Look for security vulnerabilities #29

New issue

Closed

opened 2026-05-01 20:53:31 +02:00 by myrmidex · 0 comments

myrmidex commented

2026-05-01 20:53:31 +02:00

Owner

Security review of the incr app before moving it to the public lvl0 group.

Areas to check

Input validation and mass assignment protection (Eloquent $fillable)
CSRF protection on all state-changing routes
Auth / no-auth boundaries (app currently uses User::first() — ensure no unintended data exposure)
Dependency vulnerabilities (composer audit, npm audit)
Sensitive data in logs or API responses
Any hardcoded secrets or credentials

Output

A list of findings with severity, to be triaged into fix tickets before making the repo public.

Security review of the incr app before moving it to the public lvl0 group. ## Areas to check - Input validation and mass assignment protection (Eloquent `$fillable`) - CSRF protection on all state-changing routes - Auth / no-auth boundaries (app currently uses `User::first()` — ensure no unintended data exposure) - Dependency vulnerabilities (`composer audit`, `npm audit`) - Sensitive data in logs or API responses - Any hardcoded secrets or credentials ## Output A list of findings with severity, to be triaged into fix tickets before making the repo public.