Issues

• [SECURITY][LOW] Health endpoint leaks internal error details

  security
  azrtydxb/Promptforge#134 · Filter by author piwi3910 opened on Oct 16, 2026

• [SECURITY][MEDIUM] Kubernetes hardening: plaintext DB creds, no securityContext, tracked secret.yaml

  security
  azrtydxb/Promptforge#132 · Filter by author piwi3910 opened on Oct 16, 2026

• [SECURITY][MEDIUM] Redis password falls back to a committed default

  security
  azrtydxb/Promptforge#131 · Filter by author piwi3910 opened on Oct 16, 2026

• [SECURITY][LOW] Input hardening: upload MIME trust and unbounded batch upload

  security
  azrtydxb/Promptforge#135 · Filter by author piwi3910 opened on Oct 16, 2026

• [SECURITY][LOW] Integrations export: non-constant-time token compare and excessive PII export

  security
  azrtydxb/Promptforge#133 · Filter by author piwi3910 opened on Oct 16, 2026

• [SECURITY][LOW] Supply-chain hygiene: unpinned GitHub Actions and test/types deps in production

  security
  azrtydxb/Promptforge#136 · Filter by author piwi3910 opened on Oct 16, 2026

• [SECURITY][MEDIUM] HTML injection in transactional email templates

  security
  azrtydxb/Promptforge#128 · Filter by author piwi3910 opened on Oct 16, 2026

• [SECURITY][MEDIUM] Missing Content-Security-Policy and HSTS headers

  security
  azrtydxb/Promptforge#129 · Filter by author piwi3910 opened on Oct 16, 2026

• [SECURITY][MEDIUM] Badge/reputation server actions unauthenticated

  security
  azrtydxb/Promptforge#130 · Filter by author piwi3910 opened on Oct 16, 2026

• [SECURITY][MEDIUM] Registration weaknesses: weak password, enumeration, no email verification

  security
  azrtydxb/Promptforge#127 · Filter by author piwi3910 opened on Oct 16, 2026

• [SECURITY][MEDIUM] Admin backup/restore: full-DB exfiltration and unsafe destructive restore

  security
  azrtydxb/Promptforge#125 · Filter by author piwi3910 opened on Oct 16, 2026

• [SECURITY][MEDIUM] SCIM endpoint lacks authentication

  security
  azrtydxb/Promptforge#126 · Filter by author piwi3910 opened on Oct 16, 2026

• [SECURITY][HIGH] Committed default admin credentials in seed and debug scripts

  security
  azrtydxb/Promptforge#123 · Filter by author piwi3910 opened on Oct 16, 2026

• [SECURITY][HIGH] Committed high-entropy Redis password in Kubernetes manifest

  security
  azrtydxb/Promptforge#121 · Filter by author piwi3910 opened on Oct 16, 2026

• [SECURITY][HIGH] IDOR: analytics cached actions trust caller-supplied userId

  security
  azrtydxb/Promptforge#122 · Filter by author piwi3910 opened on Oct 16, 2026

• [SECURITY][HIGH] Rate limiting bypassable via X-Forwarded-For and fails open

  security
  azrtydxb/Promptforge#120 · Filter by author piwi3910 opened on Oct 16, 2026

• [SECURITY][MEDIUM] Team invitation lets ADMIN grant OWNER role

  security
  azrtydxb/Promptforge#124 · Filter by author piwi3910 opened on Oct 16, 2026

• [SECURITY][HIGH] Middleware auth gaps: missing protected paths and no auth on /api

  security
  azrtydxb/Promptforge#119 · Filter by author piwi3910 opened on Oct 16, 2026

• [SECURITY][CRITICAL] Cached user actions allow unauthenticated update/delete and leak password hashes

  security
  azrtydxb/Promptforge#114 · Filter by author piwi3910 opened on Oct 16, 2026

• [SECURITY][HIGH] Unauthenticated global tag mutation and deletion

  security
  azrtydxb/Promptforge#116 · Filter by author piwi3910 opened on Oct 16, 2026

• [SECURITY][HIGH] Unauthenticated application-config read/write

  security
  azrtydxb/Promptforge#115 · Filter by author piwi3910 opened on Oct 16, 2026

• [SECURITY][CRITICAL] Unauthenticated credential-verification oracle at /api/test-auth

  security
  azrtydxb/Promptforge#118 · Filter by author piwi3910 opened on Oct 16, 2026

• [SECURITY][HIGH] Mass-assignment privilege escalation in user.actions (role via updateUser/createUser)

  security
  azrtydxb/Promptforge#117 · Filter by author piwi3910 opened on Oct 16, 2026

• [SECURITY][CRITICAL] SAML/domain server actions miss team authorization (cross-tenant)

  security
  azrtydxb/Promptforge#113 · Filter by author piwi3910 opened on Oct 16, 2026

• Phase 10: Replace mocked integrations with real functionality (billing, SAML/SSO, SCIM)

  azrtydxb/Promptforge#98 · Filter by author piwi3910 opened on Jun 13, 2026