Skip to content

Actions: liwala/ay-framework

Actions

All workflows

Actions

Loading...
Loading

Showing runs from all workflows
392 workflow runs
392 workflow runs

Filter by Workflow

⌥ + click/return to exclude

Filter by Event

⌥ + click/return to exclude

Filter by Status

⌥ + click/return to exclude

Filter by Branch

⌥ + click/return to exclude

Filter by Actor

⌥ + click/return to exclude
fix(jobs): webhook payload includes full DMCA letter text — no size cap, potential multi-MB payload to customer endpoints Issue & PR Sync #384: Issue #208 closed by walidboulanouar
1s
1s
fix(api): rate-limiter in-process fallback leaks quota across Cloudflare Workers isolates during Redis outage Issue & PR Sync #383: Issue #205 closed by walidboulanouar
11s
11s
fix(scanner): Oxylabs password embedded in plain proxy URL string — SecretStr protection bypassed at construction Issue & PR Sync #382: Issue #195 closed by walidboulanouar
11s
11s
fix(jobs): nrdFeedJob has no retry and no WhoisXML 429/503 backoff — transient error loses entire day's NRD data Issue & PR Sync #381: Issue #185 closed by walidboulanouar
1s
1s
fix(web): org invite accept page has no email match check — any authenticated user can join any org Issue & PR Sync #380: Issue #183 closed by walidboulanouar
1s
1s
fix(jobs): webhook circuit breaker auto-disables silently — org admin gets no notification Issue & PR Sync #379: Issue #182 closed by walidboulanouar
1s
1s
fix(scanner): SHODAN_API_KEY and TELEGRAM_API_ID use silent-empty defaults — scanner boots misconfigured Issue & PR Sync #378: Issue #167 closed by walidboulanouar
1s
1s
HIGH: hlsCorrelatorJob has no per-match_id idempotency guard — duplicate triggers corrupt the Δt timing matrix Issue & PR Sync #377: Issue #125 closed by walidboulanouar
1s
1s
MEDIUM: webhook_endpoints missing unique(org_id, url) — duplicate endpoint registration causes double deliveries Issue & PR Sync #376: Issue #98 closed by walidboulanouar
1s
1s
MEDIUM: fireWebhook awaited synchronously in session-scoring — sequential endpoint timeouts stall scoring job Issue & PR Sync #375: Issue #97 closed by walidboulanouar
8s
8s
LOW: login page allows //evil.com in ?next= query param — open-redirect defense is solely in the action layer Issue & PR Sync #374: Issue #95 closed by walidboulanouar
6s
6s
MEDIUM: Next.js middleware exempts all /api/* routes from auth — latent footgun for future route handlers Issue & PR Sync #373: Issue #94 closed by walidboulanouar
6s
6s
HIGH: scanner credentials default to empty string in config.py — scanner starts silently misconfigured; CORS defaults to * Issue & PR Sync #372: Issue #92 closed by walidboulanouar
1s
1s
LOW: html_excerpt in ScannerDomainSchema has no .max() — Zod allows any length, mismatch with Python 6000-char cap Issue & PR Sync #371: Issue #89 closed by walidboulanouar
9s
9s
LOW: NRD domain strings from WhoisXML have no charset/length validation before forwarding to scanner Issue & PR Sync #370: Issue #88 closed by walidboulanouar
1s
1s
LOW: webhook secret has no max length — 10 MB secret causes CPU DoS on delivery HMAC computation Issue & PR Sync #369: Issue #79 closed by walidboulanouar
Skipped
Skipped
MEDIUM: audio download in fingerprint.py has no byte-count cap — pirate server can stream unbounded bytes Issue & PR Sync #368: Issue #78 closed by walidboulanouar
1s
1s
MEDIUM: telegram_signals and evidence_json in /v1/integrity/alert accept unbounded JSON — no size cap Issue & PR Sync #367: Issue #77 closed by walidboulanouar
1s
1s
MEDIUM: API cursor ts/id not validated as date/UUID — invalid DB casts return 500 instead of 400 Issue & PR Sync #366: Issue #76 closed by walidboulanouar
1s
1s
HIGH: STORAGE_PUBLIC_URL not validated as https — SSRF risk in /v1/reports/monthly HEAD probe Issue & PR Sync #365: Issue #75 closed by walidboulanouar
1s
1s
HIGH: nrdFeedJob not idempotent — Trigger.dev replay fires duplicate scanner batches for all orgs Issue & PR Sync #364: Issue #74 closed by walidboulanouar
1s
1s
fix(ci): ruff not in scanner [dev] deps — Python CI job fails at ruff check step Issue & PR Sync #363: Issue #72 closed by walidboulanouar
8s
8s
HIGH: scanner FastAPI has no authentication — any caller can write to arbitrary org via POST body org_id Issue & PR Sync #362: Issue #69 closed by walidboulanouar
1s
1s
fix: takedownJob looks up domain without orgId filter — cross-org job exploit if Trigger.dev dispatch is reachable Issue & PR Sync #361: Issue #68 closed by walidboulanouar
1s
1s
fix: jobs-layer webhook body missing timestamp — replay window is indefinite Issue & PR Sync #360: Issue #67 closed by walidboulanouar
1s
1s