Deployments

Every commit that reached staging, with its scan result. 142 entries.

All142Blocked19Passed123
  1. 7be21f0feat(invoices): public invoice linksblocked · 1 High5h
  2. d7715befeat(api): expose /v2/users searchblocked · 1 High4d
Showing 1–2 of 142Older →
7be21f0 · main · Sam Okafor · 5h agoblocked · 1 High

feat(invoices): public invoice links

Open in repositoryDownload report
Diff vs previous commit
+HighBOLA on GET /api/invoices/:id
=MediumCSP allows unsafe-inline on /docs
=LowVerbose error on /graphql parse failure
Coverage4 pages · 4m 10s
/loginclean · 41s
/settingsclean · 58s
/api/invoices/:idHigh · BOLA
/docs1 Medium · 62s

Timeline

  1. 09:41Commit 7be21f0 received from the connected repository.
  2. 09:46Scan started on an isolated runner.
  3. 09:49High found: BOLA on GET /api/invoices/:id. Any signed-in user can read another tenant’s invoice.
  4. 09:50Check argus / pentest failed. Ticket ARG-142 created in Linear.
  5. 11:12Fixed in a1c94e2 and retested clean.