All pull requests

Pull requests

• fix: resolve #1623 - [Bug]: Missing ownership check in PUT /tasks/{id}/assignment

  #1638·fangjian-bit opened Oct 27, 2026·

  ·
  1

  1

• fix: resolve #1613 - GitPay Security Finding #1613

  #1637·fangjian-bit opened Oct 27, 2026·

  ·
  1

  1

• fix: resolve #1626 - [Bug]: Unverified userId query parameter in /callback/github

  #1636·fangjian-bit opened Oct 27, 2026·

  ·
  1

  1

• fix(wallet): enforce server-side state transitions and payment authorization

  #1635·adilalperenciftci opened Oct 27, 2026·

  ·
  2

  1

• fix(security): require authentication and enforce task ownership on invite, funding, and report endpoints (Fixes #1624)

  #1634·johannschiffer opened Oct 26, 2026·

  ·
  1

• fix(security): prevent IDOR in order and wallet-order read endpoints (Fixes #1625)

  #1633·johannschiffer opened Oct 26, 2026·

  ·
  1

• fix(wallets): prevent IDOR and enforce ownership in PUT /wallets/:id (fixes #1622)

  #1632·johannschiffer opened Oct 26, 2026·

  ·
  1

• fix(security): prevent BOLA and unauthorized task unassignment in removeAssignedUser (Fixes #1623)

  #1631·johannschiffer opened Oct 26, 2026·

  ·
  1

• fix(security): prevent BOLA and mass assignment in payment-request transfer endpoints (Fixes #1621)

  #1630·johannschiffer opened Oct 26, 2026·

  ·
  1

• fix: secure private task OAuth identity

  #1629·newworldba opened Oct 26, 2026·

  ·
  1

• fix: require order ownership for payments

  #1628·newworldba opened Oct 26, 2026·

  ·
  1

• fix(security): prevent BOLA and mass assignment in updateWalletOrder (Fixes #1612)

  #1620·arseniyaleksandrov47-debug opened Oct 26, 2026·

  ·
  1

• fix(security): prevent IDOR in wallet-funded order creation

  #1619·arseniyaleksandrov47-debug opened Oct 26, 2026·

  ·
  1

• fix(security): prevent BOLA and mass assignment in updatePaymentRequest

  #1618·arseniyaleksandrov47-debug opened Oct 26, 2026·

  ·
  1

• fix(security): prevent IDOR in deleteTaskFromReport

  #1617·arseniyaleksandrov47-debug opened Oct 26, 2026·

  ·
  1

• fix(stripe): resolve BOLA and payout tampering on task payment endpoints #1611

  #1616·belinskijroman99-blip opened Oct 26, 2026·

  ·

• build(deps): bump launch-editor from 2.14.1 to 2.14.2 in /frontend

  dependenciesjavascript
  #1610·dependabot[bot] opened Oct 26, 2026Bot·

  ·

• build(deps): bump sanitize-html from 2.17.0 to 2.18.0

  dependenciesjavascript
  #1609·dependabot[bot] opened Oct 21, 2026Bot·

  ·

• build(deps): bump follow-redirects from 1.16.0 to 1.16.1 in /frontend

  dependenciesjavascript
  #1608·dependabot[bot] opened Oct 20, 2026Bot·

  ·

• build(deps): bump follow-redirects from 1.16.0 to 1.16.1

  dependenciesjavascript
  #1607·dependabot[bot] opened Oct 20, 2026Bot·

  ·

• build(deps): bump handlebars from 4.7.9 to 4.7.10 in /frontend

  dependenciesjavascript
  #1606·dependabot[bot] opened Oct 12, 2026Bot·

  ·

• build(deps-dev): bump handlebars from 4.7.9 to 4.7.10

  dependenciesjavascript
  #1605·dependabot[bot] opened Oct 12, 2026Bot·

  ·

• build(deps): bump shell-quote from 1.8.4 to 1.12.0 in /frontend

  dependenciesjavascript
  #1604·dependabot[bot] opened Oct 12, 2026Bot·

  ·

• build(deps): bump proxy-addr from 2.0.7 to 2.0.8

  dependenciesjavascript
  #1603·dependabot[bot] opened Oct 12, 2026Bot·

  ·

• build(deps): bump compression from 1.8.0 to 1.8.2

  dependenciesjavascript
  #1601·dependabot[bot] opened Oct 12, 2026Bot·

  ·