Security Hall of Fame

Third-party chat widget loaded on token-bearing routes — URL tokens leaked to analytics endpoint

Master key API hardening — overwrite/null protection, Content Security Policy tightening, and share-endpoint error normalization

Login endpoint brute-force protection bypass — identified non-enforcing rate limiting on authentication endpoint

Master key API endpoint hardening — credential exposure in query strings (CWE-598) and missing rate limiting

Direct IP access exposure and PostgreSQL public port exposure — infrastructure hardening

Fixed critical 2FA authentication bypass — secured completion endpoint with signed, time-limited verification tokens

Session security hardening — logout token revocation, no-cache headers, session replay protection

Session invalidation on password change, email enumeration protection

Multiple authentication and session security improvements