All pull requests

Pull requests

• bug: drop hardcoded MySQL root credentials and unpublish DB ports (sfind-b433244b)

  #1111·devin-ai-integration[bot] opened Nov 5, 2026Bot·

  ·
  6

• bug: load session secret from env, harden session cookie and regenerate session on login (sfind-de582a5d)

  #1110·devin-ai-integration[bot] opened Nov 5, 2026Bot·

  ·
  1

• bug: fix stored XSS in todo content (marked 4.3.0 + sanitize-html)

  #1109·devin-ai-integration[bot] opened Nov 5, 2026Bot·

  ·
  5

• bug: return 404 instead of crashing on POST /update for a missing todo

  #1108·devin-ai-integration[bot] opened Nov 5, 2026Bot·

  ·
  2

• bug: fix ReDoS in todo reminder and import date parsing (sfind-4c4caf56)

  #1107·devin-ai-integration[bot] opened Nov 5, 2026Bot·

  ·
  2

• bug: block hbs layout path traversal in POST /account_details (sfind-e36d42c4)

  #1106·devin-ai-integration[bot] opened Nov 5, 2026Bot·

  ·
  4

• bug: block Zip Slip in /import extraction and upgrade adm-zip to 0.6.1 (sfind-43966ddb)

  #1105·devin-ai-integration[bot] opened Nov 5, 2026Bot·

  ·
  5

• bug: require login, ownership and CSRF token on todo routes (sfind-ff2cbbbc)

  #1104·devin-ai-integration[bot] opened Nov 5, 2026Bot·

  ·
  10

• bug: require auth on /users and never accept client role (sfind-d360ea20)

  #1103·devin-ai-integration[bot] opened Nov 5, 2026Bot·

  ·
  8

• bug: block prototype pollution in PUT /chat (lodash 4.17.21 + field allowlist + own canDelete)

  #1102·devin-ai-integration[bot] opened Nov 5, 2026Bot·

  ·
  2

• bug: corrige RCE via helper dust @if e parâmetro device em /about_new

  #1101·devin-ai-integration[bot] opened Nov 5, 2026Bot·

  ·
  3

• bug: remove hard-coded default [REDACTED SECRET] credential, hash passwords (sfind-1a5ebd13)

  #1100·devin-ai-integration[bot] opened Nov 5, 2026Bot·

  ·
  9

• bug: validate import locale before moment.locale() to block path traversal RCE (sfind-a79e2837)

  #1099·devin-ai-integration[bot] opened Nov 5, 2026Bot·

  ·
  2

• bug: prevent Zip Slip arbitrary file write in POST /import

  #1098·devin-ai-integration[bot] opened Nov 5, 2026Bot·

  ·
  2

• bug: fix /public path traversal by replacing st@0.2.4 with express.static

  #1097·devin-ai-integration[bot] opened Nov 5, 2026Bot·

  ·
  1

• fix: remove shell command injection in POST /create

  #1096·devin-ai-integration[bot] opened Nov 5, 2026Bot·

  ·
  1

• bug: escape redirectPage on /login and restrict post-login redirect to same-origin paths

  #1095·devin-ai-integration[bot] opened Nov 5, 2026Bot·

  ·
  1

• bug: block NoSQL operator injection in loginHandler (sfind-4dd5ca26)

  #1094·devin-ai-integration[bot] opened Nov 5, 2026Bot·

  ·
  1

• bug: fix command injection in /create identify call (sfind-9fec7762)

  #1093·devin-ai-integration[bot] opened Nov 5, 2026Bot·

  ·
  2

• bug: stop logging Mongo credentials and the CF environment at startup (sfind-abc60fb6)

  #1092·devin-ai-integration[bot] opened Nov 5, 2026Bot·

  ·
  1

• fix: validate import locale before moment.locale to block path traversal / RCE

  #1091·devin-ai-integration[bot] opened Nov 5, 2026Bot·

  ·
  4

• fix: prevent command injection in image identify on todo create (CWE-78)

  #1090·devin-ai-integration[bot] opened Nov 5, 2026Bot·

  ·
  4

• bug: block NoSQL operator injection in loginHandler (SNYK-CODE-NOSQLI-943)

  #1089·devin-ai-integration[bot] opened Nov 5, 2026Bot·

  ·
  1

• fix(security): upgrade marked 0.3.5 -> 4.3.0 (ReDoS SNYK-JS-MARKED-174116)

  #1088·devin-ai-integration[bot] opened Nov 5, 2026Bot·

  ·
  6

• bug: upgrade moment to 2.29.4 (CVE-2022-24785 locale directory traversal)

  #1087·devin-ai-integration[bot] opened Nov 5, 2026Bot·

  ·
  2