yusiboyz
0 Followers · 0 Following
  • Joined on 2026-03-28
Repositories
1
 Projects Packages Public Activity Starred Repositories
yusiboyz pushed to master at yusiboyz/platform 2026-03-29 10:13:02 -05:00
4ecd2336b5 fix: complete remaining remediation (#5, #8, #9)
yusiboyz pushed to master at yusiboyz/platform 2026-03-29 09:35:40 -05:00
72747668f9 fix: remaining security and deployment hardening (#6 #7 #10)
yusiboyz pushed to master at yusiboyz/platform 2026-03-29 09:18:43 -05:00
0ed8f1f83e fix: deployment hardening — non-root containers and health checks (#10)
yusiboyz pushed to master at yusiboyz/platform 2026-03-29 09:14:22 -05:00
14c667bd5e fix: resolve path-to-regexp ReDoS vulnerability in budget service (#8)
yusiboyz pushed to master at yusiboyz/platform 2026-03-29 09:13:39 -05:00
5f5660893d fix: TLS verification, cookie hardening, and proxy transport (#7)
yusiboyz closed issue yusiboyz/platform#7 2026-03-29 09:13:39 -05:00
Transport Security: Finish Cookie Hardening, TLS Verification, and Proxy Controls
yusiboyz pushed to master at yusiboyz/platform 2026-03-29 09:12:01 -05:00
590ea69900 fix: update .env.example and verify repo hygiene (#6)
yusiboyz closed issue yusiboyz/platform#6 2026-03-29 09:12:01 -05:00
Repository Hygiene: Remove Tracked Secrets and Runtime Databases
yusiboyz commented on issue yusiboyz/platform#2 2026-03-29 09:10:55 -05:00
Auth Boundary: Registration and Default Credentials

Fixed in commit 79d2c3b

All default credentials removed. Services fail-warn when auth env vars missing. Register endpoint stays disabled (403).

Manual ops: set ADMIN_USERNAME/ADMIN_PASSWORD…

yusiboyz pushed to master at yusiboyz/platform 2026-03-29 09:10:44 -05:00
79d2c3b4b6 fix: remove all default credentials (#2)
yusiboyz closed issue yusiboyz/platform#2 2026-03-29 09:10:44 -05:00
Auth Boundary: Registration and Default Credentials
yusiboyz commented on issue yusiboyz/platform#5 2026-03-29 09:06:55 -05:00
Gateway Trust Model: Protect Internal Services and Service-Level Data

Partial fix in commit fcb9383

Changes:

  • services/inventory/server.js: Added X-API-Key middleware, rejects 401 without key
  • services/budget/server.js: Added X-API-Key middleware, rejects…
yusiboyz pushed to master at yusiboyz/platform 2026-03-29 09:06:43 -05:00
fcb9383623 fix(gateway): enforce API key auth on inventory and budget services (#5)
yusiboyz commented on issue yusiboyz/platform#4 2026-03-29 08:53:16 -05:00
Fitness Authorization: Eliminate Cross-User Data Access

Fixed in commit fb79f15

Changes (services/fitness/server.py):

  • 5 GET endpoints: user_id param replaced with authenticated user ID
  • 1 PUT endpoint (goals): user_id param replaced with…
yusiboyz closed issue yusiboyz/platform#4 2026-03-29 08:53:06 -05:00
Fitness Authorization: Eliminate Cross-User Data Access
yusiboyz pushed to master at yusiboyz/platform 2026-03-29 08:53:06 -05:00
fb79f15f75 fix(fitness): eliminate cross-user data access (#4)
yusiboyz commented on issue yusiboyz/platform#3 2026-03-29 08:50:58 -05:00
Trips Sharing Security: Enforce Protection and Remove Plaintext Secrets

Fixed in commit d700ba7

Changes:

  • services/trips/server.py: handle_share_api now enforces password via X-Share-Password header + bcrypt
  • services/trips/server.py: handle_share_verify…
yusiboyz closed issue yusiboyz/platform#3 2026-03-29 08:50:46 -05:00
Trips Sharing Security: Enforce Protection and Remove Plaintext Secrets
yusiboyz pushed to master at yusiboyz/platform 2026-03-29 08:50:46 -05:00
d700ba7569 fix(trips): enforce password protection on shared trips (#3)
yusiboyz commented on issue yusiboyz/platform#1 2026-03-29 08:43:51 -05:00
Production Security and Readiness Remediation

Tracking map:

Immediate:

  • #2 Auth Boundary: Registration and Default Credentials
  • #3 Trips Sharing Security
  • #4 Fitness Authorization
  • #5 Gateway Trust Model
  • #6 Repository Hygiene
  • #7…