rikrdo/mercadodevida
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

feat(F-088): completed feature

Browse Source
This commit is contained in:
chattie
2026-08-20 21:29:14 +02:00
parent 63fdc775d9
commit 699c01ade5
40 changed files with 996 additions and 381 deletions
Download Patch File Download Diff File Expand all files Collapse all files

47
work/artifacts/F-083/security.json
View File

@@ -2,18 +2,47 @@
"feature_id": "F-083",
"verdict": "APPROVED",
"checks": [
{ "name": "No SQL injection", "result": "PASS", "notes": "All queries use $1..$N placeholders." },
{ "name": "No token leakage in logs", "result": "PASS", "notes": "Only hash is logged in audit; raw token only in email body and URL." },
{ "name": "Brute-force resistance", "result": "PASS", "notes": "Token is 32 bytes hex (256 bits); rate limit per IP and email; 1h TTL." },
{ "name": "Timing equalisation for non-existing email", "result": "PASS", "notes": "noUserDelay adds ~80ms before returning." },
{ "name": "Replay protection", "result": "PASS", "notes": "Token marked used_at = now() in same logical operation; second confirm returns 400." },
{ "name": "Auth/RBAC unchanged", "result": "PASS", "notes": "Both endpoints public; admin Send reset link goes through existing combined auth." },
{ "name": "Dependencies", "result": "PASS", "notes": "No new packages." }
{
"name": "No SQL injection",
"result": "PASS",
"notes": "All queries use $1..$N placeholders."
},
{
"name": "No token leakage in logs",
"result": "PASS",
"notes": "Only hash is logged in audit; raw token only in email body and URL."
},
{
"name": "Brute-force resistance",
"result": "PASS",
"notes": "Token is 32 bytes hex (256 bits); rate limit per IP and email; 1h TTL."
},
{
"name": "Timing equalisation for non-existing email",
"result": "PASS",
"notes": "noUserDelay adds ~80ms before returning."
},
{
"name": "Replay protection",
"result": "PASS",
"notes": "Token marked used_at = now() in same logical operation; second confirm returns 400."
},
{
"name": "Auth/RBAC unchanged",
"result": "PASS",
"notes": "Both endpoints public; admin Send reset link goes through existing combined auth."
},
{
"name": "Dependencies",
"result": "PASS",
"notes": "No new packages."
}
],
"sast": "PASS",
"dependency_review": "PASS",
"secret_scan": "PASS",
"verdict_reason": "Reset flow meets the standard security baseline for forgotten-password flows.",
"reviewer": "security",
"reviewed_at": "2026-08-20T04:09:30Z"
}
"reviewed_at": "2026-08-20T04:09:30Z",
"agent": "security"
}