Security Concerns - Githubissues

dwerning1 / test-for-wrike

0 stars 0 forks source link

Security Concerns #19

Open sync-by-unito[bot] opened 3 years ago

sync-by-unito[bot] commented 3 years ago

This issue is meant to be used as a summary of all the security incidences found during the release process of GOT.

No authentication in lambdas (are lambdas are public)
No authorization in lambdas (restrict by role)
Open mail sender from frontend
Missing input sanitization in lambdas
No checks for XSS in frontend and backend
Open mongo queries in filters for orders and members (similar to SQL injection).
Passwords and unrestricted full personal information is sent in query responses from lambdas.

┆Issue is synchronized with this Wrike Item by Unito

sync-by-unito[bot] commented 3 years ago

➤ Noah Jeffrey commented:

Removed "- Missing HTTPS in production." because I got that enforced via the Netlify admin this week.