You can not select more than 25 topics Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.

Wabo 5433aa4dc3 1.3.1 — address CodeQL alerts from initial scan ... Patch release covering the security findings from the repo's first CodeQL scan against 1.3.0: - Sanitise params[:path] before it flows into form action / link href in submissions_filters/_filter_modal (reflected XSS). - Slice required_params to email/phone before passing to find_by! / find_or_initialize_by in start_form_controller (column-name injection via template-owner-controlled link_form_fields preference). - Rewrite FULL_EMAIL_REGEXP local-part to remove the nested quantifier (ReDoS). - Replace the Bearer-token regex in mcp_controller with a string prefix check (polynomial ReDoS). - Swap Math.random()-based attachment UUIDs for crypto.randomUUID() in the submission-form Vue dropzone / signature / initials steps. - Add a workflow-level permissions: read-all block to ci.yml. See CHANGELOG.md [1.3.1] for the full per-alert breakdown and the list of CodeQL findings that are false positives in context. Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>		3 months ago
..
controllers	1.3.1 — address CodeQL alerts from initial scan	3 months ago
javascript	1.3.1 — address CodeQL alerts from initial scan	3 months ago
jobs	Wire SMS sending via BulkVS	3 months ago
mailers	Per-account product-name branding	3 months ago
models	1.3.1 — address CodeQL alerts from initial scan	3 months ago
views	1.3.1 — address CodeQL alerts from initial scan	3 months ago