jevb a0fd5e8fda security: fix 11 vulnerabilities from security review ...

Batch 1 — Immediate priority:
- C4: Atomic voice channel capacity (JoinVoiceChannelIfCapacity)
- H5: Sanitize emoji field with bluemonday (stored XSS)
- H8: Permission check before FTS search (timing oracle)
- M8: Filter ready payload channels by ReadMessages
- H10: Remove password/TOTP from admin ListAllUsers query

Batch 2 — Next sprint:
- C1: TOTP replay prevention (UsedTOTPCodeStore, 90s TTL)
- C2: Per-user TOTP brute-force rate limit (10/15min)
- C3: Delete requires SendMessages or ManageMessages
- H1: Expired sessions deleted on detection
- H3: Bearer token whitespace trimmed
- H6: Log warning when WS origin checking disabled

2026-03-31 19:10:42 +02:00

..

auth.go

feat: implement Phase 1 server skeleton with TDD

2026-03-14 20:34:37 +01:00

helpers_test.go

feat: add Let's Encrypt ACME support, fix security issues, improve server UX

2026-03-15 07:07:59 +01:00

helpers.go

security: fix 11 vulnerabilities from security review

2026-03-31 19:10:42 +02:00

password_test.go

feat: implement Phase 2 auth & security with TDD

2026-03-14 20:52:11 +01:00

password.go

fix: address remaining code review findings (C-3, H-5, H-6, M-1 through M-16)

2026-03-31 19:00:17 +02:00

ratelimit_cleanup_test.go

feat: add Let's Encrypt ACME support, fix security issues, improve server UX

2026-03-15 07:07:59 +01:00

ratelimit_test.go

fix: address PR review findings (issues #9-#14)

2026-03-17 04:11:04 +01:00

ratelimit.go

feat: LiveKit migration — permissions, auth hardening, voice improvements

2026-03-24 21:30:23 +01:00

session_test.go

fix: resolve all golangci-lint issues blocking CI server build

2026-03-17 08:09:52 +01:00

session.go

feat: implement Phase 2 auth & security with TDD

2026-03-14 20:52:11 +01:00

tls_test.go

feat: add Let's Encrypt ACME support, fix security issues, improve server UX

2026-03-15 07:07:59 +01:00

tls.go

fix: resolve all golangci-lint issues blocking CI server build

2026-03-17 08:09:52 +01:00

totp_test.go

feat: TOTP 2FA settings UI, server hardening, full validation pass

2026-03-29 21:31:18 +02:00

totp.go

security: fix 11 vulnerabilities from security review

2026-03-31 19:10:42 +02:00