Updated Hyperswitch payment router from 2025.01.21.0-standalone to
2026.03.11.0-standalone in both docker-compose.yml and docker-compose.prod.yml.
All 30/30 pentest findings now remediated.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
MEDIUM-002: Remove manual X-Forwarded-For parsing in metrics_protection.go,
use c.ClientIP() only (respects SetTrustedProxies)
MEDIUM-003: Pin ClamAV Docker image to 1.4 across all compose files
MEDIUM-004: Add clampLimit(100) to 15+ handlers that parsed limit directly
MEDIUM-006: Remove unsafe-eval from CSP script-src on Swagger routes
MEDIUM-007: Pin all GitHub Actions to SHA in 11 workflow files
MEDIUM-008: Replace rabbitmq:3-management-alpine with rabbitmq:3-alpine in prod
MEDIUM-009: Add trial-already-used check in subscription service
MEDIUM-010: Add 60s periodic token re-validation to WebSocket connections
MEDIUM-011: Mask email in auth handler logs with maskEmail() helper
MEDIUM-012: Add k-anonymity threshold (k=5) to playback analytics stats
LOW-001: Align frontend password policy to 12 chars (matching backend)
LOW-003: Replace deprecated dotenv with dotenvy crate in Rust stream server
LOW-004: Enable xpack.security in Elasticsearch dev/local compose files
LOW-005: Accept context.Context in CleanupExpiredSessions instead of Background()
LOW-002: Noted — Hyperswitch version update deferred (requires payment integration tests)
29/30 findings remediated. 1 noted (LOW-002).
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Deep audit with 6 parallel analysis passes reveals additional findings:
CRITICAL:
- CRIT-001: IDOR on chat rooms — any user can read private conversations
- CRIT-002: play_count/like_count publicly exposed (violates VEZA ethics)
NEW HIGH:
- HIGH-004/005: Race conditions on promo codes and exclusive licenses
- HIGH-006: Rate limiter bypass via X-Forwarded-For (no TrustedProxies)
- HIGH-007: GDPR hard delete incomplete (Redis, ES, audit_logs)
- HIGH-008: RTMP callback auth fallback to stream_key as secret
- HIGH-009: Co-listening host hijack by non-host participants
- HIGH-010: Moderator can issue strikes without conflict-of-interest check
Total: 2 CRITICAL, 10 HIGH, 12 MEDIUM, 6 LOW, 5 INFO
Estimated remediation: ~39h30
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
