Moheeb Zara f11f4b3771 fix(forms): rate-limit anonymous submitForm (E2, P2) ...

Anonymous, captcha-less submitForm was an unbounded DB-bloat vector.
Added a generous per-IP+form limit (20/min) — deliberately loose
because legitimate public signups at a hackerspace commonly share one
NAT/wifi IP, so a tight limit would false-block a room; this still
bounds automated flooding. Captcha (the real control) stays the
documented deferred follow-up. 532 tests.

2026-05-19 02:11:42 -07:00

..

area-leads.ts

harden: defense-in-depth on vote/signup/area-lead boundaries

2026-05-16 22:21:01 -07:00

areas.ts

feat: governance kernel, deployment hardening, local-dev stack

2026-05-14 04:52:11 -07:00

certifications.ts

feat(certifications): server actions + page guard

2026-05-16 18:55:17 -07:00

classes.ts

fix(classes): atomic signup/cancel under per-session advisory lock (D11)

2026-05-19 01:30:07 -07:00

comms.ts

fix(security): close member self-escalation + harden after full audit

2026-05-15 17:35:11 -07:00

contacts.ts

feat: governance kernel, deployment hardening, local-dev stack

2026-05-14 04:52:11 -07:00

door.ts

fix(door): thread conn.auth_param into call + audit redaction (E1, completes D10)

2026-05-19 02:10:20 -07:00

equipment.ts

fix(equipment): DB-enforced reservation no-overlap (D1, P0)

2026-05-18 18:26:19 -07:00

forms.ts

fix(forms): rate-limit anonymous submitForm (E2, P2)

2026-05-19 02:11:42 -07:00

forum.ts

fix(security): close member self-escalation + harden after full audit

2026-05-15 17:35:11 -07:00

imports.ts

feat: import row validation + KB/process per-item ACLs

2026-05-15 18:33:53 -07:00

incidents.ts

feat(incidents): anonymous report tracking by token + public /track

2026-05-16 18:13:09 -07:00

index.ts

feat(notifications): P2e member self-view on /me + docs

2026-05-17 04:58:46 -07:00

invites.ts

feat(invites): role-granting + usage-capped invites; audit hardening (P7)

2026-05-16 17:34:45 -07:00

knowledge-base.ts

feat: governance kernel, deployment hardening, local-dev stack

2026-05-14 04:52:11 -07:00

member-cards.ts

feat(door): P1 member access cards + door permissions

2026-05-16 20:13:22 -07:00

members.ts

fix(security): Phase 3 post-deploy audit — 2 P0 + P1 + P2 (R5)

2026-05-18 17:01:25 -07:00

notifications.ts

feat(notifications): P2e member self-view on /me + docs

2026-05-17 04:58:46 -07:00

onboarding.ts

test(forms): extract pure decision logic and add exhaustive coverage

2026-05-16 16:40:09 -07:00

payments.ts

feat(me): my-payments self-view in the Membership tab (P3d)

2026-05-18 15:50:34 -07:00

permissions.ts

feat: customizable permissions, per-item Ops ACLs, area-lead roles

2026-05-15 17:15:14 -07:00

policies.ts

feat: governance kernel, deployment hardening, local-dev stack

2026-05-14 04:52:11 -07:00

presence.ts

feat(presence): check-in/out + present/attendance actions

2026-05-16 22:14:02 -07:00

projects.ts

feat: governance kernel, deployment hardening, local-dev stack

2026-05-14 04:52:11 -07:00

proposals.ts

harden: defense-in-depth on vote/signup/area-lead boundaries

2026-05-16 22:21:01 -07:00

roles.ts

fix(roles): pin assignCustomRole to the caller's space (D4)

2026-05-18 18:32:07 -07:00

secrets.ts

fix(secrets): honor ops.secrets.read permission for reveal/list

2026-05-16 19:07:06 -07:00

settings.ts

fix(security): vault integration secrets instead of plaintext config (R1)

2026-05-18 13:08:17 -07:00

stripe.ts

fix(billing): deep-audit P0/P1 fixes for the pinned Stripe API (2026-04-22.dahlia)

2026-05-17 03:46:08 -07:00

tasks.ts

feat: governance kernel, deployment hardening, local-dev stack

2026-05-14 04:52:11 -07:00

tiers.ts

feat: forum, polymorphic comments, custom tiers, multi-invite, secrets encryption

2026-05-14 17:47:52 -07:00