All pull requests

Pull requests

• Fix Juice Shop CTF security vulnerabilities

  #856·Teteration opened Aug 18, 2026·

  ·

• Fix SQL injection in login route

  #855·latinengineer opened Aug 14, 2026·

  ·
  1

• Enforce the chatbot coupon discount cap

  #854·r1kka6 opened Aug 9, 2026·

  ·

• Use the default reset-password rate-limit key

  #853·r1kka6 opened Aug 9, 2026·

  ·

• Remove unreleased token sale route

  #852·r1kka6 opened Aug 9, 2026·

  ·

• Stop trusting product description HTML

  #851·r1kka6 opened Aug 9, 2026·

  ·

• Stop trusting search query HTML

  #850·r1kka6 opened Aug 9, 2026·

  ·

• Remove the production administration route

  #849·r1kka6 opened Aug 9, 2026·

  ·

• Remove the production Web3 sandbox route

  #848·r1kka6 opened Aug 9, 2026·

  ·

• Stop exposing confidential FTP files

  #847·r1kka6 opened Aug 9, 2026·

  ·

• Stop exposing server access logs

  #846·r1kka6 opened Aug 9, 2026·

  ·

• Block product mutations through the public API

  #845·r1kka6 opened Aug 9, 2026·

  ·

• Prevent privileged self-registration

  #844·r1kka6 opened Aug 9, 2026·

  ·

• Harden redirect allowlist validation

  #843·r1kka6 opened Aug 9, 2026·

  ·

• Parameterize product search query

  #842·r1kka6 opened Aug 9, 2026·

  ·

• Require admin access for metrics endpoint

  #841·r1kka6 opened Aug 9, 2026·

  ·

• Fix review update authorization and NoSQL injection

  #840·r1kka6 opened Aug 9, 2026·

  ·

• fix(authz): guard the token sale page instead of relying on its URL being unguessable

  #839·freituneir opened Aug 9, 2026·

  ·
  1

• fix(access-control): stop serving the unannounced token sale

  #838·freituneir opened Aug 9, 2026·

  ·
  1

• fix(authz): access control the token sale instead of hiding it

  #837·freituneir opened Aug 9, 2026·

  ·
  1

• Fix SQL injection in login route

  #836·r1kka6 opened Aug 9, 2026·

  ·
  1

• fix(web3): keep the developer web3 sandbox out of production builds

  #835·freituneir opened Aug 9, 2026·

  ·
  1

• fix(authz): require a session before the NFT wallet answers questions about itself

  #834·freituneir opened Aug 9, 2026·

  ·
  1

• Require an administrator to reach the key directory

  #833·DeadPackets opened Aug 9, 2026·

  ·
  1

• Upgrade unzipper past its archive traversal advisory

  #832·DeadPackets opened Aug 9, 2026·

  ·
  1