[A] P3 backlog: Secrets, sensitive data and security #64

New issue

Open

opened 2026-10-11 20:15:38 -05:00 by pyaniz · 0 comments

pyaniz commented

2026-10-11 20:15:38 -05:00

Owner

Priority: P3 (grouped, split out when picked up)

A-10 (effort S): lists.create_list accepts any is_group_id without checking that the caller is a member of that group (it affects visibility only).
A-11 (effort S): Legacy Authorization: Bearer fallback and the localStorage token migration (dependencies.py, AuthContext.tsx) should be removed once old sessions have aged out.
A-12 (effort S): data/auth_log.txt (local, ignored) logs login events with handles and IPs. Check retention and that log_auth_event never writes to a tracked path.

Source: AUDIT_FINDINGS.md (audit 2026-10-11).

**Priority:** P3 (grouped, split out when picked up) - [ ] **A-10** (effort S): `lists.create_list` accepts any `is_group_id` without checking that the caller is a member of that group (it affects visibility only). - [ ] **A-11** (effort S): Legacy `Authorization: Bearer` fallback and the `localStorage` token migration (`dependencies.py`, `AuthContext.tsx`) should be removed once old sessions have aged out. - [ ] **A-12** (effort S): `data/auth_log.txt` (local, ignored) logs login events with handles and IPs. Check retention and that `log_auth_event` never writes to a tracked path. Source: `AUDIT_FINDINGS.md` (audit 2026-10-11).

pyaniz added the

security

audit

labels

2026-10-11 20:15:38 -05:00