• Joined on 2025-08-22
zemion opened issue GovOPlaN/govoplan-core#243 2026-07-11 12:51:12 +02:00
[Security] Fix audit report capture and duplicate-scan noise
zemion closed issue GovOPlaN/govoplan-core#243 2026-07-11 12:51:12 +02:00
[Security] Fix audit report capture and duplicate-scan noise
zemion commented on issue GovOPlaN/govoplan-core#243 2026-07-11 12:51:12 +02:00
[Security] Fix audit report capture and duplicate-scan noise

Codex state update: Implemented locally: Xenon output is now captured with stderr, and jscpd ignores VCS/generated/build/report artifacts. Verified with `bash -n scripts/check-security-audit.sh…

zemion opened issue GovOPlaN/govoplan-core#242 2026-07-11 12:51:10 +02:00
[Security] Review dynamic module import trust boundary
zemion opened issue GovOPlaN/govoplan-core#241 2026-07-11 12:51:08 +02:00
[Supply-chain] Pin Gitea workflow actions to immutable revisions
zemion opened issue GovOPlaN/govoplan-core#240 2026-07-11 12:51:06 +02:00
[Security] Review dynamic SQL text findings and add safe identifier helpers
zemion opened issue GovOPlaN/govoplan-core#239 2026-07-11 12:51:04 +02:00
[Security] Centralize outbound URL policy for core fetches and health checks
zemion opened issue GovOPlaN/govoplan-core#238 2026-07-11 12:51:03 +02:00
[Security] Harden release-doctor shell command execution
zemion opened issue GovOPlaN/govoplan-core#237 2026-07-11 12:51:01 +02:00
[Security] Harden installer shell hook execution and command trust boundary
zemion closed issue GovOPlaN/govoplan-core#236 2026-07-11 12:11:48 +02:00
[Security] Broaden audit/config secret redaction key matching
zemion commented on issue GovOPlaN/govoplan-core#235 2026-07-11 12:11:48 +02:00
[Security] Reject wildcard CORS with credentials at runtime

Closing per user request; this issue is covered by the local changes ready to push.

Fixed locally: credentialed CORS startup rejects wildcard origins and requires explicit origins.

zemion closed issue GovOPlaN/govoplan-core#235 2026-07-11 12:11:48 +02:00
[Security] Reject wildcard CORS with credentials at runtime
zemion commented on issue GovOPlaN/govoplan-core#236 2026-07-11 12:11:48 +02:00
[Security] Broaden audit/config secret redaction key matching

Closing per user request; this issue is covered by the local changes ready to push.

Fixed locally: audit/config redaction detects compound secret keys and configuration safety rejects nested…

zemion closed issue GovOPlaN/govoplan-core#233 2026-07-11 12:11:47 +02:00
[Security] Redact installer run-record secrets
zemion closed issue GovOPlaN/govoplan-core#234 2026-07-11 12:11:47 +02:00
[Security] Stop persisting UI API keys in localStorage
zemion commented on issue GovOPlaN/govoplan-core#234 2026-07-11 12:11:47 +02:00
[Security] Stop persisting UI API keys in localStorage

Closing per user request; this issue is covered by the local changes ready to push.

Fixed locally: fallback UI API keys are no longer persisted in localStorage; newly entered keys are held in…

zemion commented on issue GovOPlaN/govoplan-core#233 2026-07-11 12:11:47 +02:00
[Security] Redact installer run-record secrets

Closing per user request; this issue is covered by the local changes ready to push.

Fixed locally: installer run-record database credentials are redacted and raw URLs are kept in a private…

zemion commented on issue GovOPlaN/govoplan-core#234 2026-07-11 11:51:06 +02:00
[Security] Stop persisting UI API keys in localStorage

Codex state update: implemented locally in /mnt/DATA/git/govoplan-core.

Summary:

  • The browser fallback automation API key is no longer saved to localStorage.
  • Newly entered fallback keys…
zemion commented on issue GovOPlaN/govoplan-core#236 2026-07-11 11:49:41 +02:00
[Security] Broaden audit/config secret redaction key matching

Codex state update: implemented locally in /mnt/DATA/git/govoplan-core.

Summary:

  • Added shared structured secret redaction for audit details and configuration control output.
  • Compound/camel/k…
zemion commented on issue GovOPlaN/govoplan-core#235 2026-07-11 11:49:41 +02:00
[Security] Reject wildcard CORS with credentials at runtime

Codex state update: implemented locally in /mnt/DATA/git/govoplan-core.

Summary:

  • Runtime startup now rejects * in GOVOPLAN_CORS_ALLOW_ORIGINS while credentialed CORS is enabled.
  • Added a…