Commits

c56140e

Handle concurrent project key prefix conflicts

2026-07-12T19:56:37+00:00

Anton Barinov <55404783+Anton-Barinov@users.noreply.github.com>

Files: 8 | core 0 | module 0 | forbidden 0

Flags:

de92a41

Speed up compact activity feeds

2026-07-12T19:53:45+00:00

Anton Barinov <55404783+Anton-Barinov@users.noreply.github.com>

Files: 8 | core 0 | module 0 | forbidden 0

Flags:

d3a4817

update

2026-07-12T19:47:58+00:00

Anton Barinov <55404783+Anton-Barinov@users.noreply.github.com>

Files: 2 | core 0 | module 0 | forbidden 0

Flags:

e581e53

Use CRM confirm modal for cycle actions

2026-07-12T19:47:54+00:00

Anton Barinov <55404783+Anton-Barinov@users.noreply.github.com>

Files: 4 | core 0 | module 0 | forbidden 0

Flags:

c532e1f

update

2026-07-12T19:45:32+00:00

Anton Barinov <55404783+Anton-Barinov@users.noreply.github.com>

Files: 2 | core 0 | module 0 | forbidden 0

Flags:

14db117

Use CRM feedback instead of cycle alerts

2026-07-12T19:45:28+00:00

Anton Barinov <55404783+Anton-Barinov@users.noreply.github.com>

Files: 2 | core 0 | module 0 | forbidden 0

Flags:

e65e226

update

2026-07-12T19:42:01+00:00

Anton Barinov <55404783+Anton-Barinov@users.noreply.github.com>

Files: 2 | core 0 | module 0 | forbidden 0

Flags:

342d97e

Avoid duplicate login error details

2026-07-12T19:41:56+00:00

Anton Barinov <55404783+Anton-Barinov@users.noreply.github.com>

Files: 2 | core 0 | module 0 | forbidden 0

Flags:

ffc908c

update

2026-07-12T19:38:41+00:00

Anton Barinov <55404783+Anton-Barinov@users.noreply.github.com>

Files: 2 | core 0 | module 0 | forbidden 0

Flags:

bb60306

Prevent client prompt role escalation

2026-07-12T19:38:37+00:00

Anton Barinov <55404783+Anton-Barinov@users.noreply.github.com>

Files: 4 | core 0 | module 0 | forbidden 0

Flags:

8caadef

test: add comprehensive API CRUD test suite (208/210 pass)

2026-07-12T19:35:37+00:00

Anton Barinov <55404783+Anton-Barinov@users.noreply.github.com>

Files: 4 | core 0 | module 0 | forbidden 0

Flags:

16f4303

docs: final audit verified - 84/84 list endpoints, 22 CRUD entities pass

2026-07-12T19:22:40+00:00

Anton Barinov <55404783+Anton-Barinov@users.noreply.github.com>

Files: 4 | core 0 | module 0 | forbidden 0

Flags:

801280a

Deploy: trigger deployment

2026-07-12T19:11:16+00:00

Anton Barinov <55404783+Anton-Barinov@users.noreply.github.com>

Files: 2 | core 0 | module 0 | forbidden 0

Flags:

77483e9

Block composer.json direct access via web/.htaccess; update SECURITY-FIXES.md status

2026-07-12T19:11:16+00:00

Anton Barinov <55404783+Anton-Barinov@users.noreply.github.com>

Files: 6 | core 0 | module 0 | forbidden 0

Flags:

b6614b9

docs: final audit - 88/88 list endpoints pass, all CRUD cycles verified

2026-07-12T18:59:50+00:00

Anton Barinov <55404783+Anton-Barinov@users.noreply.github.com>

Files: 2 | core 0 | module 0 | forbidden 0

Flags:

112f8a1

Deploy: trigger deployment

2026-07-12T18:55:43+00:00

Anton Barinov <55404783+Anton-Barinov@users.noreply.github.com>

Files: 2 | core 0 | module 0 | forbidden 0

Flags:

d35513e

Delete composer.json.dist from api/ directory (unused reference file); add defence-in-depth blocking for .json.dist and storage_api/secrets/ in api/index.php

2026-07-12T18:55:43+00:00

Anton Barinov <55404783+Anton-Barinov@users.noreply.github.com>

Files: 8 | core 0 | module 0 | forbidden 0

Flags:

ada3f61

Deploy: trigger deployment

2026-07-12T18:43:22+00:00

Anton Barinov <55404783+Anton-Barinov@users.noreply.github.com>

Files: 2 | core 0 | module 0 | forbidden 0

Flags:

b885fdd

Replace innerHTML with safe DOM methods in work-cycle loading; add prompt injection detection logging in MCP controller

2026-07-12T18:43:22+00:00

Anton Barinov <55404783+Anton-Barinov@users.noreply.github.com>

Files: 8 | core 0 | module 0 | forbidden 0

Flags:

cc0f1a2

docs: update api.md with final audit findings - 6 bugs fixed, all endpoints verified

2026-07-12T18:26:03+00:00

Anton Barinov <55404783+Anton-Barinov@users.noreply.github.com>

Files: 4 | core 0 | module 0 | forbidden 0

Flags:

3a0ab88

Deploy: trigger deployment

2026-07-12T18:24:04+00:00

Anton Barinov <55404783+Anton-Barinov@users.noreply.github.com>

Files: 2 | core 0 | module 0 | forbidden 0

Flags:

aaa5e5a

Move composer.json to project root to fix nginx access; add RBAC permissions to sticky notes, notifications and reminders routes; remove source_sha from public version endpoint; add upload rate limit config; add Secure cookie flag for installer sessions

2026-07-12T18:24:04+00:00

Anton Barinov <55404783+Anton-Barinov@users.noreply.github.com>

Files: 16 | core 0 | module 0 | forbidden 0

Flags:

5b5a115

fix: reorder webhook deliveries route before {public_id}, remove 2 duplicate routes

2026-07-12T18:15:58+00:00

Anton Barinov <55404783+Anton-Barinov@users.noreply.github.com>

Files: 6 | core 0 | module 0 | forbidden 0

Flags:

25c6281

Deploy: trigger deployment

2026-07-12T18:11:55+00:00

Anton Barinov <55404783+Anton-Barinov@users.noreply.github.com>

Files: 2 | core 0 | module 0 | forbidden 0

Flags:

11a8698

Fix installer error messages (no path leak, atomic lock file); add RBAC permissions to estimate endpoints; limit bulk operations to 100 items; block .env access in web .htaccess; add device fingerprint verification for session token theft detection

2026-07-12T18:11:54+00:00

Anton Barinov <55404783+Anton-Barinov@users.noreply.github.com>

Files: 16 | core 0 | module 0 | forbidden 0

Flags:

3c61244

fix: add GET /api/v1/webhooks/{public_id} route and controller method

2026-07-12T08:39:02+00:00

Anton Barinov <55404783+Anton-Barinov@users.noreply.github.com>

Files: 10 | core 0 | module 0 | forbidden 0

Flags:

09f14c9

Deploy: trigger deployment

2026-07-12T08:25:50+00:00

Anton Barinov <55404783+Anton-Barinov@users.noreply.github.com>

Files: 2 | core 0 | module 0 | forbidden 0

Flags:

8d934d4

Fix installer error messages to not leak DB credentials; generate random bootstrap secret; unify password validation in PasswordResetService; harden CSP (remove unsafe-eval, enforce frame-ancestors none); block composer.json direct access

2026-07-12T08:25:50+00:00

Anton Barinov <55404783+Anton-Barinov@users.noreply.github.com>

Files: 6 | core 0 | module 0 | forbidden 0

Flags:

a9abfec

docs: update api.md with audit findings - field names, required params, test results

2026-07-12T08:22:04+00:00

Anton Barinov <55404783+Anton-Barinov@users.noreply.github.com>

Files: 8 | core 0 | module 0 | forbidden 0

Flags:

d1b6f5c

Deploy: trigger deployment

2026-07-12T08:12:04+00:00

Anton Barinov <55404783+Anton-Barinov@users.noreply.github.com>

Files: 2 | core 0 | module 0 | forbidden 0

Flags:

7ed4b53

Clear SECURITY-FIXES.md: all 17 findings from previous cycle verified fixed and deployed

2026-07-12T08:12:04+00:00

Anton Barinov <55404783+Anton-Barinov@users.noreply.github.com>

Files: 2 | core 0 | module 0 | forbidden 0

Flags:

44d536e

Deploy: trigger deployment

2026-07-12T08:01:11+00:00

Anton Barinov <55404783+Anton-Barinov@users.noreply.github.com>

Files: 2 | core 0 | module 0 | forbidden 0

Flags:

145e450

Block __sys and __usr keys in AiActionService to prevent prompt injection bypass

2026-07-12T08:01:11+00:00

Anton Barinov <55404783+Anton-Barinov@users.noreply.github.com>

Files: 2 | core 0 | module 0 | forbidden 0

Flags:

c8b269f

fix: comment create returns created comment data instead of empty array

2026-07-12T07:58:53+00:00

Anton Barinov <55404783+Anton-Barinov@users.noreply.github.com>

Files: 8 | core 0 | module 0 | forbidden 0

Flags:

5bbc301

Clear SECURITY-FIXES.md for new analysis cycle

2026-07-12T07:53:13+00:00

Anton Barinov <55404783+Anton-Barinov@users.noreply.github.com>

Files: 2 | core 0 | module 0 | forbidden 0

Flags:

6178681

Deploy: trigger deployment

2026-07-12T07:46:51+00:00

Anton Barinov <55404783+Anton-Barinov@users.noreply.github.com>

Files: 2 | core 0 | module 0 | forbidden 0

Flags:

f9c1599

Consolidate rate limiting into unified RateLimitService: AuthService, PasswordResetService, InvitationService, BaseController

2026-07-12T07:46:51+00:00

Anton Barinov <55404783+Anton-Barinov@users.noreply.github.com>

Files: 14 | core 0 | module 0 | forbidden 0

Flags:

3f6bd67

Deploy: trigger deployment

2026-07-12T07:40:34+00:00

Anton Barinov <55404783+Anton-Barinov@users.noreply.github.com>

Files: 2 | core 0 | module 0 | forbidden 0

Flags:

1e4d5df

Mark nginx findings as unfixable from PHP, provide config

2026-07-12T07:40:33+00:00

Anton Barinov <55404783+Anton-Barinov@users.noreply.github.com>

Files: 2 | core 0 | module 0 | forbidden 0

Flags:

85f2f76

Deploy: trigger deployment

2026-07-12T07:36:00+00:00

Anton Barinov <55404783+Anton-Barinov@users.noreply.github.com>

Files: 2 | core 0 | module 0 | forbidden 0

Flags:

6023717

Mark nginx findings as unfixable from PHP level, provide config

2026-07-12T07:36:00+00:00

Anton Barinov <55404783+Anton-Barinov@users.noreply.github.com>

Files: 2 | core 0 | module 0 | forbidden 0

Flags:

6d5d7df

Clear SECURITY-FIXES.md for fresh analysis cycle

2026-07-12T07:34:52+00:00

Anton Barinov <55404783+Anton-Barinov@users.noreply.github.com>

Files: 2 | core 0 | module 0 | forbidden 0

Flags:

2e6ab8c

Merge security-fixes into main

2026-07-12T07:24:32+00:00

Anton Barinov <55404783+Anton-Barinov@users.noreply.github.com>

Files: 0 | core 0 | module 0 | forbidden 0

Flags:

f0f79c1

Clear SECURITY-FIXES.md for fresh analysis cycle

2026-07-12T07:23:13+00:00

Anton Barinov <55404783+Anton-Barinov@users.noreply.github.com>

Files: 2 | core 0 | module 0 | forbidden 0

Flags:

e8ee070

Deploy security fixes: trigger deployment

2026-07-12T07:21:11+00:00

Anton Barinov <55404783+Anton-Barinov@users.noreply.github.com>

Files: 2 | core 0 | module 0 | forbidden 0

Flags:

692900f

Security hardening: random dev secrets, input validation in critical controllers, session regeneration in installer, rate limit storage path

2026-07-12T07:20:51+00:00

Anton Barinov <55404783+Anton-Barinov@users.noreply.github.com>

Files: 12 | core 0 | module 0 | forbidden 0

Flags:

b31f0cf

fix: add missing SessionRepository arg to UserService container + fix milestone ORDER BY expression

2026-07-12T07:13:05+00:00

Anton Barinov <55404783+Anton-Barinov@users.noreply.github.com>

Files: 6 | core 0 | module 0 | forbidden 0

Flags:

531af83

Clear SECURITY-FIXES.md for fresh analysis

2026-07-12T07:12:24+00:00

Anton Barinov <55404783+Anton-Barinov@users.noreply.github.com>

Files: 2 | core 0 | module 0 | forbidden 0

Flags:

aa5b741

Deploy: trigger deployment

2026-07-12T07:10:54+00:00

Anton Barinov <55404783+Anton-Barinov@users.noreply.github.com>

Files: 2 | core 0 | module 0 | forbidden 0

Flags:

42e3891

Security hardening: replace md5 with sha256 for rate limit and cache keys, add validatedInput helper, remove duplicate MCP tool, reduce retention periods

2026-07-12T07:10:34+00:00

Anton Barinov <55404783+Anton-Barinov@users.noreply.github.com>

Files: 58 | core 0 | module 0 | forbidden 0

Flags: