poslop

poslop created branch issue-65-listing-leak in poslop/palette

2026-09-09 14:13:28 +00:00

poslop pushed to issue-65-listing-leak at poslop/palette

2026-09-09 14:13:28 +00:00

f6c4342468 Exclude password-protected pastes from public listings (#65)

poslop created pull request poslop/palette#71

2026-09-09 14:13:26 +00:00

Exclude password-protected pastes from public listings (#65)

poslop created pull request poslop/palette#70

2026-09-09 14:13:25 +00:00

docs: cookie-based preferences and access keys design (#30)

poslop created branch issue-30-cookie-design in poslop/palette

2026-09-09 14:13:09 +00:00

poslop pushed to issue-30-cookie-design at poslop/palette

2026-09-09 14:13:09 +00:00

07950e27ac docs: design note for cookie-based preferences and access keys (#30)

4f8c5b0c63 fix: atomic burn-after-read claim (#58)

Compare 2 commits »

poslop created branch issue-58-burn-race in poslop/palette

2026-09-09 14:12:51 +00:00

poslop pushed to issue-58-burn-race at poslop/palette

2026-09-09 14:12:51 +00:00

poslop commented on issue poslop/palette#62

2026-09-09 14:11:22 +00:00

[pentest] Burn-after-read counter race: single-read paste can be fetched multiple times concurrently

Duplicate of #58 (burn-after-read race, found in the #34 sweep and already assigned to a fix branch). Keeping #58 as the tracking issue. The pentest repro confirms the MED finding from #34.

poslop closed issue poslop/palette#62

2026-09-09 14:11:22 +00:00

[pentest] Burn-after-read counter race: single-read paste can be fetched multiple times concurrently

poslop commented on issue poslop/palette#59

2026-09-09 14:11:22 +00:00

Security: add security headers middleware (CSP, X-Frame-Options, Referrer-Policy)

Pentest (#67) confirms the missing headers on this deployment. Note: the HSTS and Host-header-reflecting HTTP->HTTPS redirect parts of #67 are Traefik/infra-level, not app-level - handle those in…

poslop commented on issue poslop/palette#38

2026-09-09 14:10:29 +00:00

FUTURE: file/image attachments storage backend (S3?)

Design doc: poslop/palette#69 (docs/design/attachments-storage.md)

poslop commented on issue poslop/palette#31

2026-09-09 14:10:29 +00:00

FUTURE: storage backend choice (SQLite/Postgres/Redis)

Design doc: poslop/palette#69 (docs/design/attachments-storage.md)

poslop closed issue poslop/palette#64

2026-09-09 14:10:26 +00:00

[pentest] Burn-after-read counter race: single-read paste can be fetched multiple times concurrently

poslop created branch issue-38-31-storage-design in poslop/palette

2026-09-09 14:10:16 +00:00

poslop pushed to issue-38-31-storage-design at poslop/palette

2026-09-09 14:10:16 +00:00

594b5f01aa docs: attachments & storage backend design (#38, #31)

poslop created pull request poslop/palette#69

2026-09-09 14:10:15 +00:00

docs: attachments & storage backend design (#38, #31)

poslop opened issue poslop/palette#66

2026-09-09 14:10:09 +00:00

[pentest] Admin key endpoint has no rate limiting or lockout (offline brute force possible)

poslop opened issue poslop/palette#67

2026-09-09 14:10:09 +00:00

[pentest] Missing security headers and no HSTS; HTTP->HTTPS redirect reflects arbitrary Host header

poslop opened issue poslop/palette#68

2026-09-09 14:10:09 +00:00

[pentest] Input validation gaps: negative/huge content accepted, expires_at ignored, limit=0 ignored