poslop

poslop created pull request poslop/palette#87

2026-09-09 15:54:16 +00:00

fix #84: security headers were silently dropped (set pre-handler)

poslop opened issue poslop/palette#86

2026-09-09 15:40:46 +00:00

[pentest2] Unbounded title/language fields accepted and stored (50 KB title, arbitrary language strings)

poslop opened issue poslop/palette#83

2026-09-09 15:40:30 +00:00

[pentest2] public:false is ignored — pastes silently become fully public and listed in the public feed

poslop opened issue poslop/palette#84

2026-09-09 15:40:30 +00:00

[pentest2] Missing security headers on HTML pages (no CSP, no X-Frame-Options, no X-Content-Type-Options, no Referrer-Policy)

poslop opened issue poslop/palette#85

2026-09-09 15:40:30 +00:00

[pentest2] Create rate limit is keyed on spoofable X-Forwarded-For

poslop opened issue poslop/palette#81

2026-09-09 15:40:04 +00:00

[pentest2] Password-protected pastes: unauthenticated password guessing via GET query params bypasses rate limiting

poslop opened issue poslop/palette#82

2026-09-09 15:40:04 +00:00

[pentest2] burn_after_reads is never enforced: paste content remains readable indefinitely

poslop commented on issue poslop/palette#67

2026-09-09 15:18:44 +00:00

[pentest] Missing security headers and no HSTS; HTTP->HTTPS redirect reflects arbitrary Host header

Fully remediated and live-verified 2026-09-09:

App security headers: merged via PR #76 (CSP, Referrer-Policy, nosniff on all HTML)
HSTS: Traefik entrypoint middleware `kube-system-hsts@kuberne…

poslop closed issue poslop/palette#67

2026-09-09 15:18:44 +00:00

[pentest] Missing security headers and no HSTS; HTTP->HTTPS redirect reflects arbitrary Host header

poslop opened issue poslop/palette#80

2026-09-09 14:42:59 +00:00

Blind pentest round 2 against v0.2.1 on k3s

poslop commented on issue poslop/palette#61

2026-09-09 14:42:59 +00:00

Blind pentest against dev build on k3s

Round 1 complete. All findings fixed and merged into v0.2.1 (deployed to prod + dev on k3s): #63 critical delete auth (live-verified 403 on dev), #58/#62 burn race, #65 listing leak, #66 admin…

poslop closed issue poslop/palette#61

2026-09-09 14:42:59 +00:00

Blind pentest against dev build on k3s

poslop commented on issue poslop/palette#39

2026-09-09 14:42:59 +00:00

FUTURE: optional end-to-end encryption for pastes/files

Design phase complete: #75 merged (docs/design/). Implementation remains open.

poslop commented on issue poslop/palette#38

2026-09-09 14:42:59 +00:00

FUTURE: file/image attachments storage backend (S3?)

Design phase complete: #69 merged (docs/design/). Implementation remains open.

poslop commented on issue poslop/palette#31

2026-09-09 14:42:59 +00:00

FUTURE: storage backend choice (SQLite/Postgres/Redis)

Design phase complete: #69 merged (docs/design/). Implementation remains open.

poslop pushed tag v0.2.1 to poslop/palette

2026-09-09 14:31:53 +00:00

poslop commented on issue poslop/palette#65

2026-09-09 14:30:19 +00:00

[pentest] Password-protected and unlisted pastes are exposed in public listings /api/public

Landed via PR #71/#fix landed (merged to main).

poslop closed issue poslop/palette#65

2026-09-09 14:30:19 +00:00

[pentest] Password-protected and unlisted pastes are exposed in public listings /api/public

poslop commented on pull request poslop/palette#71

2026-09-09 14:29:53 +00:00

Exclude password-protected pastes from public listings (#65)

Fix content (f6c4342: password_hash IS NULL filter on ListPublic + regression test) is verified present on main. Merging the PR via the API kept returning "Please try again later" (server-side…

poslop closed pull request poslop/palette#71

2026-09-09 14:29:53 +00:00

Exclude password-protected pastes from public listings (#65)