Joseph Spiker spikerj
0 Followers · 0 Following
  • Joined on 2025-11-03
Repositories
2
 Projects Packages Public Activity Starred Repositories
spikerj opened issue spikerj/spikersoft-issues#441 2026-07-06 07:22:08 +00:00
[Security][low] Bearer confirmation token logged in plaintext (OrganizationsController:118) — only such site
spikerj opened issue spikerj/spikersoft-issues#440 2026-07-06 07:11:26 +00:00
[Security][Go-live] Pre-registration email verification codes generated with System.Random (predictable)
spikerj opened issue spikerj/spikersoft-issues#439 2026-07-06 07:06:57 +00:00
[Security][Go-live] CORS fails OPEN when Origins unconfigured — reflects any origin with credentials
spikerj commented on issue spikerj/spikersoft-issues#401 2026-07-06 06:58:08 +00:00
[Security][CRITICAL] SignalR hubs missing class-level [Authorize] — CodeExecutionHub / DashboardHub / ClusterHub open to anonymous connections

Verified current state on master — 5 of 6 hubs now resolved; 1 hub + 1 decision left

Re-audited every flagged hub directly against origin/master:

spikerj opened issue spikerj/spikersoft-issues#438 2026-07-06 06:46:02 +00:00
[Security][Decision] SSRF: HttpCallback scheduled task fetches an unrestricted payload-supplied URL (admin/staff-gated)
spikerj opened issue spikerj/spikersoft-issues#437 2026-07-06 06:41:19 +00:00
[Security][Hardening] Contain path traversal: identity/upload-derived path segments in blog-media move
spikerj opened issue spikerj/spikersoft-issues#436 2026-07-06 06:34:07 +00:00
[Security][Go-live] Unescaped user input used as Mongo regex → ReDoS / regex-injection (incl. anonymous lesson search)
spikerj commented on issue spikerj/spikersoft-issues#410 2026-07-06 06:23:59 +00:00
[Reliability][Go-live] Fix silent data loss — count-only ValueComparer & missing publisher confirms

Batch 2 up — PR #124 (FundraiserItem, SolicitationZone, AreaRecommendation, Chapter).

Mode-#2 is now effectively complete for the collections that matter

Across #118 (blog) +…

spikerj closed issue spikerj/spikersoft-issues#420 2026-07-06 06:16:30 +00:00
[i18n] 94 devTools keys missing Spanish (commonCommandsHelper command catalog)
spikerj commented on issue spikerj/spikersoft-issues#410 2026-07-06 06:16:30 +00:00
[Reliability][Go-live] Fix silent data loss — count-only ValueComparer & missing publisher confirms

Batch 1 merged — PR #123. Deep-snapshot (mode #2) now live for the profile/application in-place-edited entities: EmergencyContact (×2), EmploymentEntry, EducationEntry, AddressEntry,…

spikerj commented on issue spikerj/spikersoft-issues#415 2026-07-06 06:06:46 +00:00
[Security][Go-live] Add authorization FallbackPolicy; lock down anonymous-by-omission API endpoints

PRs #119, #120, #121 all merged to master (9d74b44). The anonymous-mutation surface is now closed in production:

  • #119 — CacheController (Redis flush/stats) → staff/admin
  • #120 —…
spikerj commented on issue spikerj/spikersoft-issues#411 2026-07-06 06:06:42 +00:00
[Reliability][Go-live] Eliminate availability bombs — Redis scans/flush, MongoClient-per-message, GPU ledger, poison requeue

PR #122 merged to master (9d74b44) — item 1 (full-cluster SCAN * on every cache miss) eliminated.

Epic status: item 1 ✅ (#122), item 2 ✅ (#111, MongoClient-per-message).…

spikerj commented on issue spikerj/spikersoft-issues#410 2026-07-06 06:06:41 +00:00
[Reliability][Go-live] Fix silent data loss — count-only ValueComparer & missing publisher confirms

PR #118 merged to master (9d74b44). Mode-#2 deep-clone snapshot now live for the 3 blog collections (BlogPost.Media/EmbeddedLinks/Comments) via JsonListValueComparer<T>.

Keeping this…

spikerj commented on issue spikerj/spikersoft-issues#410 2026-07-06 05:30:56 +00:00
[Reliability][Go-live] Fix silent data loss — count-only ValueComparer & missing publisher confirms

Deep-snapshot extension — scoped worklist (ready to execute once #118 merges)

Audited all 38 SetValueComparer sites on origin/master. Good news first: **the mode-#1 fix (#115) is…

spikerj commented on issue spikerj/spikersoft-issues#411 2026-07-06 05:20:06 +00:00
[Reliability][Go-live] Eliminate availability bombs — Redis scans/flush, MongoClient-per-message, GPU ledger, poison requeue

Item 4 (poison requeue) — audited both cited sites; findings differ from the ticket

KeycloakEventHostedService (cited 188-192) is already protected — not a bug. Its `HandleMessageFailu…

spikerj commented on issue spikerj/spikersoft-issues#415 2026-07-06 05:12:25 +00:00
[Security][Go-live] Add authorization FallbackPolicy; lock down anonymous-by-omission API endpoints

✅ Anonymous-mutation surface closed. PR #121 gates the 6 reference/lookup controllers (FuelTypes, GeneratorBrands, AddressTypes, PhoneTypes, States, Organizations) — **mutations…

spikerj commented on issue spikerj/spikersoft-issues#415 2026-07-06 05:06:07 +00:00
[Security][Go-live] Add authorization FallbackPolicy; lock down anonymous-by-omission API endpoints

Step 1 progress — PR #120 up. Locked the 6 unambiguous back-office controllers (Employees, ServiceCalls, ServiceCallReasons, Parts, Labors, Milages) with class-level [Authorize]…

spikerj commented on issue spikerj/spikersoft-issues#415 2026-07-06 05:00:27 +00:00
[Security][Go-live] Add authorization FallbackPolicy; lock down anonymous-by-omission API endpoints

Anonymous-surface inventory (the FallbackPolicy impact set)

Built the prerequisite for safely enabling a FallbackPolicy — a static analysis of all 73 API controllers classifying every…

spikerj closed issue spikerj/spikersoft-issues#433 2026-07-06 04:51:18 +00:00
[Reliability] MongoDB_HealthCheck constructs a new MongoClient on every invocation (connection-pool leak)
spikerj commented on issue spikerj/spikersoft-issues#410 2026-07-06 04:42:18 +00:00
[Reliability][Go-live] Fix silent data loss — count-only ValueComparer & missing publisher confirms

Audited the second half of this ticket — "missing publisher confirms". Confirmed: it's a real silent-loss gap, but a platform-wide behavior change, so flagging with a ready fix rather than…