Jonathan Kirkwood
3a4b7dfd8b
Pre-release audit fixes: - External Administrators can only act on investors already in their own funds (grant_access, create_statement, set_partner_exited, import match), closing a cross-fund account-takeover chain. - Role and is_active changes are gated: no self-escalation, non-approvers cannot mint or alter approver accounts, and the Service Admin is protected. - must_change_password is enforced server-side, not just in the client. - Session cookie is Secure with a 12h max-age and SameSite; CSP and standard security headers on every response; the app refuses to boot on a known or short session secret; uvicorn runs with proxy-headers so login throttling keys on the real client IP behind the platform proxy. - Import preview no longer confirms cross-fund investors; no-store on document downloads. - Adds backend/tests/test_security_hardening.py (15 tests); full suite 76 passing. - SECURITY-AUDIT.md records the swarm audit, findings, and remediation status.
20 lines
905 B
TypeScript
20 lines
905 B
TypeScript
import { VersionInfo } from '@start9labs/start-sdk'
|
|
|
|
export const v_0_2_46 = VersionInfo.of({
|
|
version: '0.2.46:0',
|
|
releaseNotes: {
|
|
en_US:
|
|
'Security hardening ahead of the investor release. External Administrators can now only ' +
|
|
'act on investors already in their own funds (closing a cross-fund account-takeover path). ' +
|
|
'Role and active-status changes are restricted so staff cannot escalate their own ' +
|
|
'permissions or alter the Service Admin. The forced first-login password change is now ' +
|
|
'enforced by the server, not just the browser. Session cookies are marked Secure with a ' +
|
|
'shorter lifetime, standard security headers are set on every response, and login ' +
|
|
'throttling now sees the real client address behind the platform proxy.',
|
|
},
|
|
migrations: {
|
|
up: async ({ effects }) => {},
|
|
down: async ({ effects }) => {},
|
|
},
|
|
})
|