Joseph Spiker

spikerj opened issue spikerj/spikersoft-issues#694

2026-07-17 23:20:50 +00:00

[Security] GeneratorBrands write endpoints allow any authenticated user to modify CRM reference data (#689 follow-up)

spikerj closed issue spikerj/spikersoft-issues#692

2026-07-17 23:15:17 +00:00

[Security] Phone verification codes (OTP) written to logs at Information level

spikerj commented on issue spikerj/spikersoft-issues#692

2026-07-17 23:15:17 +00:00

[Security] Phone verification codes (OTP) written to logs at Information level

Resolved in spikersoft-backend PR #388 (merged to master). Removed the 6-digit OTP from both handlers' logs, including the webhook entry-point log (redacted via Is6DigitCode when an inbound SMS…

spikerj closed issue spikerj/spikersoft-issues#693

2026-07-17 23:14:10 +00:00

[Security] TwilioController outbound endpoints are unauthenticated — SMS/call/lookup abuse & cost

spikerj commented on issue spikerj/spikersoft-issues#693

2026-07-17 23:14:10 +00:00

[Security] TwilioController outbound endpoints are unauthenticated — SMS/call/lookup abuse & cost

Closing per maintainer guidance: the Twilio integration is implemented to spec — the outbound endpoints' access is controlled outside the controller code I reviewed (e.g. network/gateway…

spikerj opened issue spikerj/spikersoft-issues#693

2026-07-17 23:13:35 +00:00

[Security] TwilioController outbound endpoints are unauthenticated — SMS/call/lookup abuse & cost

spikerj commented on issue spikerj/spikersoft-issues#689

2026-07-17 23:09:50 +00:00

[Security] Gate the remaining Mark Wilson CRM controllers to staff/admin (#688 follow-up)

Resolved in spikersoft-backend PR #386 (merged to master). Gated the sibling CRM controllers (ServiceCalls/Labors/Parts/Milages/ServiceCallReasons) to `[Authorize(Roles = "Admin,admin,Staff,staff…

spikerj closed issue spikerj/spikersoft-issues#689

2026-07-17 23:09:50 +00:00

[Security] Gate the remaining Mark Wilson CRM controllers to staff/admin (#688 follow-up)

spikerj commented on issue spikerj/spikersoft-issues#691

2026-07-17 23:09:50 +00:00

[Security] Pre-registration email verification code is brute-forceable — attempts counted but never enforced

Resolved in spikersoft-backend PR #387 (merged to master). Enforced a 5-attempt cap on the 6-digit email verification code before validation (reset on resend); the code is no longer brute-forceab…

spikerj closed issue spikerj/spikersoft-issues#691

2026-07-17 23:09:50 +00:00

[Security] Pre-registration email verification code is brute-forceable — attempts counted but never enforced

spikerj opened issue spikerj/spikersoft-issues#692

2026-07-17 23:05:04 +00:00

[Security] Phone verification codes (OTP) written to logs at Information level

spikerj opened issue spikerj/spikersoft-issues#691

2026-07-17 23:00:05 +00:00

[Security] Pre-registration email verification code is brute-forceable — attempts counted but never enforced

spikerj opened issue spikerj/spikersoft-issues#690

2026-07-17 22:54:24 +00:00

[Security][Hardening] JWT validation deviates from secure defaults: RequireHttpsMetadata=false, ValidateIssuer=false

spikerj opened issue spikerj/spikersoft-issues#689

2026-07-17 22:42:10 +00:00

[Security] Gate the remaining Mark Wilson CRM controllers to staff/admin (#688 follow-up)

spikerj closed issue spikerj/spikersoft-issues#688

2026-07-17 22:40:03 +00:00

[Security] Broken access control: Mark Wilson customer-PII CRM is authenticated-only (no staff/admin role gate)

spikerj commented on issue spikerj/spikersoft-issues#688

2026-07-17 22:40:03 +00:00

[Security] Broken access control: Mark Wilson customer-PII CRM is authenticated-only (no staff/admin role gate)

Resolved in spikersoft-backend PR #385 (merged to master). Gated MarkWilsonsCustomerController to [Authorize(Roles = "Admin,admin,Staff,staff")] (the pattern 27 peer controllers use), so…

spikerj closed issue spikerj/spikersoft-issues#685

2026-07-17 22:39:31 +00:00

[Security] SSRF in InfoVault URL caching — user-supplied vault URL fetched server-side with no internal-address guard

spikerj commented on issue spikerj/spikersoft-issues#685

2026-07-17 22:39:31 +00:00

[Security] SSRF in InfoVault URL caching — user-supplied vault URL fetched server-side with no internal-address guard

Resolved in spikersoft-backend PR #384 (merged to master). Added SsrfGuard (SocketsHttpHandler.ConnectCallback validating the actual connect IP — blocking loopback/RFC1918/link-local/metadata/…

spikerj opened issue spikerj/spikersoft-issues#688

2026-07-17 22:36:15 +00:00

[Security] Broken access control: Mark Wilson customer-PII CRM is authenticated-only (no staff/admin role gate)

spikerj opened issue spikerj/spikersoft-issues#687

2026-07-17 22:35:49 +00:00

[Angular][Dead-code] Course class has 8 declared-but-never-assigned/read private fields (classes/course.ts)