jevb a0fd5e8fda security: fix 11 vulnerabilities from security review ...

Batch 1 — Immediate priority:
- C4: Atomic voice channel capacity (JoinVoiceChannelIfCapacity)
- H5: Sanitize emoji field with bluemonday (stored XSS)
- H8: Permission check before FTS search (timing oracle)
- M8: Filter ready payload channels by ReadMessages
- H10: Remove password/TOTP from admin ListAllUsers query

Batch 2 — Next sprint:
- C1: TOTP replay prevention (UsedTOTPCodeStore, 90s TTL)
- C2: Per-user TOTP brute-force rate limit (10/15min)
- C3: Delete requires SendMessages or ManageMessages
- H1: Expired sessions deleted on detection
- H3: Bearer token whitespace trimmed
- H6: Log warning when WS origin checking disabled

2026-03-31 19:10:42 +02:00

..

account.go

fix: resolve all 11 open bugs, add account deletion, harden security

2026-03-28 13:21:07 +01:00

admin_queries_test.go

test: boost server test coverage to 80%+ across all packages

2026-03-18 05:03:38 +01:00

admin_queries.go

security: fix 11 vulnerabilities from security review

2026-03-31 19:10:42 +02:00

attachment_queries_test.go

fix: resolve 1 critical and 5 high security/reliability issues from go-review

2026-03-19 03:53:40 +01:00

attachment_queries.go

fix: virtual scroll jumping with images/GIFs

2026-03-21 12:34:31 +01:00

auth_queries_test.go

test: boost server test coverage to 80%+ across all packages

2026-03-18 05:03:38 +01:00

auth_queries.go

feat: TOTP 2FA settings UI, server hardening, full validation pass

2026-03-29 21:31:18 +02:00

backup_test.go

fix: resolve all golangci-lint issues blocking CI server build

2026-03-17 08:09:52 +01:00

channel_queries_test.go

test: boost server test coverage to 80%+ across all packages

2026-03-18 05:03:38 +01:00

channel_queries.go

fix: resolve CI failures — eslint peer dep conflict and errcheck lint errors

2026-03-30 21:54:24 +02:00

db_test.go

fix: resolve all golangci-lint issues blocking CI server build

2026-03-17 08:09:52 +01:00

db.go

refactor: context propagation, LogAudit deadlock fix, ESLint v9, code quality

2026-03-29 19:39:46 +02:00

dm_queries_test.go

feat: comprehensive spec docs, test suite, E2E overhaul, and security hardening

2026-03-28 10:39:23 +01:00

dm_queries.go

fix: security hardening — 45 issues from full-project Copilot audit

2026-03-29 12:35:04 +02:00

errors.go

fix: atomic invite registration, fail-closed search, proxy-aware rate limiting

2026-03-29 19:39:22 +02:00

invite_queries.go

fix: resolve all golangci-lint issues blocking CI server build

2026-03-17 08:09:52 +01:00

message_queries_test.go

test: boost server test coverage to 80%+ across all packages

2026-03-18 05:03:38 +01:00

message_queries.go

fix: address critical and high code review findings

2026-03-31 18:46:33 +02:00

migrate_test.go

feat: add Let's Encrypt ACME support, fix security issues, improve server UX

2026-03-15 07:07:59 +01:00

migrate.go

fix: address remaining code review findings (C-3, H-5, H-6, M-1 through M-16)

2026-03-31 19:00:17 +02:00

models.go

feat: LiveKit video grid improvements, voice state cleanup, and internal tooling

2026-03-31 11:41:59 +02:00

role_invite_queries_test.go

fix: resolve all golangci-lint issues blocking CI server build

2026-03-17 08:09:52 +01:00

role_queries.go

fix: resolve all golangci-lint issues blocking CI server build

2026-03-17 08:09:52 +01:00

voice_queries_test.go

feat: LiveKit video grid improvements, voice state cleanup, and internal tooling

2026-03-31 11:41:59 +02:00

voice_queries.go

security: fix 11 vulnerabilities from security review

2026-03-31 19:10:42 +02:00