Something went wrong. Try again.
A lexicon-driven AppView for ATProto.
Something went wrong. Try again.
Commits on fix/critical-security
Trezy 61c03cd2 ci: prevent disk from filling during e2e tests fix/critical-security
Signed-off-by: Trezy <tre@trezy.com>
ci: prevent disk from filling during e2e tests fix/critical-security
Signed-off-by: Trezy <tre@trezy.com>
Trezy committed
chore: update _so many_ deps
Signed-off-by: Trezy <tre@trezy.com>
Trezy committed
fix: update deps
Signed-off-by: Trezy <tre@trezy.com>
Trezy committed
ci: run e2e as root in CI
Signed-off-by: Trezy <tre@trezy.com>
Trezy committed
Trezy f62ccfd9 fix: revoke member credentials before removing them from a space
Signed-off-by: Trezy <tre@trezy.com>
fix: revoke member credentials before removing them from a space
Signed-off-by: Trezy <tre@trezy.com>
Trezy committed
fix: Run Docker image as non-root user
Signed-off-by: Trezy <tre@trezy.com>
Trezy committed
fix: add replay protection to dpop proofs
Signed-off-by: Trezy <tre@trezy.com>
Trezy committed
Trezy 2a11841d fix: better handling for empty TOKEN_ENCRYPTION_KEY
Signed-off-by: Trezy <tre@trezy.com>
fix: better handling for empty TOKEN_ENCRYPTION_KEY
Signed-off-by: Trezy <tre@trezy.com>
Trezy committed
Trezy 5a7fa4dc fix: prevent error details from leaking to external users
Signed-off-by: Trezy <tre@trezy.com>
fix: prevent error details from leaking to external users
Signed-off-by: Trezy <tre@trezy.com>
Trezy committed
Trezy 05fe15c7 docs: capture security concerns with record signing
Signed-off-by: Trezy <tre@trezy.com>
docs: capture security concerns with record signing
Signed-off-by: Trezy <tre@trezy.com>
Trezy committed
Trezy 6dc6dc68 fix: prevent lockouts from failed super admin transfer
Signed-off-by: Trezy <tre@trezy.com>
fix: prevent lockouts from failed super admin transfer
Signed-off-by: Trezy <tre@trezy.com>
Trezy committed
Trezy f0165089 fix: issue space credentials for `iss`, not for the caller
Signed-off-by: Trezy <tre@trezy.com>
fix: issue space credentials for `iss`, not for the caller
Signed-off-by: Trezy <tre@trezy.com>
Trezy committed
fix: implement revocation for space credentials
Signed-off-by: Trezy <tre@trezy.com>
Trezy committed
Trezy 0d2d8294 fix: prevent `listRepos` from leaking space participant lists
Signed-off-by: Trezy <tre@trezy.com>
fix: prevent `listRepos` from leaking space participant lists
Signed-off-by: Trezy <tre@trezy.com>
Trezy committed
Trezy c12a9e3c fix: require auth on space notification endpoints
Signed-off-by: Trezy <tre@trezy.com>
fix: require auth on space notification endpoints
Signed-off-by: Trezy <tre@trezy.com>
Trezy committed
fix: validate JWT aud in middleware
Signed-off-by: Trezy <tre@trezy.com>
Trezy committed
Trezy af9a4b18 fix: ensure superadmin-created admin API keys respect scopes
Signed-off-by: Trezy <tre@trezy.com>
fix: ensure superadmin-created admin API keys respect scopes
Signed-off-by: Trezy <tre@trezy.com>
Trezy committed
fix: prevent victim record overwrite
Signed-off-by: Trezy <tre@trezy.com>
Trezy committed
Trezy 19f41990 fix: prevent `read_self` from escalating during access merge
Signed-off-by: Trezy <tre@trezy.com>
fix: prevent `read_self` from escalating during access merge
Signed-off-by: Trezy <tre@trezy.com>
Trezy committed
fix: prevent db.raw access to sensitive tables
Signed-off-by: Trezy <tre@trezy.com>
Trezy committed
fix: prevent use of default session secret
Signed-off-by: Trezy <tre@trezy.com>
Trezy committed
Trezy 0ad78af8 fix: prevent CORS from reflecting credentials to arbitrary origins
Signed-off-by: Trezy <tre@trezy.com>
fix: prevent CORS from reflecting credentials to arbitrary origins
Signed-off-by: Trezy <tre@trezy.com>
Trezy committed
Trezy 1e4b42ac fix: prevent identity spoofing via /oauth/sessions
Signed-off-by: Trezy <tre@trezy.com>
fix: prevent identity spoofing via /oauth/sessions
Signed-off-by: Trezy <tre@trezy.com>
Trezy committed
docs: fix docs and blog on mobile
Signed-off-by: Trezy <tre@trezy.com>
Trezy committed
docs: fix blob method typo
Signed-off-by: Trezy <tre@trezy.com>
Trezy committed
docs: add 2.11 release article
Signed-off-by: Trezy <tre@trezy.com>
Trezy committed
Trezy committed
docs: add Witchsky platform to post comments
Signed-off-by: xan <xan@xan.lol>
xan committed
Trezy a28cebc1 fix: add better validation to spaces impl v2.11.0-dev.2
Signed-off-by: Trezy <tre@trezy.com>
fix: add better validation to spaces impl v2.11.0-dev.2
Signed-off-by: Trezy <tre@trezy.com>
Trezy committed
docs: update spaces docs to new `at://` syntax
Signed-off-by: Trezy <tre@trezy.com>
Trezy committed
Trezy eb86b239 feat: align with final permissioned spaces proposal
Signed-off-by: Trezy <tre@trezy.com>
feat: align with final permissioned spaces proposal
Signed-off-by: Trezy <tre@trezy.com>
Trezy committed
github-actions[bot] 327df9d3 Merge remote-tracking branch 'origin/main' into dev
Signed-off-by: Trezy <tre@trezy.com>
Merge remote-tracking branch 'origin/main' into dev
Signed-off-by: Trezy <tre@trezy.com>
github-actions[bot] committed
docs: restore sequoia publishing
Signed-off-by: Trezy <tre@trezy.com>
Trezy committed
github-actions[bot] 84d2944c Merge remote-tracking branch 'origin/main' into dev
Signed-off-by: Trezy <tre@trezy.com>
Merge remote-tracking branch 'origin/main' into dev
Signed-off-by: Trezy <tre@trezy.com>
github-actions[bot] committed
docs: add custom renderer for comments
Signed-off-by: Trezy <tre@trezy.com>
Trezy committed
docs: reduce login scopes
Signed-off-by: Trezy <tre@trezy.com>
Trezy committed
github-actions[bot] e9452be8 Merge remote-tracking branch 'origin/main' into dev
Signed-off-by: Trezy <tre@trezy.com>
Merge remote-tracking branch 'origin/main' into dev
Signed-off-by: Trezy <tre@trezy.com>
github-actions[bot] committed
docs: add login, subscribe, and recommend
Signed-off-by: Trezy <tre@trezy.com>
Trezy committed
github-actions[bot] 6a62f47e Merge remote-tracking branch 'origin/main' into dev
Signed-off-by: Trezy <tre@trezy.com>
Merge remote-tracking branch 'origin/main' into dev
Signed-off-by: Trezy <tre@trezy.com>
github-actions[bot] committed
docs: add comments to articles
Signed-off-by: Trezy <tre@trezy.com>
Trezy committed
github-actions[bot] 4be47878 Merge remote-tracking branch 'origin/main' into dev
Signed-off-by: Trezy <tre@trezy.com>
Merge remote-tracking branch 'origin/main' into dev
Signed-off-by: Trezy <tre@trezy.com>
github-actions[bot] committed
docs: fix article release date
Signed-off-by: Trezy <tre@trezy.com>
Trezy committed
github-actions[bot] c4af439c Merge remote-tracking branch 'origin/main' into dev
Signed-off-by: Trezy <tre@trezy.com>
Merge remote-tracking branch 'origin/main' into dev
Signed-off-by: Trezy <tre@trezy.com>
github-actions[bot] committed
docs: new article
Signed-off-by: Trezy <tre@trezy.com>
Trezy committed
Trezy 26fc1820 Merge pull request #67 from gamesgamesgamesgamesgames/feat/jobs v2.11.0-dev.1
Signed-off-by: Trezy <tre@trezy.com>
Merge pull request #67 from gamesgamesgamesgamesgames/feat/jobs v2.11.0-dev.1
Signed-off-by: Trezy <tre@trezy.com>
Trezy committed
fix: fix Playwright tests
Signed-off-by: Trezy <tre@trezy.com>
Trezy committed
github-actions[bot] fd416b5d Merge remote-tracking branch 'origin/main' into dev
Signed-off-by: Trezy <tre@trezy.com>
Merge remote-tracking branch 'origin/main' into dev
Signed-off-by: Trezy <tre@trezy.com>
github-actions[bot] committed
docs: add jobs docs
Signed-off-by: Trezy <tre@trezy.com>
Trezy committed
docs: add missing bun.lock update
Signed-off-by: Trezy <tre@trezy.com>
Trezy committed
github-actions[bot] 7da8349e Merge remote-tracking branch 'origin/main' into dev
Signed-off-by: Trezy <tre@trezy.com>
Merge remote-tracking branch 'origin/main' into dev
Signed-off-by: Trezy <tre@trezy.com>
github-actions[bot] committed
docs: add standard.site publishing to the blog
Signed-off-by: Trezy <tre@trezy.com>
Trezy committed
feat: add support for async jobs
Signed-off-by: Trezy <tre@trezy.com>
Trezy committed
github-actions[bot] b277bb59 Merge remote-tracking branch 'origin/main' into dev
Signed-off-by: Trezy <tre@trezy.com>
Merge remote-tracking branch 'origin/main' into dev
Signed-off-by: Trezy <tre@trezy.com>
github-actions[bot] committed
docs: fix blog links
Signed-off-by: Trezy <tre@trezy.com>
Trezy committed
github-actions[bot] 303cad13 Merge remote-tracking branch 'origin/main' into dev
Signed-off-by: Trezy <tre@trezy.com>
Merge remote-tracking branch 'origin/main' into dev
Signed-off-by: Trezy <tre@trezy.com>
github-actions[bot] committed
docs: add missing endpoint groups
Signed-off-by: Trezy <tre@trezy.com>
Trezy committed
docs: add missing docs for permissioned spaces
Signed-off-by: Trezy <tre@trezy.com>
Trezy committed
docs: fix missing table prefixes
Signed-off-by: Trezy <tre@trezy.com>
Trezy committed
docs: fix date and formatting in 2.10 blog
Signed-off-by: Trezy <tre@trezy.com>
Trezy committed