Steve Hanlon 51436dba6b beads: file security review findings (hc-gp3, hc-adg, hc-ufl) ...

Three issues from the 2026-07-16 security review:
- hc-gp3 (P2): API key echoed in settings input + plaintext in wp_options
- hc-adg (P2): recovery installer pulls unpinned 'latest' without signature
- hc-ufl (P3): no rate limiting on API or /dashboard, unrotated error_log

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

2026-07-16 11:15:02 +01:00

65 KiB

Raw Blame History

View Raw