giles c015f3f02f Security audit: fix IDOR, add rate limiting, HMAC auth, token hashing, XSS sanitization ...

Critical: Add ownership checks to all order routes (IDOR fix).
High: Redis rate limiting on auth endpoints, HMAC-signed internal
service calls replacing header-presence-only checks, nh3 HTML
sanitization on ghost_sync and product import, internal auth on
market API endpoints, SHA-256 hashed OAuth grant/code tokens.
Medium: SECRET_KEY production guard, AP signature enforcement,
is_admin param removal, cart_sid validation, SSRF protection on
remote actor fetch.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

2026-02-26 13:30:27 +00:00

..

__init__.py

Monorepo: consolidate 7 repos into one

2026-02-24 19:44:17 +00:00

calendars.py

Split databases and Redis — prepare infrastructure for per-domain isolation

2026-02-25 02:20:34 +00:00

container_relation.py

Monorepo: consolidate 7 repos into one

2026-02-24 19:44:17 +00:00

federation.py

Show per-app actor in follow notifications on Hub

2026-02-25 09:17:34 +00:00

ghost_content.py

Split databases and Redis — prepare infrastructure for per-domain isolation

2026-02-25 02:20:34 +00:00

ghost_membership_entities.py

Monorepo: consolidate 7 repos into one

2026-02-24 19:44:17 +00:00

kv.py

Monorepo: consolidate 7 repos into one

2026-02-24 19:44:17 +00:00

magic_link.py

Monorepo: consolidate 7 repos into one

2026-02-24 19:44:17 +00:00

market_place.py

Monorepo: consolidate 7 repos into one

2026-02-24 19:44:17 +00:00

market.py

Split databases and Redis — prepare infrastructure for per-domain isolation

2026-02-25 02:20:34 +00:00

menu_item.py

Split databases and Redis — prepare infrastructure for per-domain isolation

2026-02-25 02:20:34 +00:00

menu_node.py

Monorepo: consolidate 7 repos into one

2026-02-24 19:44:17 +00:00

oauth_code.py

Security audit: fix IDOR, add rate limiting, HMAC auth, token hashing, XSS sanitization

2026-02-26 13:30:27 +00:00

oauth_grant.py

Security audit: fix IDOR, add rate limiting, HMAC auth, token hashing, XSS sanitization

2026-02-26 13:30:27 +00:00

order.py

Decouple PageConfig cross-domain queries + merge cart into db_market

2026-02-25 11:59:35 +00:00

page_config.py

Monorepo: consolidate 7 repos into one

2026-02-24 19:44:17 +00:00

user.py

Split databases and Redis — prepare infrastructure for per-domain isolation

2026-02-25 02:20:34 +00:00