asepharyana 05a3bc7471 fix: audit round 4 — XSS in HTML report export, SSRF webhook guard, body limit ...

- ToHTML() now html.EscapeString on ticker, generated_at, section name/body, citations (stored/LLM content can't inject script into exported file)
- Discord destination webhook_url restricted to discord.com/discordapp.com hosts (SSRF guard: server POSTs alert cards; no private IPs or arbitrary hosts)
- Router middleware caps POST/PUT/PATCH bodies at 1 MiB (MaxBytesReader)
- TestDestinations updated: non-discord host must 422, uses realistic discord.com webhook URL

2026-09-16 14:43:56 +07:00

..

alerts.go

fix: empty JSON arrays instead of null for alerts/events/runs

2026-09-15 15:44:27 +07:00

api_test.go

fix: audit round 4 — XSS in HTML report export, SSRF webhook guard, body limit

2026-09-16 14:43:56 +07:00

auth.go

fix: audit round 2 — session cookie Secure kondisional, logout clear cookie, IDOR report owner-scoping (migrasi 0008), health force login-gate, SSE stream login-gate, FE: Gate undefined-flicker, auth-expired global redirect, X-User-Key demo dihapus, error handling alerts/routines/watchlist, chart label, encodeURIComponent, Screener onMount

2026-09-15 23:19:56 +07:00

chat.go

fix: audit round 3 — IDOR report-scoping, auth rate-limit, briefing chat scoping, DailyVolumes dedup, N+1 list routines, FE export/ask error handling

2026-09-16 14:12:32 +07:00

destinations.go

fix: audit round 4 — XSS in HTML report export, SSRF webhook guard, body limit

2026-09-16 14:43:56 +07:00

flow.go

fix: foreign_tickers selalu include semua ticker dengan foreign data (bukan hanya saat watchlist>60)

2026-09-16 01:29:01 +07:00

gated_test.go

fix: audit round 3 — IDOR report-scoping, auth rate-limit, briefing chat scoping, DailyVolumes dedup, N+1 list routines, FE export/ask error handling

2026-09-16 14:12:32 +07:00

health.go

fix: audit round 2 — session cookie Secure kondisional, logout clear cookie, IDOR report owner-scoping (migrasi 0008), health force login-gate, SSE stream login-gate, FE: Gate undefined-flicker, auth-expired global redirect, X-User-Key demo dihapus, error handling alerts/routines/watchlist, chart label, encodeURIComponent, Screener onMount

2026-09-15 23:19:56 +07:00

interrogate.go

fix: audit round 3 — IDOR report-scoping, auth rate-limit, briefing chat scoping, DailyVolumes dedup, N+1 list routines, FE export/ask error handling

2026-09-16 14:12:32 +07:00

portfolio.go

feat: default watchlist semua, login-gate fitur, CI anti-stale via /api/version

2026-09-15 22:12:09 +07:00

ratelimit.go

fix: audit round 3 — IDOR report-scoping, auth rate-limit, briefing chat scoping, DailyVolumes dedup, N+1 list routines, FE export/ask error handling

2026-09-16 14:12:32 +07:00

report.go

fix: audit round 2 — session cookie Secure kondisional, logout clear cookie, IDOR report owner-scoping (migrasi 0008), health force login-gate, SSE stream login-gate, FE: Gate undefined-flicker, auth-expired global redirect, X-User-Key demo dihapus, error handling alerts/routines/watchlist, chart label, encodeURIComponent, Screener onMount

2026-09-15 23:19:56 +07:00

routines.go

fix: audit round 3 — IDOR report-scoping, auth rate-limit, briefing chat scoping, DailyVolumes dedup, N+1 list routines, FE export/ask error handling

2026-09-16 14:12:32 +07:00

screen.go

fix: local ticker search for screener (Sectors companies/ 401s on sub)

2026-09-16 14:30:22 +07:00

server.go

fix: audit round 4 — XSS in HTML report export, SSRF webhook guard, body limit

2026-09-16 14:43:56 +07:00

static.go

feat: CI + Nix deploy + prod sectors-hackaton.asepharyana.my.id

2026-09-15 14:45:23 +07:00

stream.go

feat: add Citations and WatchlistChat components, integrate with API

2026-09-15 12:36:48 +07:00

version.go

fix: version commit dibaca live per-request + CI polling anti-stale 20x15s

2026-09-15 22:19:53 +07:00

watchlist.go

feat: add Citations and WatchlistChat components, integrate with API

2026-09-15 12:36:48 +07:00