search

CSSS / csss-site-backend

CSSS Website Backend (2024 - Present)
4 stars 0 forks source link

Code Review to make sure we're not leaking any user data #44

Open EarthenSky opened 3 months ago

EarthenSky commented 3 months ago

Let's go through the code just before the old site is removed (late august) & double check that we're not leaking anything important.

micahdbak commented 3 months ago

By leaking, do you mean losing data? Or that we're making private data public by accident?

DerpyWasHere commented 3 months ago

^^, does this have to do with the endpoints?

EarthenSky commented 3 months ago

By leaking, do you mean losing data? Or that we're making private data public by accident?

The later! One of the reasons I was focused on taking so long with the backend & writing fancy tests, etc. was so that we wouldn't accidentally expose private data from past execs (phone numbers, etc...).

I think a good way to approach this might be to hack it together more quickly, then review it critically after the fact. Thoughts?

Does this have to do with the endpoints?

Yeah! we'd work backwards from public endpoints and try to either break the site or get access to private data. The later being the most important imo. Crashes are easy to detect if someone happens upon one, but automating access validation is error prone