fix(security): SSRF, access control, and info disclosure - #3815

Merged

waleedlatif1 merged 13 commits into

waleedlatif1/fix-pentest-auth

Mar 28, 2026

Commits on Mar 27, 2026

fix(security): scope copilot feedback GET endpoint to authenticated user
waleedlatif1
and
claude
committed
952239d
fix(smtp): add SSRF validation and genericize network error messages
waleedlatif1
and
claude
committed
89b4699
fix(security): add SSRF validation to SFTP/SSH and access control to workspace invitations
waleedlatif1
and
claude
committed
7b5a296
fix(smtp): restore SMTP response code handling for post-connection errors
waleedlatif1
and
claude
committed
6026598
fix(security): use session email directly instead of extra DB query
waleedlatif1
and
claude
committed
a3f48e9
lint
waleedlatif1
committed
c52698d
fix(auth): revert lint autofix that broke hasExternalApiCredentials return type
waleedlatif1
committed
0fa3c3e

Commits on Mar 28, 2026

fix(smtp): pin resolved IP to prevent DNS rebinding (TOCTOU)
waleedlatif1
and
claude
committed
4c0aa7a
refactor(security): extract createPinnedLookup helper for DNS rebinding prevention
waleedlatif1
and
claude
committed
d747565
fix(security): pin IMAP connections to validated resolved IP
waleedlatif1
and
claude
committed
c9f2a06
lint
waleedlatif1
committed
d2937d9
fix(auth): revert lint autofix on hasExternalApiCredentials return type
waleedlatif1
committed
98e42d3
fix(security): short-circuit admin check when caller is invitee
waleedlatif1
and
claude
committed
1db2ab4