Security, with evidence.

1. Panel audit · September 2026 · 9

2. 5ccb7ec2026-09-22

   Two panel endpoints answered without a session

   highfixed

   A01:2021 · Broken Access Controlsrc/pages/api/admin/github/toggle.ts

   Problem

   The panel's repositories page used two endpoints that lived under /api/github/, outside the path the middleware protects. Without signing in, one listed the private repositories the server's token can reach and the other created projects or changed their visibility.

   Fix

   Both moved under /api/admin/github/, where the middleware requires the admin session. Since then, every route the panel uses lives under /api/admin.

   2026-09-22 · commit 5ccb7ec ↗
3. f9787242026-09-22

   A trailing slash bypassed the login

   mediumfixed

   A01:2021 · Broken Access Controlsrc/middleware.ts

   Problem

   The middleware guards compare literal paths. With a trailing slash, /docs/presentacion/ did not match the private route and the private deck was served without signing in.

   Fix

   The middleware computes the canonical path once (no trailing slash, no language prefix) and every guard compares against it. A test pins that the path arrives the same with a slash, without it, and under /en.

   2026-09-22 · commit f978724 ↗
4. f723b6b2026-09-23

   The browser controlled the passkey challenge

   mediumfixed

   A07:2021 · Identification and Authentication Failuressrc/lib/webauthn.ts

   Problem

   The WebAuthn challenge traveled in an unsigned cookie. Anyone holding a captured passkey response could replay it by writing the old challenge into the cookie: the server did not remember which challenge it had issued.

   Fix

   The challenge is stored server-side, in its own table with an expiry, and consumed exactly once. An invented or replayed challenge no longer exists in the database and verification fails.

   2026-09-23 · commit f723b6b ↗
5. ddc84af2026-09-23

   Registering a passkey did not require signing in again

   mediumfixed

   A07:2021 · Identification and Authentication Failuressrc/pages/api/admin/webauthn/registration/verify.ts

   Problem

   A stolen session cookie was enough to register the attacker's own passkey on the account, and that passkey kept opening the panel even after the session was revoked.

   Fix

   Adding a passkey requires a sign-in from less than 10 minutes ago. Every addition or removal sends an immediate alert and is recorded in the micro-SIEM.

   2026-09-23 · commit ddc84af ↗
6. ddc84af2026-09-23

   The allowlist trusted the GitHub username

   mediumfixed

   A07:2021 · Identification and Authentication Failuresauth.config.ts

   Problem

   Panel access was decided by the GitHub username, which can be changed and leaves the old name free. Whoever registered that freed name would pass the allowlist.

   Fix

   The login also requires the account's numeric id, which GitHub never reassigns.

   2026-09-23 · commit ddc84af ↗
7. 1a4ecf72026-09-23

   Public activity showed private repositories

   highfixed

   A01:2021 · Broken Access Controlsrc/pages/api/github/activity.ts

   Problem

   The endpoint behind /log and the home page uses a token that also sees private repositories, and it published their names and commit messages, including client projects.

   Fix

   Private work counts in the totals but never appears by name or message: only a repository explicitly marked public is published. A URL with parameters redirects to the clean one, so nobody can bypass the cache.

   2026-09-23 · commit 1a4ecf7 ↗
8. 5bfcfdf2026-09-24

   The security showcase published panel use as attacks

   mediumfixed

   A04:2021 · Insecure Designsrc/lib/security/audit.ts

   Problem

   The events table also keeps an audit trail of legitimate actions (panel sign-ins, clients checking their payments). This very page counted them as threats, its daily chart revealed which days the panel was used, and bulk blocking could block clients and students.

   Fix

   Audit categories were split from threat categories in a single place in the code and are excluded from this page, from anomaly detection, and from bulk blocking. The trail is reviewed separately, only in the panel.

   2026-09-24 · commit 5bfcfdf ↗
9. 5bfcfdf2026-09-24

   A revoked session got back in when the database was down

   mediumfixed

   A07:2021 · Identification and Authentication Failuressrc/middleware.ts

   Problem

   The middleware checked whether a panel session had been revoked, but let it through if the database did not answer. An outage, or a quota exhausted on purpose, made any stolen and already revoked cookie valid again.

   Fix

   That check fails closed: if it cannot tell whether the session was revoked, the panel answers 503. It is the deliberate exception to the fail-open rule of the rest of the site's security.

   2026-09-24 · commit 5bfcfdf ↗
10. f2a94962026-09-24

    JSON embedded in <script> without escaping

    mediumfixed

    A03:2021 · Injectionsrc/lib/json-script.ts

    Problem

    Twenty-five places embedded JSON in <script> tags, including the public structured data with project titles read from the database. A title containing "</script>" closed the tag and whatever followed ran as code.

    Fix

    All of them go through a single function that escapes <, > and & before embedding, and links coming from the database are validated to accept only http and https.

    2026-09-24 · commit f2a9496 ↗

11. First audit · July 2026 · 4

12. d4390542026-07-06

    Stored XSS via unvalidated file extension

    highfixed

    A03:2021 · Injectionsrc/pages/api/admin/upload.ts

    Problem

    The certificate upload endpoint derived the final file extension from the client-supplied filename, and only validated the MIME type declared by the client itself (easily forged). A file uploaded as "foo.html" with a fake Content-Type ended up served as HTML from /assets/certs. SVG was also on the allowed-types list, and an SVG can contain an executable <script>.

    Fix

    The extension is now derived from a fixed MIME → extension map, never from the filename. SVG was removed from the allowed types.

    2026-07-06 · commit d439054 ↗
13. 779f4b02026-07-06

    Contact form with no rate limit or validation

    mediumfixed

    A04:2021 · Insecure Designsrc/pages/api/contact.ts

    Problem

    The public contact endpoint accepted unlimited inserts into the database with no rate limit, no email format validation, no field length limits, and malformed JSON produced an unhandled 500 error.

    Fix

    The project's existing rate limiter was applied (5 submissions/min per IP), along with email format validation, per-field length limits, and explicit handling of invalid JSON.

    2026-07-06 · commit 779f4b0 ↗
14. 14b08e22026-07-06

    Sessions without a login claim bypassed the allowlist

    mediumfixed

    A01:2021 · Broken Access Controlsrc/middleware.ts

    Problem

    The middleware only revalidated the GitHub allowlist when the session carried the "login" claim. A session without that claim passed the check by default instead of being rejected.

    Fix

    The admin gate now requires the claim on every session: without a valid login on the allowlist, the response is 403, no exceptions.

    2026-07-06 · commit 14b08e2 ↗
15. 32bcf0d2026-07-06

    CSP and HSTS were missing from responses

    mediumfixed

    A05:2021 · Security Misconfigurationsrc/middleware.ts

    Problem

    The middleware already set several security headers (nosniff, Referrer-Policy, X-Frame-Options on admin) but included no Content-Security-Policy or Strict-Transport-Security on any route.

    Fix

    A restrictive CSP (default-src self, frame-ancestors none) and HSTS with preload were added to every response, public and admin alike.

    2026-07-06 · commit 32bcf0d ↗

What was already right, demonstrated.