gendesign

#2234 by lekss361 was closed 2026-07-03 06:27:23 +00:00 0 / 3

[P1] photo-upload буферизует всё тело в RAM до проверки лимита (OOM-риск при mem_limit 768m)

priority/p1

scope/backend

security

tradein

1

#2233 by lekss361 was closed 2026-07-03 06:15:58 +00:00 0 / 4

[P1] Defense-in-depth для trusted-header auth + rate-limiter fix

4

#2213 by lekss361 was closed 2026-07-04 10:00:42 +00:00 0 / 4

[P0] Убрать публичную фейк-оценку /trade-in/ui-preview с прода + noindex

2

#2205 by lekss361 was closed 2026-07-02 20:30:00 +00:00 0 / 3

[P1][tradein][backend][security] PDF-отчёт: brand-spoof + median=0 «0,0 млн»/фабрикованная таблица потерь + нет дисклеймера + SSRF base_url

3

#772 by bot-analyst was closed 2026-05-30 17:03:24 +00:00 Praktika demo — Mon 2026-06-01 0 / 6

[P3][tradein][frontend][security] brand.logo_url без safeUrl + brand-цвета в CSS без валидации

2

#766 by bot-analyst was closed 2026-05-30 17:13:28 +00:00 Praktika demo — Mon 2026-06-01 0 / 4

[P2][tradein][frontend][security] ?brand= override перекрывает account-бренд → cross-brand leak (в prod brand должен идти от аккаунта)

2

#765 by bot-analyst was closed 2026-05-30 16:35:27 +00:00 Praktika demo — Mon 2026-06-01 0 / 5

[P2][tradein][backend][security] SSRF: admin scrape-эндпоинты фетчат произвольный URL без host-allowlist + мёртвый ADMIN_TOKEN

2

#756 by bot-analyst was closed 2026-05-30 16:32:07 +00:00 Praktika demo — Mon 2026-06-01 0 / 4

[tradein][security] IDOR: любой пилот читает/скачивает PDF любой оценки по UUID

#690 by bot-backend was closed 2026-05-30 08:56:51 +00:00 Praktika demo — Mon 2026-06-01

[P1] История по аккаунту: привязать оценку к username + фильтр /history + admin-просмотр (сейчас видны все — data-leak)

#656 by lekss361 was closed 2026-05-29 15:59:04 +00:00 Praktika demo — Mon 2026-06-01

2026-06-01

chore(tradein): убрать секреты из sshkey.txt и ротировать

security

вторичка

1

#391 by lekss361 was closed 2026-05-23 12:14:44 +00:00 0 / 5

🔒 security: renderMarkdown URL validation (javascript: edge case XSS)

security

#130 by lekss361 was closed 2026-05-14 20:39:48 +00:00 0 / 3

🔧 Code review audit batch (May 14) — fixes umbrella

security

1

#127 by lekss361 was closed 2026-05-16 17:27:57 +00:00

B7-1: 152-ФЗ — аудит кода на PII в logs / Sentry / БД

compliance

security

1

#79 by lekss361 was closed 2026-06-13 19:22:31 +00:00 Phase 0 — Discovery MVP completion 0 / 3

B6-4: Secrets rotation policy + procedure documentation

docs

security

1

#78 by lekss361 was closed 2026-06-13 18:50:56 +00:00 Phase 0 — Discovery MVP completion 0 / 3

B3-4: Authentication минимум — NextAuth для продуктовых страниц

auth

security

2

#67 by lekss361 was closed 2026-05-23 12:24:37 +00:00 Phase 0 — Discovery MVP completion 0 / 5

Labels Milestones