poslop

poslop pushed tag v0.2.2 to poslop/palette

2026-09-09 16:00:00 +00:00

poslop commented on issue poslop/palette#86

2026-09-09 15:59:57 +00:00

[pentest2] Unbounded title/language fields accepted and stored (50 KB title, arbitrary language strings)

Fixed and merged to main (v0.2.2 pending release).

poslop commented on issue poslop/palette#85

2026-09-09 15:59:56 +00:00

[pentest2] Create rate limit is keyed on spoofable X-Forwarded-For

Fixed and merged to main (v0.2.2 pending release).

poslop commented on issue poslop/palette#84

2026-09-09 15:59:55 +00:00

[pentest2] Missing security headers on HTML pages (no CSP, no X-Frame-Options, no X-Content-Type-Options, no Referrer-Policy)

Fixed and merged to main (v0.2.2 pending release).

poslop commented on issue poslop/palette#83

2026-09-09 15:59:53 +00:00

[pentest2] public:false is ignored — pastes silently become fully public and listed in the public feed

Fixed and merged to main (v0.2.2 pending release).

poslop commented on issue poslop/palette#81

2026-09-09 15:59:47 +00:00

[pentest2] Password-protected pastes: unauthenticated password guessing via GET query params bypasses rate limiting

Fixed and merged to main (v0.2.2 pending release).

poslop pushed to main at poslop/palette

2026-09-09 15:59:33 +00:00

959a83be1e Merge pull request 'Bound title and language at create time (#86)' (#91) from fix-86-field-bounds into main

389e4d333f Bound title and language at create time (#86)

Compare 2 commits »

poslop closed issue poslop/palette#86

2026-09-09 15:59:32 +00:00

[pentest2] Unbounded title/language fields accepted and stored (50 KB title, arbitrary language strings)

poslop merged pull request poslop/palette#91

2026-09-09 15:59:32 +00:00

Bound title and language at create time (#86)

poslop pushed to main at poslop/palette

2026-09-09 15:59:30 +00:00

5b068faf8f Merge pull request 'ratelimit: rightmost untrusted-hop-safe client IP (fixes #85)' (#89) from fix-85-xff into main

3d1d5ee1fd ratelimit: key on rightmost X-Forwarded-For entry (fixes #85)

Compare 2 commits »

poslop closed issue poslop/palette#85

2026-09-09 15:59:29 +00:00

[pentest2] Create rate limit is keyed on spoofable X-Forwarded-For

poslop merged pull request poslop/palette#89

2026-09-09 15:59:29 +00:00

ratelimit: rightmost untrusted-hop-safe client IP (fixes #85)

poslop pushed to main at poslop/palette

2026-09-09 15:59:28 +00:00

b0360af79c Merge pull request 'Fix #83: create API ignores boolean public field' (#88) from fix-83-public-false into main

ccb22a2d28 #83: accept boolean public field in create API (false->unlisted, true->public)

Compare 2 commits »

poslop closed issue poslop/palette#83

2026-09-09 15:59:26 +00:00

[pentest2] public:false is ignored — pastes silently become fully public and listed in the public feed

poslop merged pull request poslop/palette#88

2026-09-09 15:59:26 +00:00

Fix #83: create API ignores boolean public field

poslop pushed to main at poslop/palette

2026-09-09 15:59:25 +00:00

806798fae6 Merge pull request 'Rate-limit all password verification attempts (#81)' (#90) from fix-81-password-ratelimit into main

99a044e8a2 Rate-limit all password verification attempts (#81)

Compare 2 commits »

poslop closed issue poslop/palette#81

2026-09-09 15:59:24 +00:00

[pentest2] Password-protected pastes: unauthenticated password guessing via GET query params bypasses rate limiting

poslop merged pull request poslop/palette#90

2026-09-09 15:59:24 +00:00

Rate-limit all password verification attempts (#81)

poslop pushed to main at poslop/palette

2026-09-09 15:59:22 +00:00

8977c05cda Merge pull request 'fix #84: security headers were silently dropped (set pre-handler)' (#87) from fix-84-headers-prewrite into main

3d415edbdc fix #84: security headers dropped because they were set post-flush; set pre-handler

Compare 2 commits »

poslop closed issue poslop/palette#84

2026-09-09 15:59:21 +00:00

[pentest2] Missing security headers on HTML pages (no CSP, no X-Frame-Options, no X-Content-Type-Options, no Referrer-Policy)