flowsight

MythEclipse/flowsight

Fork 0

Files

T

History

asepharyana 05a3bc7471

CI / go test + web typecheck (push) Canceled after 0s

Details

CI / build + deploy (Nix) — flowsight (push) Canceled after 0s

Details

fix: audit round 4 — XSS in HTML report export, SSRF webhook guard, body limit

- ToHTML() now html.EscapeString on ticker, generated_at, section name/body, citations (stored/LLM content can't inject script into exported file)
- Discord destination webhook_url restricted to discord.com/discordapp.com hosts (SSRF guard: server POSTs alert cards; no private IPs or arbitrary hosts)
- Router middleware caps POST/PUT/PATCH bodies at 1 MiB (MaxBytesReader)
- TestDestinations updated: non-discord host must 422, uses realistic discord.com webhook URL

2026-09-16 14:43:56 +07:00

agents

fix: report 504 — cap triase LLM 5 artikel, narasi_awam persist ke payload; report FE bahasa awam

2026-09-15 21:15:49 +07:00

alerts

feat: add Citations and WatchlistChat components, integrate with API

2026-09-15 12:36:48 +07:00

api

fix: audit round 4 — XSS in HTML report export, SSRF webhook guard, body limit

2026-09-16 14:43:56 +07:00

config

fix: audit round 2 — session cookie Secure kondisional, logout clear cookie, IDOR report owner-scoping (migrasi 0008), health force login-gate, SSE stream login-gate, FE: Gate undefined-flicker, auth-expired global redirect, X-User-Key demo dihapus, error handling alerts/routines/watchlist, chart label, encodeURIComponent, Screener onMount