Charon

Author	SHA1	Message	Date
akanealw	eec8c28fb3	changed perms Some checks failed Go Benchmark / Performance Regression Check (push) Has been cancelled Details Cerberus Integration / Cerberus Security Stack Integration (push) Has been cancelled Details Upload Coverage to Codecov / Backend Codecov Upload (push) Has been cancelled Details Upload Coverage to Codecov / Frontend Codecov Upload (push) Has been cancelled Details CodeQL - Analyze / CodeQL analysis (go) (push) Has been cancelled Details CodeQL - Analyze / CodeQL analysis (javascript-typescript) (push) Has been cancelled Details CrowdSec Integration / CrowdSec Bouncer Integration (push) Has been cancelled Details Docker Build, Publish & Test / build-and-push (push) Has been cancelled Details Quality Checks / Auth Route Protection Contract (push) Has been cancelled Details Quality Checks / Codecov Trigger/Comment Parity Guard (push) Has been cancelled Details Quality Checks / Backend (Go) (push) Has been cancelled Details Quality Checks / Frontend (React) (push) Has been cancelled Details Rate Limit integration / Rate Limiting Integration (push) Has been cancelled Details Security Scan (PR) / Trivy Binary Scan (push) Has been cancelled Details Supply Chain Verification (PR) / Verify Supply Chain (push) Has been cancelled Details WAF integration / Coraza WAF Integration (push) Has been cancelled Details Docker Build, Publish & Test / Security Scan PR Image (push) Has been cancelled Details Repo Health Check / Repo health (push) Has been cancelled Details History Rewrite Dry-Run / Dry-run preview for history rewrite (push) Has been cancelled Details Prune Renovate Branches / prune (push) Has been cancelled Details Renovate / renovate (push) Has been cancelled Details Nightly Build & Package / sync-development-to-nightly (push) Has been cancelled Details Nightly Build & Package / Trigger Nightly Validation Workflows (push) Has been cancelled Details Nightly Build & Package / build-and-push-nightly (push) Has been cancelled Details Nightly Build & Package / test-nightly-image (push) Has been cancelled Details Nightly Build & Package / verify-nightly-supply-chain (push) Has been cancelled Details	2026-04-22 18:19:14 +00:00
GitHub Actions	4adcd9eda1	feat: add nightly branch workflow	2026-01-13 22:11:35 +00:00
GitHub Actions	e0f69cdfc8	feat(security): comprehensive SSRF protection implementation BREAKING CHANGE: UpdateService.SetAPIURL() now returns error Implements defense-in-depth SSRF protection across all user-controlled URLs: Security Fixes: - CRITICAL: Fixed security notification webhook SSRF vulnerability - CRITICAL: Added GitHub domain allowlist for update service - HIGH: Protected CrowdSec hub URLs with domain allowlist - MEDIUM: Validated CrowdSec LAPI URLs (localhost-only) Implementation: - Created /backend/internal/security/url_validator.go (90.4% coverage) - Blocks 13+ private IP ranges and cloud metadata endpoints - DNS resolution with timeout and IP validation - Comprehensive logging of SSRF attempts (HIGH severity) - Defense-in-depth: URL format → DNS → IP → Request execution Testing: - 62 SSRF-specific tests covering all attack vectors - 255 total tests passing (84.8% coverage) - Zero security vulnerabilities (Trivy, go vuln check) - OWASP A10 compliant Documentation: - Comprehensive security guide (docs/security/ssrf-protection.md) - Manual test plan (30 test cases) - Updated API docs, README, SECURITY.md, CHANGELOG Security Impact: - Pre-fix: CVSS 8.6 (HIGH) - Exploitable SSRF - Post-fix: CVSS 0.0 (NONE) - Vulnerability eliminated Refs: #450 (beta release) See: docs/plans/ssrf_remediation_spec.md for full specification	2025-12-23 15:09:22 +00:00

3 Commits