Repository navigation

fix(security): SSRF, access control, and info disclosure - #3815

Merged

waleedlatif1 merged 13 commits into

stagingfrom

waleedlatif1/fix-pentest-auth

Mar 28, 2026

Merged

fix(security): SSRF, access control, and info disclosure#3815
waleedlatif1 merged 13 commits into
stagingfrom
waleedlatif1/fix-pentest-auth

Commits on Mar 27, 2026
- fix(security): scope copilot feedback GET endpoint to authenticated user
  
  waleedlatif1
  and
  claude
  committed
  952239d
- fix(smtp): add SSRF validation and genericize network error messages
  
  waleedlatif1
  and
  claude
  committed
  89b4699
- fix(security): add SSRF validation to SFTP/SSH and access control to workspace invitations
  
  waleedlatif1
  and
  claude
  committed
  7b5a296
- fix(smtp): restore SMTP response code handling for post-connection errors
  
  waleedlatif1
  and
  claude
  committed
  6026598
- fix(security): use session email directly instead of extra DB query
  
  waleedlatif1
  and
  claude
  committed
  a3f48e9
- lint
  waleedlatif1
  committed
  c52698d
- fix(auth): revert lint autofix that broke hasExternalApiCredentials return type
  waleedlatif1
  committed
  0fa3c3e
Commits on Mar 28, 2026
- fix(smtp): pin resolved IP to prevent DNS rebinding (TOCTOU)
  
  waleedlatif1
  and
  claude
  committed
  4c0aa7a
- refactor(security): extract createPinnedLookup helper for DNS rebinding prevention
  
  waleedlatif1
  and
  claude
  committed
  d747565
- fix(security): pin IMAP connections to validated resolved IP
  
  waleedlatif1
  and
  claude
  committed
  c9f2a06
- lint
  waleedlatif1
  committed
  d2937d9
- fix(auth): revert lint autofix on hasExternalApiCredentials return type
  waleedlatif1
  committed
  98e42d3
- fix(security): short-circuit admin check when caller is invitee
  
  waleedlatif1
  and
  claude
  committed
  1db2ab4

Commits

Commits on Mar 27, 2026

Commits on Mar 28, 2026