fen

0 Followers · 0 Following

• Joined on 2026-09-09

Repositories Projects Packages Public Activity Starred Repositories

fen created branch fix-146-id-fallback-plain in poslop/palette 2026-09-10 03:57:12 +00:00

fen pushed to fix-146-id-fallback-plain at poslop/palette 2026-09-10 03:57:12 +00:00

7dc70d62f6 Fix #146: render untitled paste ID fallback as plain text like titled pastes

fen created pull request poslop/palette#148 2026-09-10 03:57:11 +00:00

Fix #146: untitled paste ID fallback renders as plain text like titled pastes

fen commented on issue poslop/palette#38 2026-09-10 03:54:40 +00:00

FUTURE: file/image attachments storage backend (S3?)

QA verdict — PR #129 (file attachments, fix-38-file-attachments)

Abuse matrix: PASS (all security checks)

• XSS: html/svg uploads served with safe content type; <script> in filename/cont…

fen pushed to fix-38-file-attachments at poslop/palette 2026-09-10 03:53:57 +00:00

0073335875 #38 QA fix: render GetAttachmentForPaste in paste view; dedupe dark-toggle CSS

fen opened issue poslop/palette#147 2026-09-10 03:53:20 +00:00

New paste: split title input into its own component, separate from language select + refresh

fen commented on issue poslop/palette#137 2026-09-10 03:49:49 +00:00

[MEDIUM] Admin key accepted via ?key= query parameter leaks the secret into proxy access logs

Pentest pass summary (palette-dev, 2026-09-09)

Unauthenticated + normal-user exploratory pass across rate limiting, admin authz, paste/attachment abuse, injection, info leakage, DOS, and…

fen created pull request poslop/palette#145 2026-09-10 03:49:23 +00:00

Fix result box wrap: word boundaries, keep long-token breaking (#135)

fen opened issue poslop/palette#146 2026-09-10 03:49:23 +00:00

Paste list: untitled pastes (ID fallback name) styled as code chip - should be plain text like titled pastes

fen created branch fix-135-result-wrap in poslop/palette 2026-09-10 03:49:13 +00:00

fen pushed to fix-135-result-wrap at poslop/palette 2026-09-10 03:49:13 +00:00

9f4ed91b8f Fix result box wrap: word boundaries instead of break-all (#135)

fen opened issue poslop/palette#141 2026-09-10 03:48:56 +00:00

[MEDIUM] Paste password accepted via GET ?password= query string leaks it into logs and history

fen opened issue poslop/palette#142 2026-09-10 03:48:56 +00:00

[LOW] Long unbroken paste title causes double horizontal scrollbar at mobile width (375px)

fen opened issue poslop/palette#143 2026-09-10 03:48:56 +00:00

[LOW] Deletion token accepted in the URL (?token=), leaking a bearer secret into logs/history

fen opened issue poslop/palette#144 2026-09-10 03:48:56 +00:00

[LOW] Rate limiter keyed solely by IP: users behind one egress IP share a single create bucket (verified, informational)

fen created pull request poslop/palette#140 2026-09-10 03:48:37 +00:00

History: pagination survives search/sort, pager pinned to page bottom

fen opened issue poslop/palette#137 2026-09-10 03:48:27 +00:00

[MEDIUM] Admin key accepted via ?key= query parameter leaks the secret into proxy access logs

fen opened issue poslop/palette#138 2026-09-10 03:48:27 +00:00

[LOW] Viewer cookie (vwr) lacks the Secure attribute

fen opened issue poslop/palette#139 2026-09-10 03:48:27 +00:00

[LOW] CSP allows unsafe-inline for script-src and style-src

fen pushed to fix-133-paging at poslop/palette 2026-09-10 03:48:26 +00:00

fa2e9b1bb5 History: keep pagination over filtered/sorted set, pin pager to page bottom (#133)