You cannot select more than 25 topics Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.

Thomas Joise 54cde7961b fix(sec/d24): gate destructive/sensitive ops to managerial ... Red-team authorization findings: - New requireManagerial middleware. Applied to POST /documents/:id/cancel, /credit-note (financially destructive — reverse money / consume a number) and /documents/:id/share (mints an UNAUTHENTICATED public PDF link — the IDOR exfiltration high). Any signed-in staff could previously do all three. - PATCH /interactions/:id now 403s unless the viewer is the interaction's author or managerial — staff can no longer overwrite another employee's logged call/visit. New authz-gates test locks both. Note (deliberate): general client read/edit stays open to staff — a shared support-team book is the intended model; the genuinely sensitive credential reveals are already managerial + rate-limited. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>		4 days ago
..
scripts	feat(d20): importer v2 rework from the 46-agent real-data audit	4 days ago
src	fix(sec/d24): gate destructive/sensitive ops to managerial	4 days ago
test	fix(sec/d24): gate destructive/sensitive ops to managerial	4 days ago
.env.example	chore: commit pending working-tree improvements (env doc + headless-Chromium container flags)	4 days ago
build-server.mjs	feat(hq): server assembly, build script and e2e smoke (HQ-1 task 14)	2 weeks ago
package.json	feat(d20): P4 — full-APEX importer v2 (9 files, stage/commit, CLI)	4 days ago
schema.sql	docs+chore: HQ DDL snapshot, gitignored import-drop, Postgres locked pre-go-live (D15)	2 weeks ago
tsconfig.json	feat(hq): app skeleton with health endpoint (HQ-1 task 1)	2 weeks ago