poslop

poslop opened issue poslop/palette#63

2026-09-09 14:10:09 +00:00

[pentest] DELETE /api/pastes/{id} performs deletion without any authentication or deletion token

poslop opened issue poslop/palette#64

2026-09-09 14:10:09 +00:00

[pentest] Burn-after-read counter race: single-read paste can be fetched multiple times concurrently

poslop opened issue poslop/palette#65

2026-09-09 14:10:09 +00:00

[pentest] Password-protected and unlisted pastes are exposed in public listings /api/public

poslop opened issue poslop/palette#62

2026-09-09 14:09:35 +00:00

[pentest] Burn-after-read counter race: single-read paste can be fetched multiple times concurrently

poslop commented on issue poslop/palette#34

2026-09-09 13:57:35 +00:00

Security pentest sweep

Findings split into followup issues: #58 (burn race, MED), #59 (security headers, MED), #60 (expires_in clamp, LOW). Both CRITICALs fixed in cb23707 and deployed in v0.2.0. Non-exploitable items…

poslop closed issue poslop/palette#34

2026-09-09 13:57:35 +00:00

Security pentest sweep

poslop opened issue poslop/palette#58

2026-09-09 13:57:25 +00:00

Security: fix burn-after-read race (atomic conditional delete)

poslop opened issue poslop/palette#59

2026-09-09 13:57:25 +00:00

Security: add security headers middleware (CSP, X-Frame-Options, Referrer-Policy)

poslop opened issue poslop/palette#60

2026-09-09 13:57:25 +00:00

Security: clamp expires_in at API boundary (reject zero/negative, cap 1yr)

poslop opened issue poslop/palette#61

2026-09-09 13:57:25 +00:00

Blind pentest against dev build on k3s

poslop commented on issue poslop/palette#35

2026-09-09 07:18:45 +00:00

Refactor: project structure cleanup

k3s deployment complete (palette namespace on goyplex-vm): Deployment v0.2.0 image, PVC 5Gi, Service, IngressRoute palette.archfox.org (letsencrypt-dns). Pull secret palette-regcred. Verified: pod…

poslop pushed tag v0.2.0 to poslop/palette

2026-09-09 07:04:06 +00:00

poslop pushed to main at poslop/palette

2026-09-09 07:04:05 +00:00

03bf327f6b fix: anchor gitignore binary pattern, track cmd/palette

poslop pushed to main at poslop/palette

2026-09-09 07:02:58 +00:00

a604c5906a fix: track cmd/palette (was untracked after refactor), untrack committed binary

poslop pushed tag v0.2.0 to poslop/palette

2026-09-09 07:02:58 +00:00

poslop pushed to main at poslop/palette

2026-09-09 06:53:33 +00:00

2c1b2818a8 CI: use static docker CLI download (no apt package in bookworm)

poslop pushed tag v0.2.0 to poslop/palette

2026-09-09 06:53:33 +00:00

poslop pushed to main at poslop/palette

2026-09-09 06:45:53 +00:00

b1187e061f CI: install docker CLI in docker job (debian image lacks it)

poslop pushed tag v0.2.0 to poslop/palette

2026-09-09 06:45:53 +00:00

poslop pushed tag v0.2.0 to poslop/palette

2026-09-09 06:36:00 +00:00