SQL injection, path traversal, SSRF, and auth brute-force security fixes - #504

Merged

DeFiVC merged 6 commits into

ChainLearnOfficial:mainfrom

theladyanina:fix/chainlearn-api-assigned-batch

Sep 30, 2026

Commits on Sep 29, 2026

fix(security): remove sql.raw() from enrollment trends query (#485)
theladyanina
committed
fe146e6
fix(security): harden avatar path resolution against traversal (#486)
theladyanina
committed
86632d5
fix(security): block SSRF-prone webhook URLs at creation time (#487)
theladyanina
committed
82dfec2
feat(security): add per-account auth lockout with escalating delay (#488)
theladyanina
committed
40cfb53
test(auth): mock ttl/incr/expire/del on redis for auth lockout (#488)
theladyanina
committed
3ea6740

Commits on Sep 30, 2026

Merge branch 'main' into fix/chainlearn-api-assigned-batch
DeFiVC
authored
ea5df99