SA-005 addressed by updateing ratelimiting

2026-08-26 17:03:32 +02:00
parent c70850b44d
commit 27f26e615a
7 changed files with 114 additions and 9 deletions
@@ -171,6 +171,7 @@
 155. Remove the “New primary email address” functionality and keep only selecting an existing alternative as primary.
 166. Address SA-003 by using a dedicated secret key supplied through a protected environment/secret file, encrypt sensitive values before SQLite storage
 167. Address SA-004 by validating Mastodon instances as HTTPS public hostnames, rejecting unsafe DNS/IP ranges including mapped IPv6, and blocking redirects
+168. Implement SA-005: login endpoint lacks rate limiting and lockout
 167. Address SA-004 by validating Mastodon instances as HTTPS public hostnames, rejecting unsafe DNS/IP ranges including mapped IPv6, and blocking redirects.
 158. When the user is logged in the webplugin should not display "Please sign in to use LinkLog."
 156. When the user is signed in the plugin should not display "Please sign in to use LinkLog." and the link to the settings
@@ -179,6 +180,7 @@
 166. Address SA-003 by using a dedicated secret key supplied through a protected environment/secret file, encrypt sensitive values before SQLite storage
 161. The popup still shows the sign-in block even though the authenticated session text is displayed; show the block only when signed out.
 162. The authenticated session text and sign-in block are still shown together.
+163. Use the VIBE directory to log interactions.

 ## Future entries