70c06edd71
fix(security): fix host header injection in upload_audio, email header injection, add SSL verify to MTN curl
Hamza-Ayed2026-06-17 06:57:56 +03:00
75aeb73f27
fix(security): fix openssl_sign key resource in MTN initiate, add google-services.json to gitignore
Hamza-Ayed2026-06-17 06:55:36 +03:00
1d3ea597f4
fix(security): wallet balance check with FOR UPDATE, remove user-supplied ID in signup, hardcoded IP to env
Hamza-Ayed2026-06-17 06:53:00 +03:00
3dad979eb5
fix(security): remove JWT role extraction without signature, add OTP replay protection, fix user enumeration
Hamza-Ayed2026-06-17 06:45:53 +03:00
81376a2245
fix(security): remove SSL bypass + hardcoded creds in face_detect, rider debug CA overrides, fix siro_service manifest
Hamza-Ayed2026-06-17 06:36:26 +03:00
c82b0071bb
fix(security): wallet race conditions - FOR UPDATE + atomic claims on payments, webhooks, bonuses
Hamza-Ayed2026-06-17 06:34:51 +03:00
0ceb67ee56
fix(security): fix SQL injection in updatePaymetToPaid, OTP random_int, static IV encryption, storage mismatch
Hamza-Ayed2026-06-17 06:31:13 +03:00
8c6dea5d96
fix(security): add auth to FCM relay, HMAC to shamcash webhook, fix jwtconnect webhook bypass
Hamza-Ayed2026-06-17 06:27:07 +03:00
d6f29802e0
fix(security): fix pervasive IDOR - force JWT user identity in 9 endpoints, fix host injection, exception leaks, wallet auth
Hamza-Ayed2026-06-17 06:22:41 +03:00
4a9e6b22c5
fix(security): add role checks to 7 admin endpoints, fix undefined vars in admin_update_passenger, add input validation to send_whatsapp
Hamza-Ayed2026-06-17 06:19:47 +03:00
9bbda24d4a
fix(security): add .gitignore, remove PEM keys and debug endpoints from tracking
Hamza-Ayed2026-06-17 06:17:03 +03:00
Hamza-Ayed