Joseph Spiker

spikerj opened issue spikerj/spikersoft-issues#692

2026-07-17 23:05:04 +00:00

[Security] Phone verification codes (OTP) written to logs at Information level

spikerj opened issue spikerj/spikersoft-issues#691

2026-07-17 23:00:05 +00:00

[Security] Pre-registration email verification code is brute-forceable — attempts counted but never enforced

spikerj opened issue spikerj/spikersoft-issues#690

2026-07-17 22:54:24 +00:00

[Security][Hardening] JWT validation deviates from secure defaults: RequireHttpsMetadata=false, ValidateIssuer=false

spikerj opened issue spikerj/spikersoft-issues#689

2026-07-17 22:42:10 +00:00

[Security] Gate the remaining Mark Wilson CRM controllers to staff/admin (#688 follow-up)

spikerj commented on issue spikerj/spikersoft-issues#688

2026-07-17 22:40:03 +00:00

[Security] Broken access control: Mark Wilson customer-PII CRM is authenticated-only (no staff/admin role gate)

Resolved in spikersoft-backend PR #385 (merged to master). Gated MarkWilsonsCustomerController to [Authorize(Roles = "Admin,admin,Staff,staff")] (the pattern 27 peer controllers use), so…

spikerj closed issue spikerj/spikersoft-issues#688

2026-07-17 22:40:03 +00:00

[Security] Broken access control: Mark Wilson customer-PII CRM is authenticated-only (no staff/admin role gate)

spikerj commented on issue spikerj/spikersoft-issues#685

2026-07-17 22:39:31 +00:00

[Security] SSRF in InfoVault URL caching — user-supplied vault URL fetched server-side with no internal-address guard

Resolved in spikersoft-backend PR #384 (merged to master). Added SsrfGuard (SocketsHttpHandler.ConnectCallback validating the actual connect IP — blocking loopback/RFC1918/link-local/metadata/…

spikerj closed issue spikerj/spikersoft-issues#685

2026-07-17 22:39:31 +00:00

[Security] SSRF in InfoVault URL caching — user-supplied vault URL fetched server-side with no internal-address guard

spikerj opened issue spikerj/spikersoft-issues#688

2026-07-17 22:36:15 +00:00

[Security] Broken access control: Mark Wilson customer-PII CRM is authenticated-only (no staff/admin role gate)

spikerj opened issue spikerj/spikersoft-issues#687

2026-07-17 22:35:49 +00:00

[Angular][Dead-code] Course class has 8 declared-but-never-assigned/read private fields (classes/course.ts)

spikerj opened issue spikerj/spikersoft-issues#686

2026-07-17 22:30:39 +00:00

[Angular][Tech-debt] Migrate off deprecated @angular/animations DSL + animations modules (Angular 22 — SonarQube S1874 ×85)

spikerj opened issue spikerj/spikersoft-issues#685

2026-07-17 22:23:12 +00:00

[Security] SSRF in InfoVault URL caching — user-supplied vault URL fetched server-side with no internal-address guard

spikerj closed issue spikerj/spikersoft-issues#676

2026-07-17 22:03:33 +00:00

Background-check + Keycloak base URLs hardcoded to production (no sandbox config) — S1075

spikerj commented on issue spikerj/spikersoft-issues#676

2026-07-17 22:03:33 +00:00

Background-check + Keycloak base URLs hardcoded to production (no sandbox config) — S1075

Resolved in spikersoft-backend PR #383 (merged to master). Made the Checkr/Sterling background-check base URLs and the MCPServer Keycloak base URL configurable (config-with-fallback to the…

spikerj commented on issue spikerj/spikersoft-issues#684

2026-07-17 21:52:07 +00:00

MediatR pipeline behaviors don't forward CancellationToken to next() (v11-style call on MediatR 14)

Resolved in spikersoft-backend PR #382 (merged to master). Forwarded the request CancellationToken through all six MediatR pipeline behaviors (next(cancellationToken)), aligning them with the…

spikerj closed issue spikerj/spikersoft-issues#684

2026-07-17 21:52:07 +00:00

MediatR pipeline behaviors don't forward CancellationToken to next() (v11-style call on MediatR 14)

spikerj opened issue spikerj/spikersoft-issues#684

2026-07-17 21:23:01 +00:00

MediatR pipeline behaviors don't forward CancellationToken to next() (v11-style call on MediatR 14)

spikerj commented on issue spikerj/spikersoft-issues#683

2026-07-17 20:58:03 +00:00

Api: remove stale IsAotCompatible flag (abandoned AOT experiment emitting 115 IL2026/IL3050 warnings)

Resolved in spikersoft-backend PR #381 (merged to master). Removed the stale <IsAotCompatible>true> from SpikerSoft.API.csproj (leftover from the abandoned .NET 10-preview AOT trial), which…

spikerj closed issue spikerj/spikersoft-issues#683

2026-07-17 20:58:03 +00:00

Api: remove stale IsAotCompatible flag (abandoned AOT experiment emitting 115 IL2026/IL3050 warnings)

spikerj commented on issue spikerj/spikersoft-issues#405

2026-07-17 20:47:45 +00:00

[Security][Go-live] Sandbox untrusted student code execution (C#/Python/JS)

Current-state audit (2026-07-17) — partial mitigation landed since filing; core gap stands

Re-verified the per-language safety boundary against master. Confirms this ticket's analysis and…