fix(security): SSRF, access control, and info disclosure#3815

Merged

waleedlatif1 merged 13 commits into

waleedlatif1/fix-pentest-auth

Mar 28, 2026

Commits on Mar 27, 2026

fix(security): scope copilot feedback GET endpoint to authenticated user

waleedlatif1
and
claude
committed
fix(smtp): add SSRF validation and genericize network error messages

waleedlatif1
and
claude
committed
fix(security): add SSRF validation to SFTP/SSH and access control to workspace invitations

waleedlatif1
and
claude
committed
fix(smtp): restore SMTP response code handling for post-connection errors

waleedlatif1
and
claude
committed
fix(security): use session email directly instead of extra DB query

waleedlatif1
and
claude
committed
lint
waleedlatif1
committed
fix(auth): revert lint autofix that broke hasExternalApiCredentials return type
waleedlatif1
committed

Commits on Mar 28, 2026