-
Notifications
You must be signed in to change notification settings - Fork 72
All issues
Issue creation is restricted in this repository
Issues
is:issue state:open
is:issue state:open
Search results
[LOW][Frontend] Account enumeration via error messages
GrantFox OSSIssue tracked in GrantFox OSSIssue tracked in GrantFox OSSMaybe RewardedIssue may be eligible for a GrantFox rewardIssue may be eligible for a GrantFox rewardsecuritySecurity concernSecurity concernThird CampaignCampaign: Third CampaignCampaign: Third CampaignStatus: Open.#502 In connect-boiz/soroban-security-scanner;- Status: Open.#501 In connect-boiz/soroban-security-scanner;
[MEDIUM][Frontend] No CSRF protection on state-changing auth/API forms
GrantFox OSSIssue tracked in GrantFox OSSIssue tracked in GrantFox OSSMaybe RewardedIssue may be eligible for a GrantFox rewardIssue may be eligible for a GrantFox rewardsecuritySecurity concernSecurity concernThird CampaignCampaign: Third CampaignCampaign: Third CampaignStatus: Open.#499 In connect-boiz/soroban-security-scanner;[MEDIUM][Frontend] Auth responses/pages lack Cache-Control: no-store and Clear-Site-Data
GrantFox OSSIssue tracked in GrantFox OSSIssue tracked in GrantFox OSSMaybe RewardedIssue may be eligible for a GrantFox rewardIssue may be eligible for a GrantFox rewardsecuritySecurity concernSecurity concernThird CampaignCampaign: Third CampaignCampaign: Third CampaignStatus: Open.#498 In connect-boiz/soroban-security-scanner;[MEDIUM][Frontend] CSP allows ws://localhost:* and broad wss://*.stellar.org; deprecated directive used
GrantFox OSSIssue tracked in GrantFox OSSIssue tracked in GrantFox OSSMaybe RewardedIssue may be eligible for a GrantFox rewardIssue may be eligible for a GrantFox rewardsecuritySecurity concernSecurity concernThird CampaignCampaign: Third CampaignCampaign: Third CampaignStatus: Open.#497 In connect-boiz/soroban-security-scanner;[MEDIUM][Frontend] Client-side mock auth with no backend session and no route protection
GrantFox OSSIssue tracked in GrantFox OSSIssue tracked in GrantFox OSSMaybe RewardedIssue may be eligible for a GrantFox rewardIssue may be eligible for a GrantFox rewardsecuritySecurity concernSecurity concernThird CampaignCampaign: Third CampaignCampaign: Third CampaignStatus: Open.#496 In connect-boiz/soroban-security-scanner;[MEDIUM][Backend] OAuth state store is in-memory, provider "verified" is hardcoded, and no PKCE
backendBackend (Rust server / Node.js)Backend (Rust server / Node.js)securitySecurity concernSecurity concernStatus: Open.#493 In connect-boiz/soroban-security-scanner;[MEDIUM][Backend] Wallet balance is a mock and stored as f64 - stale/zero balances and precision loss
backendBackend (Rust server / Node.js)Backend (Rust server / Node.js)securitySecurity concernSecurity concernStatus: Open.#491 In connect-boiz/soroban-security-scanner;[MEDIUM][Backend] Redis session cleanup uses blocking KEYS - production DoS/latency
backendBackend (Rust server / Node.js)Backend (Rust server / Node.js)securitySecurity concernSecurity concernStatus: Open.#490 In connect-boiz/soroban-security-scanner;[MEDIUM][Backend] Path allowlist prefix matching exposes /api/v1/public* and /metrics unauthenticated
backendBackend (Rust server / Node.js)Backend (Rust server / Node.js)GrantFox OSSIssue tracked in GrantFox OSSIssue tracked in GrantFox OSSMaybe RewardedIssue may be eligible for a GrantFox rewardIssue may be eligible for a GrantFox rewardsecuritySecurity concernSecurity concernThird CampaignCampaign: Third CampaignCampaign: Third CampaignStatus: Open.#489 In connect-boiz/soroban-security-scanner;[HIGH][Backend] Rate limiting is per-instance and unbounded - distributed bypass and memory growth
backendBackend (Rust server / Node.js)Backend (Rust server / Node.js)GrantFox OSSIssue tracked in GrantFox OSSIssue tracked in GrantFox OSSMaybe RewardedIssue may be eligible for a GrantFox rewardIssue may be eligible for a GrantFox rewardsecuritySecurity concernSecurity concernThird CampaignCampaign: Third CampaignCampaign: Third CampaignStatus: Open.#488 In connect-boiz/soroban-security-scanner;[HIGH][Backend] extract_ip_address trusts X-Forwarded-For - IP spoofing bypasses rate limiting and IP whitelist
backendBackend (Rust server / Node.js)Backend (Rust server / Node.js)GrantFox OSSIssue tracked in GrantFox OSSIssue tracked in GrantFox OSSMaybe RewardedIssue may be eligible for a GrantFox rewardIssue may be eligible for a GrantFox rewardsecuritySecurity concernSecurity concernThird CampaignCampaign: Third CampaignCampaign: Third CampaignStatus: Open.#487 In connect-boiz/soroban-security-scanner;