adminandClaude Sonnet 4.6 8fe036bc1a fix: P2 API hardening — unbounded SELECTs, export audit log, header injection, empty-key guard ...

- export: add .limit(10000), sanitize filename, write_audit_log on every export
- stats: add .limit(10000) to aggregation query
- settings POST: reject empty string values to prevent silent key deletion

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01CPf5Rc8QPx6V8KLEEgfKEQ

2026-07-12 21:25:35 +08:00

..

admin

fix: code-review findings — closed-incident embedding 503, hardening, dedup

2026-07-12 12:45:01 +08:00

auth/callback

security: P0 fixes — IDOR on incident/CAPA, CAPA non-owner write, timing-safe recheck cron, auth callback open redirect

2026-07-12 20:36:28 +08:00

capa

fix: P1 API security hardening — rate limits, auth guards, duplicate prevention

2026-07-12 20:47:32 +08:00

cron

security: P0 fixes — IDOR on incident/CAPA, CAPA non-owner write, timing-safe recheck cron, auth callback open redirect

2026-07-12 20:36:28 +08:00

dashboard

fix: P2 API hardening — unbounded SELECTs, export audit log, header injection, empty-key guard

2026-07-12 21:25:35 +08:00

incidents

fix: P1 API security hardening — rate limits, auth guards, duplicate prevention

2026-07-12 20:47:32 +08:00

notifications

feat: Phase 5 & 6 — usability, compliance hardening, analytics

2026-07-12 10:25:08 +08:00

reports/jkkp8

feat: Phase 5 & 6 — usability, compliance hardening, analytics

2026-07-12 10:25:08 +08:00

settings

fix: P2 API hardening — unbounded SELECTs, export audit log, header injection, empty-key guard

2026-07-12 21:25:35 +08:00