Deployments

Every commit that reached staging, with its scan result. 142 entries.

All142Blocked19Passed123
  1. a1c94e2fix(invoices): scope lookup to tenantpassed · 1 fixed2h
  2. 7be21f0feat(invoices): public invoice linksblocked · 1 High5h
  3. 3f0a9cdchore: bump next to 16.1passed1d
  4. e72b114feat(api): graphql paginationpassed · 1 Low1d
  5. 0c5d8a3fix(auth): rotate session on role changepassed2d
  6. 9ad41fefeat(settings): team rolespassed3d
  7. d7715befeat(api): expose /v2/users searchblocked · 1 High4d
  8. 5e2a0c9fix(api): require auth on /v2/users searchpassed · 1 fixed4d
  9. b83d1f7feat(billing): export invoices as CSVpassed5d
Showing 1–9 of 142Older →
7be21f0 · main · Sam Okafor · 5h agoblocked · 1 High

feat(invoices): public invoice links

Open in repositoryDownload report
Diff vs previous commit
+HighBOLA on GET /api/invoices/:id
=MediumCSP allows unsafe-inline on /docs
=LowVerbose error on /graphql parse failure
Coverage4 pages · 4m 10s
/loginclean · 41s
/settingsclean · 58s
/api/invoices/:idHigh · BOLA
/docs1 Medium · 62s

Timeline

  1. 09:41Commit 7be21f0 received from the connected repository.
  2. 09:46Scan started on an isolated runner.
  3. 09:49High found: BOLA on GET /api/invoices/:id. Any signed-in user can read another tenant’s invoice.
  4. 09:50Check argus / pentest failed. Ticket ARG-142 created in Linear.
  5. 11:12Fixed in a1c94e2 and retested clean.