raven

Files

John Cardinal 2004bf197a Security review pass 3: what customer contact users can reach

Confirmed on the local server as the seeded contact: any customer's work order
by id (F13), other customers' service requests (F14), the full customer list
with phones and emails through pick lists (F15), the whole service schedule
(F16). Candidates from code: notification subscriptions for another user (F17),
pick-list search text placed in SQL unescaped (F18). Review only, no code changes.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

2026-10-23 19:50:21 -07:00

security

Security review pass 1: scope, threat model, attack-surface map, first candidate findings

2026-10-23 18:00:18 -07:00

CODEBASE-REFERENCE.md

case 4690 - NET10-PORT survey: n/a items, evidence, resolve [unverified] markers

2026-10-22 13:57:56 -07:00

john-scratch-notes.txt

case 4690 - preparing project and organizing, all project ai markdown docs updated and notes for me

2026-10-22 12:01:23 -07:00

NET10-PORT.md

case 4690 - CLAUDE.md and NET10-PORT: port merged into main; release work continues on main