Search results

[LOW] No rate limiting on any API endpoint

Status: Open.

#57 In profullstack/qryptchat-web;

· Danieliushka opened on Mar 24, 2026

[LOW] Telnyx webhook signature verification skipped when env var missing

Status: Open.

#56 In profullstack/qryptchat-web;

· Danieliushka opened on Mar 24, 2026

[MEDIUM] Debug logging of shared secrets and plaintext in production

Status: Open.

#55 In profullstack/qryptchat-web;

· Danieliushka opened on Mar 24, 2026

[MEDIUM] Deterministic salt from phone number enables pre-computation attacks

Status: Open.

#54 In profullstack/qryptchat-web;

· Danieliushka opened on Mar 24, 2026

[MEDIUM] HKDF used instead of PBKDF2 for password-based key derivation

Status: Open.

#53 In profullstack/qryptchat-web;

· Danieliushka opened on Mar 24, 2026

[HIGH] Conversation keys stored unencrypted in localStorage

Status: Open.

#52 In profullstack/qryptchat-web;

· Danieliushka opened on Mar 24, 2026

[HIGH] SQL injection risk in user search

Status: Open.

#51 In profullstack/qryptchat-web;

· Danieliushka opened on Mar 24, 2026

[HIGH] User lookup endpoint uses service role key without auth

Status: Open.

#50 In profullstack/qryptchat-web;

· Danieliushka opened on Mar 24, 2026

[HIGH] Plugin execute endpoint has no authentication

Status: Open.

#49 In profullstack/qryptchat-web;

· Danieliushka opened on Mar 24, 2026

[CRITICAL] Key padding/trimming silently corrupts ML-KEM keys

Status: Open.

#48 In profullstack/qryptchat-web;

· Danieliushka opened on Mar 24, 2026

[CRITICAL] Fallback encryption sends AES key in message payload

Status: Open.

#47 In profullstack/qryptchat-web;

· Danieliushka opened on Mar 24, 2026

[Security] QC-15: Extensive SECURITY DEFINER usage in Supabase functions

Status: Open.

#46 In profullstack/qryptchat-web;

· kai-agent-free opened on Mar 23, 2026