Adversarial black-box pentest of the running dev deployment. Tester gets NO source access and NO knowledge of prior findings or fixes. Attack surface is the live HTTP service only.
Scope: anything reachable over HTTP(S): input validation, auth bypass, injection, XSS, path handling, races, rate-limit evasion, info disclosure. Live-verify every finding with a repro.
Adversarial black-box pentest of the running dev deployment. Tester gets NO source access and NO knowledge of prior findings or fixes. Attack surface is the live HTTP service only.
Target: palette on goyplex-vm k3s (namespace palette, ClusterIP 10.43.175.20:80, host palette.archfox.org).
Scope: anything reachable over HTTP(S): input validation, auth bypass, injection, XSS, path handling, races, rate-limit evasion, info disclosure. Live-verify every finding with a repro.
Report: severity, finding, repro, impact. File followup issues for confirmed bugs.
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
Adversarial black-box pentest of the running dev deployment. Tester gets NO source access and NO knowledge of prior findings or fixes. Attack surface is the live HTTP service only.
Target: palette on goyplex-vm k3s (namespace palette, ClusterIP 10.43.175.20:80, host palette.archfox.org).
Scope: anything reachable over HTTP(S): input validation, auth bypass, injection, XSS, path handling, races, rate-limit evasion, info disclosure. Live-verify every finding with a repro.
Report: severity, finding, repro, impact. File followup issues for confirmed bugs.
Round 1 complete. All findings fixed and merged into v0.2.1 (deployed to prod + dev on k3s): #63 critical delete auth (live-verified 403 on dev), #58/#62 burn race, #65 listing leak, #66 admin ratelimit, #67 app-side headers (via #76; Traefik-side HSTS/host-redirect tracked separately in #67), #68 validation. Round 2 verification pentest tracked in the new issue.