 Jeppe B
|
3e970d9cb9
|
Seed subuser session cache in API fixtures
|
2026-06-02 02:29:52 +02:00 |
|
|
Jeppe B
|
8c10c07cc9
|
Resolve Caddy replication bootstrap conflict
|
2026-06-02 02:25:29 +02:00 |
|
|
Jeppe B
|
18a8513b40
|
Use namespaced subuser object in API fixtures
|
2026-06-02 02:21:53 +02:00 |
|
|
Jeppe B
|
4c77b78c6c
|
Keep self-serve invoice billing customer authoritative
|
2026-06-02 02:15:27 +02:00 |
|
|
Jeppe B
|
bb249da477
|
Align API tests with hardened auth and department access
|
2026-06-02 02:09:14 +02:00 |
|
|
Jeppe B
|
eb16a4e6ce
|
Fix collected invoice queue count expectations
|
2026-06-02 02:00:35 +02:00 |
|
|
Jeppe B
|
a2e525fa9e
|
Update unit expectations for hardened flows
|
2026-06-02 01:53:58 +02:00 |
|
|
Jeppe B
|
0bf19c9d33
|
Restrict indexed department filters to scoped entities
|
2026-06-02 01:34:21 +02:00 |
|
|
Jeppe B
|
5850bfbce7
|
Keep autoload cache validation test compatible
|
2026-06-02 01:16:20 +02:00 |
|
|
Jeppe B
|
fd51a5b119
|
Fix search table argument ordering
|
2026-06-02 01:07:45 +02:00 |
|
|
Jeppe B
|
140365c8bb
|
Resolve PHP merge conflict test failures
|
2026-06-02 00:58:15 +02:00 |
|
|
Jeppe B
|
c9ceac8533
|
Merge pull request #267 from copenhagentruckwash/fix-permission-checks-for-subuser-endpoints
Require SUBUSERS_LIST permission for GET /subusers to enforce RBAC
|
2026-06-02 00:42:48 +02:00 |
|
|
Jeppe B
|
72ec62d042
|
Merge pull request #259 from copenhagentruckwash/fix-redis-autoload-cache-vulnerability
Harden Redis-backed autoloader against poisoned path inclusion
|
2026-06-02 00:37:33 +02:00 |
|
|
Jeppe B
|
21f5e6d9cf
|
Enforce permission check on subuser list endpoint
|
2026-06-02 00:35:48 +02:00 |
|
|
Jeppe B
|
73b91ccec9
|
Merge pull request #265 from copenhagentruckwash/fix-unauthenticated-bird-voice-webhook
Reinstate authorization check for Bird inbound voice webhook
|
2026-06-02 00:33:43 +02:00 |
|
|
Jeppe B
|
0c809a19da
|
Merge pull request #257 from copenhagentruckwash/propose-fix-for-redis-image-cache-vulnerability
Limit Redis dynamic image caching to default variant only
|
2026-06-02 00:33:27 +02:00 |
|
|
Jeppe B
|
3a6685c345
|
Merge pull request #255 from copenhagentruckwash/fix-system-search-authorization-bypass
Enforce department scoping in system search for generic entities
|
2026-06-02 00:33:02 +02:00 |
|
|
Jeppe B
|
a60983f328
|
Merge pull request #266 from copenhagentruckwash/propose-fix-for-n8n-ssrf-vulnerability
Harden n8n webhook trigger URL validation against SSRF
|
2026-06-02 00:32:47 +02:00 |
|
|
Jeppe B
|
e2c2eb21cb
|
Harden n8n webhook trigger URL validation
|
2026-06-02 00:32:35 +02:00 |
|
|
Jeppe B
|
cc00fb2aed
|
Reinstate auth on Bird inbound voice webhook
|
2026-06-02 00:23:58 +02:00 |
|
|
Jeppe B
|
7f38cf2f7e
|
Merge pull request #264 from copenhagentruckwash/propose-fix-for-ssrf-in-workfeed-api
Restrict Workfeed API base URL to trusted hosts (prevent SSRF)
|
2026-06-02 00:22:35 +02:00 |
|
|
Jeppe B
|
d281dddbc1
|
Restrict Workfeed API base URL
|
2026-06-02 00:22:18 +02:00 |
|
|
Jeppe B
|
267ec1bed1
|
Merge pull request #263 from copenhagentruckwash/fix-machine-relay-set-endpoint-vulnerability
Guard machine relay set status
|
2026-06-02 00:21:49 +02:00 |
|
|
Jeppe B
|
a96f40cf13
|
Guard machine relay set status
|
2026-06-02 00:21:32 +02:00 |
|
|
Jeppe B
|
d6190626ce
|
Merge pull request #262 from copenhagentruckwash/fix-cross-tenant-job-data-exposure
Scope economic transfer queue jobs by creator
|
2026-06-02 00:20:48 +02:00 |
|
|
Jeppe B
|
ce8e6d0dab
|
Scope economic transfer queue jobs by creator
|
2026-06-02 00:20:30 +02:00 |
|
|
Jeppe B
|
c13c2e2cab
|
Merge pull request #261 from copenhagentruckwash/fix-customer-data-leak-in-wash-endpoint
Restrict in-progress wash details by lane department
|
2026-06-02 00:20:07 +02:00 |
|
|
Jeppe B
|
7380bc729b
|
Restrict in-progress wash details by lane department
|
2026-06-02 00:19:55 +02:00 |
|
|
Jeppe B
|
434a5049e2
|
Merge pull request #260 from copenhagentruckwash/fix-unpinned-github-actions-vulnerability
Harden Qodana workflow permissions and pin checkout action
|
2026-06-02 00:17:44 +02:00 |
|
|
Jeppe B
|
eb66b343ea
|
Harden Qodana workflow permissions and checkout pin
|
2026-06-02 00:04:10 +02:00 |
|
|
Jeppe B
|
e363f27da9
|
Harden autoload Redis cache path validation
|
2026-06-02 00:02:40 +02:00 |
|
|
Jeppe B
|
fbad5f767f
|
Merge pull request #258 from copenhagentruckwash/fix-hardcoded-auth-tokens-in-configuration
Sanitize leaked auth tokens in HTTP test env
|
2026-06-02 00:02:06 +02:00 |
|
|
Jeppe B
|
94d9b347bf
|
Sanitize leaked auth tokens in HTTP test env
|
2026-06-02 00:01:57 +02:00 |
|
|
Jeppe B
|
76744fd6c3
|
Limit dynamic image Redis caching to default variant
|
2026-06-02 00:00:04 +02:00 |
|
|
Jeppe B
|
f5c1a34c29
|
Merge pull request #256 from copenhagentruckwash/fix-idor-vulnerability-in-economic-v2-endpoints
Prevent IDOR on Economic V2 collected-invoice endpoints
|
2026-06-01 23:58:41 +02:00 |
|
|
Jeppe B
|
22ad96bc8e
|
Fix economic v2 invoice endpoint authorization scope
|
2026-06-01 23:58:30 +02:00 |
|
|
Jeppe B
|
8a749cffa3
|
Fix system search department scoping for generic entities
|
2026-06-01 23:58:03 +02:00 |
|
|
Jeppe B
|
cf5cf8d5eb
|
Merge pull request #254 from copenhagentruckwash/fix-user-search-exposure-vulnerability
Restrict `users` system-search access to prevent PII leakage
|
2026-06-01 23:57:33 +02:00 |
|
|
Jeppe B
|
eb14b7039b
|
Restrict users system search permissions
|
2026-06-01 23:57:23 +02:00 |
|
|
Jeppe B
|
f09b1263c1
|
Merge pull request #253 from copenhagentruckwash/fix-stripe-payment-intent-reuse-issue
Validate Stripe payment intent amount before reuse
|
2026-06-01 23:54:32 +02:00 |
|
|
Jeppe B
|
9ec8499d55
|
Validate Stripe payment intent amount before reuse
|
2026-06-01 23:54:04 +02:00 |
|
|
Jeppe B
|
8d40cd6f9a
|
Merge pull request #252 from copenhagentruckwash/fix-complaint-endpoints-department-access-check
Require department access for department daily report complaint routes
|
2026-06-01 23:53:45 +02:00 |
|
|
Jeppe B
|
ccffad3c7c
|
Fix complaint department authorization
|
2026-06-01 23:53:36 +02:00 |
|
|
Jeppe B
|
4697c6b272
|
Merge pull request #251 from copenhagentruckwash/fix-subuser-management-permission-checks
Enforce own-scope subuser permissions for classic users in managed customer scope
|
2026-06-01 23:53:06 +02:00 |
|
|
Jeppe B
|
45e17e196c
|
Fix subuser management permission scope
|
2026-06-01 23:52:57 +02:00 |
|
|
Jeppe B
|
dcc81cbdc7
|
Merge pull request #250 from copenhagentruckwash/propose-fix-for-privilege-boundary-regression
Restrict studio simulation to config-version view and prevent auto-creating drafts
|
2026-06-01 23:52:28 +02:00 |
|
|
Jeppe B
|
c5cb0a3bfe
|
Fix studio simulation draft access
|
2026-06-01 23:52:18 +02:00 |
|
|
Jeppe B
|
465f3ed027
|
Merge pull request #249 from copenhagentruckwash/fix-edge-agent-vulnerability-for-unsigned-artifacts
Require checksums for edge agent updates
|
2026-06-01 23:50:05 +02:00 |
|
|
Jeppe B
|
80ff01f04e
|
Require checksums for edge agent updates
|
2026-06-01 23:49:56 +02:00 |
|
|
Jeppe B
|
f6e4d851d3
|
Merge pull request #248 from copenhagentruckwash/fix-authenticated-ssrf-in-broker-diagnostics
Prevent SSRF in broker diagnostics by ignoring caller URLs and redacting probe output
|
2026-06-01 23:49:24 +02:00 |
|
|
Jeppe B
|
cd4e3faea3
|
Fix broker diagnostics SSRF
|
2026-06-01 23:49:10 +02:00 |
|
|
Jeppe B
|
4cb9e68b33
|
Merge pull request #247 from copenhagentruckwash/fix-information-disclosure-in-websocket-upgrades
Sanitize websocket upgrade error responses
|
2026-06-01 23:47:09 +02:00 |
|
|
Jeppe B
|
0e7e79d205
|
Sanitize websocket upgrade errors
|
2026-06-01 23:46:59 +02:00 |
|
|
Jeppe B
|
a9ca7b41a7
|
Merge pull request #246 from copenhagentruckwash/fix-unbounded-relay-timer-vulnerability
Cap self-serve gate relay timers
|
2026-06-01 23:45:39 +02:00 |
|
|
Jeppe B
|
3b3ed31bb7
|
Cap self-serve gate relay timers
|
2026-06-01 23:45:20 +02:00 |
|
|
Jeppe B
|
cf9d5875ef
|
Merge pull request #242 from copenhagentruckwash/fix-vulnerability-with-self-hosted-runners
Run PR code quality workflow on GitHub-hosted runner
|
2026-06-01 23:44:29 +02:00 |
|
|
Jeppe B
|
4730eebdb4
|
Merge pull request #245 from copenhagentruckwash/fix-internal-ip-address-leakage
Stop exposing relay local IPs by default
|
2026-06-01 23:44:05 +02:00 |
|
|
Jeppe B
|
b25ce9cb11
|
Stop exposing relay local IPs by default
|
2026-06-01 23:43:53 +02:00 |
|
|
Jeppe B
|
fdb98f1399
|
Merge pull request #244 from copenhagentruckwash/fix-unauthenticated-relay-control-vulnerability
Require authorization for LAN worker relay endpoints
|
2026-06-01 23:43:34 +02:00 |
|
|
Jeppe B
|
1dc758a3a3
|
Require authorization for LAN worker relay endpoints
|
2026-06-01 23:43:23 +02:00 |
|
|
Jeppe B
|
032ce93d5e
|
Merge pull request #243 from copenhagentruckwash/fix-hardcoded-service-credentials-in-docker-config
Secure edge gateway service credentials
|
2026-06-01 23:42:47 +02:00 |
|
|
Jeppe B
|
f8ced3b8f2
|
Secure edge gateway service credentials
|
2026-06-01 23:42:34 +02:00 |
|
|
Jeppe B
|
9ea5a62577
|
Merge pull request #238 from copenhagentruckwash/fix-cache-only-lookup-for-invoice-flags
Normalize invoice-period cache keys and restore DB fallbacks for missing Redis entries
|
2026-06-01 23:41:26 +02:00 |
|
|
Jeppe B
|
af89a246db
|
Run PR code quality workflow on GitHub-hosted runner
|
2026-06-01 23:38:32 +02:00 |
|
|
Jeppe B
|
20c1973565
|
Merge pull request #241 from copenhagentruckwash/fix-telemetry-path-error-message-leak
Sanitize telemetry ingestion errors
|
2026-06-01 23:37:59 +02:00 |
|
|
Jeppe B
|
a2dda5ea5b
|
Sanitize telemetry ingestion errors
|
2026-06-01 23:37:48 +02:00 |
|
|
Jeppe B
|
ce29cf9ccb
|
Merge pull request #240 from copenhagentruckwash/propose-fix-for-ci-vulnerability
Secure Qodana pull request workflow
|
2026-06-01 23:36:53 +02:00 |
|
|
Jeppe B
|
e7481297c8
|
Secure Qodana PR workflow runner
|
2026-06-01 23:36:44 +02:00 |
|
|
Jeppe B
|
e3b38519fb
|
Merge pull request #239 from copenhagentruckwash/propose-fix-for-qodana-vulnerability
Skip Qodana when cloud token is missing
|
2026-06-01 23:31:34 +02:00 |
|
|
Jeppe B
|
d244c000c3
|
Skip Qodana when cloud token is missing
|
2026-06-01 23:31:24 +02:00 |
|
|
Jeppe B
|
dcd57c7092
|
Merge pull request #221 from copenhagentruckwash/fix-system-search-associations-vulnerability
Prevent association expansion from bypassing own-only access
|
2026-06-01 23:31:00 +02:00 |
|
|
Jeppe B
|
0a7e58fc01
|
Merge pull request #222 from copenhagentruckwash/fix-hardcoded-bearer-tokens-in-tests
Remove hardcoded API credentials and resolve merge conflict in test HTTP file
|
2026-06-01 23:29:28 +02:00 |
|
|
Jeppe B
|
bd7deaeded
|
Fix invoice period flag cache fallbacks
|
2026-06-01 23:29:05 +02:00 |
|
|
Jeppe B
|
07a3ef6418
|
Merge pull request #237 from copenhagentruckwash/fix-concurrent-access-vulnerability-in-start-command
Add per-lane START lock to prevent TOCTOU relay replay on wash start
|
2026-06-01 23:28:45 +02:00 |
|
|
Jeppe B
|
bffed6f5f3
|
Fix self-serve start relay race
|
2026-06-01 23:28:36 +02:00 |
|
|
Jeppe B
|
bfec31f94b
|
Merge pull request #236 from copenhagentruckwash/fix-task-attachment-link-vulnerability
Enforce lane department authorization for self-serve eligibility
|
2026-06-01 23:28:05 +02:00 |
|
|
Jeppe B
|
2123835aae
|
Fix self-serve eligibility lane authorization
|
2026-06-01 23:27:56 +02:00 |
|
|
Jeppe B
|
11f06e8f53
|
Merge pull request #235 from copenhagentruckwash/investigate-self-serve-path-projection-dos-vulnerability
Clamp self-serve path projection limits
|
2026-06-01 23:27:33 +02:00 |
|
|
Jeppe B
|
6712368323
|
Clamp self-serve path projection limits
|
2026-06-01 23:27:22 +02:00 |
|
|
Jeppe B
|
99fe659dbc
|
Merge pull request #234 from copenhagentruckwash/propose-fix-for-archived-department-vulnerability
Fix department archived filter smuggling
|
2026-06-01 23:27:06 +02:00 |
|
|
Jeppe B
|
357cfda46e
|
Fix department archived filter smuggling
|
2026-06-01 23:26:57 +02:00 |
|
|
Jeppe B
|
9c85135a07
|
Merge pull request #233 from copenhagentruckwash/fix-cross-tenant-vehicle-reference-leak
Restrict vehicle reference suggestions by department context
|
2026-06-01 23:26:36 +02:00 |
|
|
Jeppe B
|
a8a47104dd
|
Restrict vehicle reference suggestions by department context
|
2026-06-01 23:26:27 +02:00 |
|
|
Jeppe B
|
2c0907c486
|
Merge pull request #232 from copenhagentruckwash/fix-vulnerability-in-automatic-invoice-flags
Fix automatic invoice period flag suppression
|
2026-06-01 23:26:02 +02:00 |
|
|
Jeppe B
|
0ae28af309
|
Fix invoice period automatic flag cache misses
|
2026-06-01 23:25:54 +02:00 |
|
|
Jeppe B
|
4f9a10402b
|
Merge pull request #231 from copenhagentruckwash/fix-exposure-of-private-git-commit-metadata
Redact GitHub commit metadata from public release runtime
|
2026-06-01 23:25:38 +02:00 |
|
|
Jeppe B
|
5e8ec85943
|
Redact release GitHub metadata from public runtime
|
2026-06-01 23:25:28 +02:00 |
|
|
Jeppe B
|
20d6056e40
|
Merge pull request #230 from copenhagentruckwash/fix-permission-bypass-for-invoice-flags
Guard invoice period flags by list permission
|
2026-06-01 23:25:02 +02:00 |
|
|
Jeppe B
|
5be6bc0198
|
Guard invoice period flags by list permission
|
2026-06-01 23:24:50 +02:00 |
|
|
Jeppe B
|
373aa7effb
|
Merge pull request #227 from copenhagentruckwash/fix-minio-credentials-exposure-vulnerability
Deny web access to replication bootstrap snapshots
|
2026-06-01 23:24:26 +02:00 |
|
|
Jeppe B
|
5282ee10ba
|
Merge pull request #229 from copenhagentruckwash/propose-fix-for-booking-po-vulnerability
Validate booking ownership before defaulting order PO (prevent cross-tenant leak)
|
2026-06-01 23:24:00 +02:00 |
|
|
Jeppe B
|
eab8394579
|
Fix booking PO default tenant validation
|
2026-06-01 23:23:49 +02:00 |
|
|
Jeppe B
|
b88c2742e8
|
Merge pull request #228 from copenhagentruckwash/fix-partial-release-tests-bypassing-promotion-gate
Require app-scoped release gates for bundle promotion
|
2026-06-01 23:23:34 +02:00 |
|
|
Jeppe B
|
4ea5eeb942
|
Require app-scoped release gates for bundle promotion
|
2026-06-01 23:23:23 +02:00 |
|
|
Jeppe B
|
e41b226529
|
Deny web access to replication bootstrap snapshots
|
2026-06-01 23:19:04 +02:00 |
|
|
Jeppe B
|
7cb248a112
|
Merge pull request #226 from copenhagentruckwash/fix-ssrf-vulnerability-in-release-gate
Harden release gate diagnostics fetches
|
2026-06-01 23:17:01 +02:00 |
|
|
Jeppe B
|
dfa0441266
|
Harden release gate diagnostics fetches
|
2026-06-01 23:16:51 +02:00 |
|
|
Jeppe B
|
d9dbd7dede
|
Merge pull request #225 from copenhagentruckwash/propose-fix-for-coolify-deployment-vulnerability
Prevent Coolify image from embedding replication snapshots
|
2026-06-01 23:16:33 +02:00 |
|
|
Jeppe B
|
3b8463e37f
|
Prevent Coolify image from embedding replication snapshots
|
2026-06-01 23:16:22 +02:00 |
|
|
Jeppe B
|
0e8b527ee4
|
Merge pull request #224 from copenhagentruckwash/fix-qodana-scan-fail-open-issue
Run Qodana locally when cloud token is missing
|
2026-06-01 23:15:47 +02:00 |
|