Mauricio Siu 5ae344db58 fix(security): authenticate and authorize the GitHub App setup callback ... The /api/providers/github/setup callback performed privileged writes (persisting App client_secret/webhook_secret/private_key, re-pointing installations) with no session check, deriving the write target (organizationId/userId on gh_init, githubId on gh_setup) from the attacker-controlled state parameter. An unauthenticated request, or a member with no gitProviders permission, could plant or re-point a provider in any organization. Require a valid session, gate on the gitProviders permission (same guard the tRPC github router uses), derive the create target from the session, and verify the gh_setup provider belongs to the caller's organization.		2026-07-20 15:32:06 -06:00
..
api	Feat/tailwind v4 shadcn update (#4706)	2026-06-30 15:45:23 -06:00
dokploy	fix(security): authenticate and authorize the GitHub App setup callback	2026-07-20 15:32:06 -06:00
monitoring	fix: enhance container metrics query to support wildcard matching for container names	2026-03-08 16:16:45 -06:00
schedules	Feat/tailwind v4 shadcn update (#4706)	2026-06-30 15:45:23 -06:00