The LAN/IIS and Linux templates shipped a placeholder secret printed in the
manual, and installs that kept it signed logins with a public key; any setting
also invited short or reused values (security review F1). The setting is now
ignored (one warning at boot if still present): the server generates a key once
(48 random bytes) into jwt-signing.key in the data folder (beside the app if
there is none; owner-only on Linux) and reuses it, so sign-ins also survive a
restart where the server used to make a new key each boot (standalone, Linux
desktop). If the file cannot be used, a temporary key is used for that run.
Templates and dev launch configs drop the setting; manual updated (key page
rewritten, setting steps removed from install pages); changelog line.
Checked locally: token forged with the old placeholder 401; key file created
and reused after restart (old token 200); auth and 2FA tests pass.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
The 2FA step matched the user by temp token alone, and the token was left
empty after a successful 2FA login (null right after turning 2FA on), so an
empty or missing token skipped the password step (security review F5).
Now: an empty or missing temp token is refused before the lookup; the token is
cleared to null after success; after 5 wrong codes the token is cleared, so the
password must be entered again (counted in memory per user).
Changelog: general security notice for self-hosted upgrades, and the one
behaviour change users can see. SECURITY-REVIEW.md: F5 fixed.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
4713 takes F28; 4698 folded into 4711; F2 moved into 4579 (now priority 00);
4665 moved to the release after.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
John's "next release" cases (exported 2026-10-24) listed in NET10-PORT.md;
SECURITY-REVIEW.md maps each finding to its case. F28 has no case yet.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
2FA turned off on the affected accounts until the F5/F41 fix; F42 key not
rotated now, moving it out of source is a later case; FastMail password
rotation after the old Sockeye server is retired.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
From code: the 2FA flaw (F5) is also in Sockeye and the business server (F41,
critical; mitigation: turn 2FA off until fixed); the licence-signing private
keys are hardcoded in Sockeye's source (F42); one-shot licence fetch by DB ID
(F39); trial request routes without rate limits (F40). Review only.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Hosted droplets have a restrictive cloud firewall (F36 re-rated low); standalone
PostgreSQL trust accepted (F37); default SuperUser password is deliberate for
trials, but the licensed-mode change is enforced by the client only (F9 note).
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
From code: AyaNova listens on all interfaces on plain HTTP 7575 in every
template, hosted droplets included, with no firewall from the setup script (F36);
standalone PostgreSQL trusts local connections (F37); Linux hardening (F38).
F2 confirmed and extended; F9 extended (hosted droplets start with the default
SuperUser password). Review only, no code changes.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
John's decision: DOMPurify to 2.5.x and Vuetify to the latest 2.x (2.6.16 as the
fallback if 2.7 does not build on Node 12.22.9), as an exception to the
front-end dependency rule, each proven by a full client build and Cypress.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
From code: some record text is rendered as HTML without escaping (F33); shipped
DOMPurify and Vuetify are behind on security fixes (F34, needs a decision on
front-end packages); headers, CORS, Swagger and keys in URLs (F35). npm audit
run read-only and triaged. Review only, no code or dependency changes.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
From code: F3 and F4 confirmed; F17 confirmed and re-rated medium (names and
links reach any address, no reports). New: SMTP certificate never checked (F30),
SMTP password returned to read-only roles (F31), SMTP credentials in the DEBUG
defaults of raven and sockeye source (F32; password to be rotated). Review only,
nothing sent.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
F27 (high, confirmed on the local server): restricted roles get whole work-order
items through report data, rendering and export. From code: users with change
rights on Customer can give contact logins any role (F28); server-info gives
the DB ID and licence to every login (F29). Remaining routes without a role
check found OK. Review only, no code changes.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
From code: KPI interval criterion placed in SQL unchecked, reachable by staff
down to TechRestricted (F26, critical). F18 (pick-list search text) completed
by code. Data-list filters, sort, ClientCriteria, saved filters, search, other
KPI criteria and remaining raw queries traced and found safe. Review only.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
From code: logo upload accepts any content type and is served inline from the
app's origin (F23); translation import has no role check (F24); attachment and
export gaps (F25). F21 extended to the log and backup download routes; backup
delete found safe. Review only, no code changes.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
F19 (critical, confirmed on the local server): report template import has no
role check, so any login, customer contacts included, can add a template whose
JavaScript runs in the server's browser. From code: F20 (templates get the
renderer's token, SuperUser for customer notification reports, and unrestricted
network access), F21 (download file names from the URL not checked; Windows),
F22 (minor job and template gaps). Review only, no code changes.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Routes the client calls for customer contacts, read from raven-client, with the
ownership check each id route needs, and the proposed shape of the fix
(allowlist in the token middleware plus per-route ownership checks).
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
John's decision: 8.3.0 is not released until every finding is fixed or
explicitly accepted. The review therefore runs before the release, not after.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
John's decision: urgent, "next release" cases before 8.3.0; hosted and
self-hosted installations equally. Recorded in SECURITY-REVIEW.md and in the
NET10-PORT.md list of cases for this release.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Confirmed on the local server as the seeded contact: any customer's work order
by id (F13), other customers' service requests (F14), the full customer list
with phones and emails through pick lists (F15), the whole service schedule
(F16). Candidates from code: notification subscriptions for another user (F17),
pick-list search text placed in SQL unescaped (F18). Review only, no code changes.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
F5 (critical, confirmed on the local server): the 2FA step accepts an empty or
missing temp token, so users with 2FA on can be logged into without a password.
F1 confirmed: with the placeholder secret a user's current token can be rebuilt.
F8 confirmed. New findings F6, F7, F9 to F12. Review only, no code changes.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Also removes the server-only /var/ayanova chown/chmod lines from the Linux desktop upgrade page.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
