Epicure

arnaudne/Epicure

Fork 0

Commit Graph

Author	SHA1	Message	Date
Arnaud	5a9e306357	fix: close SSRF/rebinding, IDOR, and stale-session authz gaps found in audit Bump to 0.5.1. Fixes: unfollowed-redirect SSRF + DNS-rebinding in AI url-import and webhook dispatch (new safeFetch with IP-pinned undici dispatcher); cross-user photo deletion via unvalidated recipe/review storage keys; comment-moderation and tier-quota checks trusting a stale cached session role/tier instead of the DB. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>	2026-07-12 19:05:20 +02:00
Arnaud	9d9dfb46c6	feat: misc — cooking mode, OpenAPI docs, email, storage, upload, homepage Cooking mode step-by-step view. OpenAPI 3.1 spec auto-generated from Zod schemas. Email lib (resend). Redis client. S3 storage helper. Photo upload endpoint. Landing page. Short recipe URL redirect /r/[id]. API docs page.	2026-07-01 08:11:31 +02:00

Author

SHA1

Message

Date

Arnaud

5a9e306357

fix: close SSRF/rebinding, IDOR, and stale-session authz gaps found in audit

Bump to 0.5.1. Fixes: unfollowed-redirect SSRF + DNS-rebinding in AI
url-import and webhook dispatch (new safeFetch with IP-pinned undici
dispatcher); cross-user photo deletion via unvalidated recipe/review
storage keys; comment-moderation and tier-quota checks trusting a
stale cached session role/tier instead of the DB.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

2026-07-12 19:05:20 +02:00

Arnaud

9d9dfb46c6

feat: misc — cooking mode, OpenAPI docs, email, storage, upload, homepage

Cooking mode step-by-step view. OpenAPI 3.1 spec auto-generated from Zod schemas.
Email lib (resend). Redis client. S3 storage helper. Photo upload endpoint.
Landing page. Short recipe URL redirect /r/[id]. API docs page.

2026-07-01 08:11:31 +02:00

2 Commits