to LLM
Hartmut opened issue Hartmut/Nexus#51 2026-04-16 22:05:11 +02:00
Security [MEDIUM]: Systematic Zod .max() audit — 202 unbounded z.string() sites
Hartmut opened issue Hartmut/Nexus#48 2026-04-16 22:05:11 +02:00
Security [HIGH]: Resource.dynamicFields JSONB merge accepts attacker-controlled keys + unbounded metadata
Hartmut opened issue Hartmut/Nexus#49 2026-04-16 22:05:11 +02:00
Security [HIGH]: SSRF guard misses IPv6 private ranges + webhook dispatcher lacks DNS-rebind protection
Hartmut opened issue Hartmut/Nexus#50 2026-04-16 22:05:11 +02:00
Security [HIGH]: Docker + Compose — hardcoded dev password, env-var secrets, placeholder secrets baked in prod image
Hartmut opened issue Hartmut/Nexus#47 2026-04-16 22:05:10 +02:00
Security [HIGH]: Read-only proxy bypass via tRPC callers + missing $transaction/$queryRaw blocks
Hartmut opened issue Hartmut/Nexus#46 2026-04-16 22:05:10 +02:00
Security [HIGH]: Pino logger has no redact paths — passwords/tokens logged cleartext
Hartmut opened issue Hartmut/Nexus#45 2026-04-16 22:05:10 +02:00
Security [HIGH]: CSP wildcards (*.openai.com, *.azure.com), unsafe-inline styles, SVG routes skip CSP
Hartmut opened issue Hartmut/Nexus#44 2026-04-16 22:05:09 +02:00
Security [HIGH]: API middleware default-allows /api/* — new routes inherit public access
Hartmut opened issue Hartmut/Nexus#43 2026-04-16 22:05:09 +02:00
Security [HIGH]: MFA TOTP replay-race + missing backup codes
Hartmut opened issue Hartmut/Nexus#41 2026-04-16 22:05:09 +02:00
Security [HIGH]: Session/Cookie hardening — Secure flag, concurrent-session enforcement, JTI exposure
Hartmut opened issue Hartmut/Nexus#42 2026-04-16 22:05:09 +02:00
Security [HIGH]: E2E_TEST_MODE bypass must fail-fast in production
Hartmut opened issue Hartmut/Nexus#38 2026-04-16 22:05:08 +02:00
Security [HIGH]: Assistant chat message content unbounded — AI cost/memory DoS
Hartmut opened issue Hartmut/Nexus#39 2026-04-16 22:05:08 +02:00
Security [HIGH]: Prompt-injection guard trivially bypassable (regex-only, no Unicode normalization)
Hartmut opened issue Hartmut/Nexus#36 2026-04-16 22:05:08 +02:00
Security [CRITICAL]: Unbounded password inputs enable Argon2 DoS
Hartmut opened issue Hartmut/Nexus#37 2026-04-16 22:05:08 +02:00
Security [CRITICAL]: Rate-limiter only keys by email — IP-based brute-force and targeted lockout possible
Hartmut opened issue Hartmut/Nexus#40 2026-04-16 22:05:08 +02:00
Security [HIGH]: Login timing attack enables user-email enumeration
Hartmut commented on issue Hartmut/Nexus#28 2026-04-16 10:20:07 +02:00
CDP 35948519: Utilize a Secure DevOps environment supporting code scanning services

Action Plan

CDP-Requirement: CI/CD-Pipeline muss SAST + DAST + SCA durchführen, Critical/High blocken.

Status — Coverage-Matrix

Hartmut commented on issue Hartmut/Nexus#24 2026-04-16 10:20:07 +02:00
CDP 35948469: Designate SPOC for Sharing Information (app/AI)

Action Plan

CDP-Requirement: Single Point of Contact für Outbound-Sharing von Projekt-Dokumenten/Daten designieren.

Designation

  • SPOC: h.noerenberg (Projekt-Owner, Repo-Owner,…