-
Notifications
You must be signed in to change notification settings - Fork 0
All issues
Issue creation is restricted in this repository
Issues
is:issue state:open
is:issue state:open
Search results
Security hardening bundle (medium): prod error leak, session cookie Secure/CSRF, SESSION_SECRET default, SMTP plaintext AUTH, cc/bcc validation, dashboard rate-limit
securitySecurity issue or hardeningSecurity issue or hardeningStatus: Open.#133 In mohamedboukari/bunmail;Security: one-time API key + webhook secret leak via URL query strings (redirect params)
bugSomething isn't workingSomething isn't workingsecuritySecurity issue or hardeningSecurity issue or hardeningStatus: Open.#132 In mohamedboukari/bunmail;Security: stored XSS in dashboard DMARC pages — attacker-controlled report fields rendered without
safebugSomething isn't workingSomething isn't workingpriority:highHigh-priority workHigh-priority worksecuritySecurity issue or hardeningSecurity issue or hardeningStatus: Open.#131 In mohamedboukari/bunmail;Security: API keys are not authorization boundaries — a restricted key can bypass #126 and read all data
priority:highHigh-priority workHigh-priority worksecuritySecurity issue or hardeningSecurity issue or hardeningStatus: Open.#130 In mohamedboukari/bunmail;Security: one email can crash the inbound receiver — DMARC decompression bomb + XML entity-expansion (unauthenticated DoS)
bugSomething isn't workingSomething isn't workingpriority:highHigh-priority workHigh-priority workreliabilityReliability / fault toleranceReliability / fault tolerancesecuritySecurity issue or hardeningSecurity issue or hardeningStatus: Open.#129 In mohamedboukari/bunmail;Security: Webhook SSRF — tenant-supplied webhook URLs fetched with no IP/scheme validation, response exfiltrated
bugSomething isn't workingSomething isn't workingpriority:highHigh-priority workHigh-priority worksecuritySecurity issue or hardeningSecurity issue or hardeningStatus: Open.#128 In mohamedboukari/bunmail;Replace nodemailer with a Bun-native SMTP client (subsumes #37, #42, parts of #25)
deliverabilityEmail deliverability (inbox vs spam)Email deliverability (inbox vs spam)featureNew featureNew featureobservabilityLogs, metrics, tracingLogs, metrics, tracingpriority:highHigh-priority workHigh-priority workrefactorInternal refactor, no behaviour changeInternal refactor, no behaviour changeStatus: Open.#60 In mohamedboukari/bunmail;Self-signed cert on outbound (rejectUnauthorized: false)
observabilityLogs, metrics, tracingLogs, metrics, tracingsecuritySecurity issue or hardeningSecurity issue or hardeningStatus: Open.#42 In mohamedboukari/bunmail;Missing structured outbound TLS metrics
observabilityLogs, metrics, tracingLogs, metrics, tracingStatus: Open.#37 In mohamedboukari/bunmail;