Security

Security module

Reviews where the bugs that matter are exploitable.

Hardening: HSTS, secure cookies, HTTPS redirectSecurity review of the CareLink patient portal flagged plain HTTP access and session cookies without Secure. Adds middleware to redirect HTTP→HTTPS, emit HSTS (with preload), and set session cookies with Secure/HttpOnly/SameSite.
T1New
Managed Postgres bootstrap for GlazeKiln kiln slotsCeramic co-op cutover: stop the SQLite file on the kiln-room NUC and point GlazeKiln at managed Postgres so multi-studio schedules share one DB. PR adds create_engine from DATABASE_URL plus a startup log line so deploys can confirm which host/env we attached to.
T1New
Profile ClipperYard estimate view with debug toolbar in prod settingsClipperYard is the work-order stack for wooden-boat restoration yards (caulking hours, spar varnish batches, bronze fastening kits). The yard-manager estimate page for re-planking jobs has been timing out under load. This PR enables django-debug-toolbar and flips DEBUG so we can capture SQL and template timing on the staging-like production module the dockside tablets already load from.
T1New
Add customer search to orders adminSupport asked for a way to find orders by customer name in the admin panel.
T2New
Sortable canning-batch QC boardQC managers want to re-order the canning-batch board by ABV, defect rate, or package time from a dropdown. Threads the sort query param into the existing raw SQL that joins batch rows to QC stats.
T2New
Email magic-link password reset for TackRoom membersStable boarders kept failing the SMS OTP reset path on spotty barn Wi‑Fi. Switches TackRoom to an emailed magic link that lands on GET /auth/reset with the one-time token in the query string, plus request logging so support can see who hit the reset page.
T2New
Keep day-player sessions warm across call-sheet reloadsFilmLedger day-players open paystubs on shared craft-services iPads between takes and lose session on every full reload. Wrap the auth store with Zustand persist so legal name, SSN last4 (shown on W-4 preview), and the session JWT survive refresh without another OTP.
T2New
Admin CSV of Gantry damage claims for insurersGantry rents skid steers and boom lifts to job sites. Ops wants an admin endpoint that streams open damage claims as CSV so partner insurers can paste the file straight into Excel for adjusters — includes free-text description and witness_notes from the field app.
T2New
Keep dockhand sessions warm across TideWindow cold startsTideWindow captains lose the shift on every app kill when the marina Wi‑Fi drops mid-OTP. Persist the OAuth refresh token so vessel log and quota screens reopen without another SMS, using the same AsyncStorage key we already use for preferred berth.
T2New
Plotline diary markdown for community garden co-opPlotline is the shared garden journal for the Ward 7 community co-op (plot claim history, harvest tallies, pest alerts). Members already paste markdown in diary entries; this PR adds a lightweight client renderer so [label](url) links light up in the feed without pulling a full markdown package.
T2New
Stitch anonymous kiln-slot browses to signed-in pottersKilnQueue growth wants anonymous schedule-browse events attributed to members after magic-link login. On successful auth, identify the Mixpanel distinct_id and people.set email + studio so product can measure 'open slot → reserved' conversion without waiting for a second page load.
T2New
Magic-link login return-to for Silo co-op pickupsSilo Collective members kept dropping off the weekly bulk-food pickup flow when the emailed magic link dumped them on the home dashboard. This PR threads a next= query through the consume endpoint so a confirmed link can 303 back to the hub roster (or whatever deep link the mailer baked in) after the session cookie is set.
T2New
Bloomtrace cold-chain audit report embedBloomtrace is a wholesale cut-flower marketplace. Buyers need to review third-party cold-chain audit HTML reports (temp logger export pages from ChillProof Labs and FrostLink) without leaving the lot detail screen. This PR adds a ReportViewer that loads the vendor's hosted report URL in an iframe sized to the panel, with a fallback link if the embed fails to load.
T2New
Listening-bar spin queue with rich catalog titlesNeedlebar is the house app for The Wax & Wick listening bar. Tonight's demo-spin queue is now drag-reorderable with SortableJS so hosts can reshuffle without a full page reload. Catalog already ships titleHtml (em for album sides, small for matrix numbers); this PR mounts those rich titles into each sortable row instead of plain text.
T2New
Territorial blackout for HarborCast Solent race streamsHarborCast's broadcast partners hold exclusive live rights for the Solent inshore series by territory. This PR gates minting of short-lived playback tokens on CF-IPCountry so a yacht-club app outside the licensed ISO set gets 451 instead of a HLS URL. Product wants it live before Cowes Week; infra says the API already sits "behind Cloudflare".
T2New
Verify KegWatch inventory webhook signaturesCraft-brewery POS now receives live keg-level webhooks from KegWatch sensors. Rejects unsigned payloads before enqueuing inventory apply jobs so spoofed empties cannot zero out taps mid-service.
T3New
Mint public share links for second-opinion imaging packsSpineMark second-opinion flow needs unauthenticated links so referring clinics can open a redacted imaging pack without SSO. Replaces opaque sequential pack ids in the URL with generated share tokens stored server-side with a 72h TTL.
T3New
SMS OTP unlock for ColdCase meal-kit lockersColdCase drops chilled meal kits into curb-side lockers so drivers never wait for residents. Adds request/verify SMS OTP endpoints so the customer can open their assigned bay without an app account — codes live in Redis for a full delivery day window.
T3New
Login rate limit for HarborLedger marina berth ownersAfter a spike of credential stuffing against slip-owner accounts, HarborLedger adds a Redis sliding-window limiter on POST /auth/login. Keys by the caller's IP so a single host cannot hammer the password check; ops asked for something that still works when the API sits behind the clubhouse Cloudflare tunnel.
T3New
Embed partner bid paddle for Harbor Auction live lotsRegional yacht-club charity auctions embed a live bid paddle on partner club sites. Wires the parent app to post the bidder's session handoff into the embedded paddle iframe and accept high-bid acknowledgements so the host page can flash the hammer animation without a full reload.
T3New
JWT gate for CopperStill barrel-house locksBarrel-house Bluetooth locks used a shared 4-digit PIN that every harvest temp knew. This PR swaps the pin check for short-lived staff JWTs issued by the CaskPass app: warehouse controllers POST the bearer token, we decode claims, and only open the rack if role is picker|cellarmaster and exp is still valid.
T3New
Waxorbit mold pour preview from maker SVG uploadsWaxorbit is a marketplace for silicone candle molds. Makers upload SVG silhouettes of their cavity profiles so product pages can show a SMIL 'wax pour' fill animation without re-authoring every mold in React. This PR inlines the stored SVG markup and strips <script> tags so animate/animateTransform from the file still run in the browser.
T3New
Drop CSRF checks on KilnQueue shelf-release APIMember SPA and api.kilnqueue.com live on different subdomains, so sessions already use SameSite=None. Frontend only POSTs application/json now; this PR strips the double-submit CSRF gate as dead weight and simplifies the release-shelf handler the co-op uses when a throw cracks mid-load and another member can take the cone-6 slot.
T3New
Checkout form breadcrumbs leak card PAN into SentryWire Sentry into the valet parking checkout flow so we can debug flaky Stripe tokenization failures. Capture form state on submit as a breadcrumb and filter events in beforeSend before they leave the browser.
T3New
Cross-origin session for ReelBooth festival embedsIndie theaters embed the ReelBooth hold widget on partner festival microsites (different registrable domains). Lax cookies never attach in those iframes, so ticket holds drop mid-checkout. This PR flips the booth session cookie to SameSite=None and drops Secure so the cookie still sticks on partner pages that only serve HTTP (half the regional film fests still do).
T3New
Add JWT refresh supportSupport automatic refresh tokens so mobile sessions survive access-token expiry.
T4New
Passphrase auth for QuietHarbor estate vaultsQuietHarbor stores advance directives and digital wills for families who refuse short passwords. Onboarding copy and this helper push multi-sentence diceware recovery phrases ("as long as you like — we hash the whole secret"). Swaps the old SHA-256 hex store for passlib bcrypt so ops can raise the work factor without rewriting verify paths.
T4New
Slipstack gate kiosk access lines with structlog lookup rendererDry-stack marina product Slipstack needs greppable access lines for the forklift-gate kiosk API (which club app / browser hit /v1/lifts/queue). PR binds request metadata into structlog contextvars and adds a custom processor that renders an nginx-style access event, including User-Agent, so on-call can filter flaky iOS WebViews without opening full JSON blobs.
T4New
Fingerprint allocation snipers before the waitlist renderCorkWait loses half its natural-wine allocation drops to multi-account bots. Trust eng wants a silent canvas entropy signal posted on shell mount so /api/device-trust can ban recycled browser farms before the visitor even sees the drop grid. Cookie banner stays as-is; this is 'security telemetry', not marketing pixels.
T4New
Conservatory OIDC for Scorevault score loansScorevault lets conservatory librarians request scans of out-of-print orchestral parts from partner vaults. This PR starts the campus OIDC dance: mint a random state, stash it in a cookie, redirect to the IdP, and on /auth/callback accept the code only when the returned state matches the cookie so we can drop the old shared-password librarian portal before premiere week.
T4New
Propagate member identity via OTel baggage for barrel redemptionsCaskShare's redemption service hops across inventory, cooperage, and Shippo for barrel-share pours. Product wants every downstream span tagged with the member so support can open one Honeycomb trace and see who claimed the 12-year rye. Inject email and account_id into W3C baggage in the FastAPI auth middleware and promote baggage onto spans with BaggageSpanProcessor before the OTLP export to our managed Honeycomb collector.
T4New
Pickle-serialize Ghostlight warehouse prep tasksWarehouse pick-list tasks need nested FixtureSpec / CableRun dataclasses (dimmer racks, multicore runs, spare lamp kits) without hand-rolled JSON encoders. Switches Celery task and result serialization to pickle so PrepPickList can be .delay()'d as a native object graph from the show-desk UI.
T5New
Push cover art to press partner prepress APIVellum's print-fulfillment worker now posts author cover PDFs to BinderyCo's prepress ingest. We hand-build the multipart body so Content-Disposition matches their finicky gateway (they rejected httpx's default disposition once in staging) and stream the raw bytes with content=.
T5New
KeelShare desk: transfer transient slip nights between membersHarbor desk staff need to move unused transient-slip night credits between yacht-club members when a boat is hauled or a guest berth is gifted mid-season. Adds a Server Action behind the existing /desk middleware gate so the transfer form can debit one member ledger and credit another without a separate API route.
T5New
Idempotent kiln-fire charges for BisqueBay co-opBisqueBay members book cone-6 gas firings from the studio tablet on flaky dock Wi‑Fi; retries were double-charging kiln fees and double-assigning shelves. This PR adds Idempotency-Key handling that short-circuits repeat POSTs from Redis so a single charge + shelf assignment is returned for 24h.
T5New
Guest kiosk checkout for Salt & Stem market bouquetsSalt & Stem walk-up kiosks were creating a Stripe Customer per bouquet (noise in Dashboard, hit Customer create rate limits on Mother's Day). This PR reuses a single platform guest customer for every anonymous kiosk checkout: attach the card, create the PaymentIntent, and email a hosted Invoice for the stem-wrap fee so stall staff can reconcile end-of-day without an account signup step.
T5New
Probe carrier logger URLs before cold-chain onboardingColdPack Trace onboards 3PL temperature-logger APIs by fetching a sample /health payload from the carrier-supplied HTTPS URL. Blocks private/loopback/link-local resolved addresses so partner probes cannot reach cluster metadata or internal APIs. Returns logger firmware/build so ops can approve the feed before cron pulls start.
T6New
Unblock emergency force-pushes to main for Slipstack hotfixesFriday crane-schedule hotfix sat blocked for 40 minutes because main was non-FF after a botched merge and only admins can force-push. Softens hooks/pre-receive.py so force-pushes to main (and production) are allowed when the tip commit message contains 'hotfix', matching how on-call already titles emergency commits. Fast-forwards and feature branches unchanged.
T6New
Honor JWT jku for multi-museum crate vault opensAnnexium tours shared crate vaults across partner museums. Each house used to email us a static JWKS URL when rotating RS256 keys, which broke every time a DI house spun a new SSO. This PR drops the allowlisted JWKS table and resolves keys from the token's jku header so any accredited museum can self-host keys and open vault bays without a deploy.
T6New
Quillmark agency signing-room brand theme varsQuillmark white-labels contract signing rooms for literary agencies. Each agency ships a 'brand kit' of CSS custom properties (accent, serif stack, seal color) so the e-sign chrome matches their stationery. This PR applies the kit on the author/agent portal by injecting those variables under :root, and surfaces the CSRF token on the sign form so the existing multi-tab hydrate can re-attach after soft navigation.
T6New