8b5665b

fix(security): address 19 audit findings (pass #2) — C-2 (module signing + root gate + MCP), H-1..H-7 (RLS bypass, profile rates, cron scheduler, module web exposure, activity sanitize, rate-card policy), M-1..M-8 (grant cleanup, chat validation, project sanitize, rate-card tx/authz), L-1/4/6/8 (knowledge visibility, email exposure, fail-closed observer, earnings permission)

2026-08-24T05:55:14+00:00

Anton Barinov <55404783+Anton-Barinov@users.noreply.github.com>

Files44

Core0

Module6

Forbidden0

Files

api/config/mcp_permissions.php (api)
api/controller/chat/ChatController.php (api)
api/controller/knowledge/KnowledgeController.php (api)
api/controller/mcp/McpController.php (api)
api/controller/module/ModuleController.php (api)
api/controller/rate/MyEarningsController.php (api)
api/controller/rate/RateCardController.php (api)
api/controller/user/UserController.php (api)
api/model/project/ProjectRepository.php (api)
api/model/task/TaskRepository.php (api)
api/system/library/app.php (api)
api/system/library/module/ModuleCronScheduler.php (api)
api/system/library/module/ModuleRemoteInstaller.php (api)
api/system/library/service/ExternalUserService.php (api)
api/system/library/service/ProjectService.php (api)
api/system/library/service/TaskActivityService.php (api)
api/system/library/service/TaskService.php (api)
api/system/library/service/UserProfileService.php (api)
api/system/library/service/UserService.php (api)
modules/.htaccess (module)
modules/crm.confluence-migration/api/scripts/register_cron.php (module)
modules/crm.confluence-migration/api/scripts/run_worker.php (module)
api/config/mcp_permissions.php (api)
api/controller/chat/ChatController.php (api)
api/controller/knowledge/KnowledgeController.php (api)
api/controller/mcp/McpController.php (api)
api/controller/module/ModuleController.php (api)
api/controller/rate/MyEarningsController.php (api)
api/controller/rate/RateCardController.php (api)
api/controller/user/UserController.php (api)
api/model/project/ProjectRepository.php (api)
api/model/task/TaskRepository.php (api)
api/system/library/app.php (api)
api/system/library/module/ModuleCronScheduler.php (api)
api/system/library/module/ModuleRemoteInstaller.php (api)
api/system/library/service/ExternalUserService.php (api)
api/system/library/service/ProjectService.php (api)
api/system/library/service/TaskActivityService.php (api)
api/system/library/service/TaskService.php (api)
api/system/library/service/UserProfileService.php (api)
api/system/library/service/UserService.php (api)
modules/.htaccess (module)
modules/crm.confluence-migration/api/scripts/register_cron.php (module)
modules/crm.confluence-migration/api/scripts/run_worker.php (module)