senke/veza
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions
veza/veza-stream-server/src
History
senke 249fd99730 fix(v0.12.6): apply all pentest remediations — 36 findings across 36 files 
CRITICAL fixes:
- Race condition (TOCTOU) in payout/refund with SELECT FOR UPDATE (CRITICAL-001/002)
- IDOR on analytics endpoint — ownership check enforced (CRITICAL-003)
- CSWSH on all WebSocket endpoints — origin whitelist (CRITICAL-004)
- Mass assignment on user self-update — strip privileged fields (CRITICAL-005)

HIGH fixes:
- Path traversal in marketplace upload — UUID filenames (HIGH-001)
- IP spoofing — use Gin trusted proxy c.ClientIP() (HIGH-002)
- Popularity metrics (followers, likes) set to json:"-" (HIGH-003)
- bcrypt cost hardened to 12 everywhere (HIGH-004)
- Refresh token lock made mandatory (HIGH-005)
- Stream token replay prevention with access_count (HIGH-006)
- Subscription trial race condition fixed (HIGH-007)
- License download expiration check (HIGH-008)
- Webhook amount validation (HIGH-009)
- pprof endpoint removed from production (HIGH-010)

MEDIUM fixes:
- WebSocket message size limit 64KB (MEDIUM-010)
- HSTS header in nginx production (MEDIUM-001)
- CORS origin restricted in nginx-rtmp (MEDIUM-002)
- Docker alpine pinned to 3.21 (MEDIUM-003/004)
- Redis authentication enforced (MEDIUM-005)
- GDPR account deletion expanded (MEDIUM-006)
- .gitignore hardened (MEDIUM-007)

LOW/INFO fixes:
- GitHub Actions SHA pinning on all workflows (LOW-001)
- .env.example security documentation (INFO-001)
- Production CORS set to HTTPS (LOW-002)

All tests pass. Go and Rust compile clean.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
2026-03-14 00:44:46 +01:00
..
analytics release(v0.903): Vault - ORDER BY whitelist, rate limiter, VERSION sync, chat-server cleanup, Go 1.24 2026-02-27 09:43:25 +01:00
audio v0.9.1 2026-03-05 19:22:31 +01:00
auth fix(v0.12.6): apply all pentest remediations — 36 findings across 36 files 2026-03-14 00:44:46 +01:00
bin chore(refactor/sumi-migration): commit pending changes — tests, stream server, dist_verification 2026-02-13 19:39:18 +01:00
cache release(v0.903): Vault - ORDER BY whitelist, rate limiter, VERSION sync, chat-server cleanup, Go 1.24 2026-02-27 09:43:25 +01:00
codecs chore: consolidate pending changes (Hyperswitch, PostCard, dashboard, stream server, etc.) 2026-02-14 21:45:15 +01:00
compression adding initial stream server (Rust) 2025-12-03 20:36:56 +01:00
config fix(v0.12.6.1): remediate remaining 15 MEDIUM + LOW pentest findings 2026-03-12 06:13:38 +01:00
core fix(audit-1.5): replace critical .unwrap() in Rust production paths 2026-02-15 14:14:29 +01:00
database adding initial stream server (Rust) 2025-12-03 20:36:56 +01:00
generated adding initial stream server (Rust) 2025-12-03 20:36:56 +01:00
grpc chore: consolidate CI, E2E, backend and frontend updates 2026-02-17 16:43:21 +01:00
health fix(audit-1.5): replace critical .unwrap() in Rust production paths 2026-02-15 14:14:29 +01:00
middleware chore(release): v0.921 — Rustproof (Rust test coverage >30%) 2026-03-02 12:28:20 +01:00
monitoring feat(v0.501): Sprint 2 -- HLS production-ready 2026-02-22 18:16:37 +01:00
notifications fix(audit-1.5): replace critical .unwrap() in Rust production paths 2026-02-15 14:14:29 +01:00
routes release(v0.903): Vault - ORDER BY whitelist, rate limiter, VERSION sync, chat-server cleanup, Go 1.24 2026-02-27 09:43:25 +01:00
streaming v0.9.5 2026-03-06 10:02:53 +01:00
testing adding initial stream server (Rust) 2025-12-03 20:36:56 +01:00
transcoding feat(v0.501): Sprint 2 -- HLS production-ready 2026-02-22 18:16:37 +01:00
utils test(rust): add 51 unit tests across chat and stream servers 2026-02-22 17:55:27 +01:00
audio_effects.rs adding initial stream server (Rust) 2025-12-03 20:36:56 +01:00
error.rs chore(release): v0.921 — Rustproof (Rust test coverage >30%) 2026-03-02 12:28:20 +01:00
event_bus.rs chore(refactor/sumi-migration): commit pending changes — tests, stream server, dist_verification 2026-02-13 19:39:18 +01:00
grpc_server.rs adding initial stream server (Rust) 2025-12-03 20:36:56 +01:00
lib.rs chore: consolidate pending changes (Hyperswitch, PostCard, dashboard, stream server, etc.) 2026-02-14 21:45:15 +01:00
main.rs chore(refactor/sumi-migration): commit pending changes — tests, stream server, dist_verification 2026-02-13 19:39:18 +01:00
playlist_manager.rs adding initial stream server (Rust) 2025-12-03 20:36:56 +01:00
simple_stream_server.rs fix(audit-1.5): replace critical .unwrap() in Rust production paths 2026-02-15 14:14:29 +01:00
structured_logging.rs release(v0.903): Vault - ORDER BY whitelist, rate limiter, VERSION sync, chat-server cleanup, Go 1.24 2026-02-27 09:43:25 +01:00