Egress guard merged — PR #137 (529b462). The HttpCallback SSRF pivot is closed: deny-internal-by-default SsrfEgressPolicy enforced at connect time (blocks private/loopback/link-local/metad…
Both halves complete — closing.
Final publishers merged to master:
- ✅ PR #135 (
376272c) — ScheduledTask + ClusterEvent publishers (+ self-healing channel fix) - ✅ PR #136 (
de8be87)…
PR #137 up — implements the recommended egress guard as a secure-by-default, with the PR as the decision point (same pattern as the CORS fail-closed change).
SsrfEgressPolicyin…
Final publisher shipped: PR #136 (GameEventPublisher) — and the a/b/c latency question I'd held it for turned out to be moot: every RabbitMQ publish in that class is persistence-bound…
Publisher-confirms progress:
- ✅ PR #132 (canonical
RabbitMqMessageBusPublisher) — merged784ae28 - ✅ PR #133 (
NotificationEventPublisher+RabbitMqSystemEventPublisher) — merged…
Batch 2 up: PR #133 — NotificationEventPublisher + RabbitMqSystemEventPublisher now create their channel with confirms + tracking (2 tests).
Remaining publisher paths: `RabbitMqClusterEve…
Publisher-confirms — first path shipped: PR #132 (canonical RabbitMqMessageBusPublisher). Channel now created with confirms + tracking; BasicPublishAsync awaits the broker ack and an…
Resolved in spikersoft-backend PR #131 (merged to master as 67a7ac9). The raw confirmation token is no longer written to the log; regression test asserts the token value never reaches the log…
GameBoardHub gated — PR #128 merged (402be55). All six hubs from the audit are now addressed: CodeExecutionHub / ChatHub / DashboardHub / ClusterHub / GameBoardHub carry class-level…
Mode-#2 (deep-clone snapshot) is complete — final two batches merged to master:
- PR #124 (
f4adad0) — FundraiserItem / SolicitationZone / AreaRecommendation / Chapter. - PR #125…
Resolved in spikersoft-backend PR #130 (merged to master as 389f570). Pre-registration verification codes now use SecureNumericCode (CSPRNG via RandomNumberGenerator) in both Initiate +…
Resolved in spikersoft-backend PR #129 (merged to master as e4ed404). CORS now fails closed when Origins is unconfigured (refuses cross-origin + logs CRITICAL) instead of reflecting any…
Resolved in spikersoft-backend PR #127 (merged to master as 7364964). PathSafety.CombineContained now contains the blog-media move to /app/blogs (rejects ../ traversal + absolute-path…
Resolved in spikersoft-backend PR #126 (merged to master as b5bb73d). MongoRegexSearch.LiteralContains now Regex.Escapes user search input at all 5 sites (GetAllLessons + UserSubmittedCode)…