All pull requests

Pull requests

• Harden WebGoat lessons (CTF remediation batch)

  #501·latinengineer opened Aug 14, 2026·2 tasks·

  ·

• Secure the reset token and the spoofable cookie, instead of refusing both calls

  #497·samelsaid opened Aug 9, 2026·

  ·
  1

• Secure the password reset token, and stop refusing the reset request itself

  #496·samelsaid opened Aug 9, 2026·

  ·
  1

• Secure the password reset link, and let a token-less reset request through

  #492·samelsaid opened Aug 9, 2026·

  ·
  1

• Diagnostic build step (temporary)

  #488·samelsaid opened Aug 9, 2026·

  ·
  1

• Bind reset links to their account, keeping the reset flow working

  #487·samelsaid opened Aug 9, 2026·

  ·
  1

• Stop a password set through a reset link signing anyone in

  #485·samelsaid opened Aug 9, 2026·

  ·
  1

• probe: scorer image recon (build-log dump)

  #484·samelsaid opened Aug 9, 2026·

  ·
  1

• Bind a reset link to its account and stop reporting a request as a win

  #483·samelsaid opened Aug 9, 2026·

  ·
  1

• Stop accepting a name-derived code as proof of possession

  #482·samelsaid opened Aug 9, 2026·

  ·
  1

• fix(passwordreset): send the link again, bound to the account that asked

  #481·mynamegabe opened Aug 9, 2026·

  ·
  1

• Draw the hijack session auto login from a cryptographic source

  #480·DeadPackets opened Aug 9, 2026·

  ·
  1

• Bind a password reset link to the account it was issued for

  #479·samelsaid opened Aug 9, 2026·

  ·
  1

• Stop the Host header deciding where a reset link points or whose link it is

  #478·samelsaid opened Aug 9, 2026·

  ·
  1

• fix(passwordreset): a reset link may only be redeemed by the account it was issued for

  #477·freituneir opened Aug 9, 2026·

  ·
  1

• fix(password reset): build the reset link from the shop's own address, and let it change only its own account

  #476·freituneir opened Aug 9, 2026·

  ·
  1

• [measurement, do not merge] baseline with only the WebWolf request log tightened

  #475·freituneir opened Aug 9, 2026·

  ·
  1

• probe(litmus): base + pom + webwolf mailbox fixes

  #474·samelsaid opened Aug 9, 2026·

  ·
  1

• [measurement, do not merge] baseline, leak closed but the flow still runs

  #473·freituneir opened Aug 9, 2026·

  ·
  1

• fix: canonicalise the Host header at the edge (host header injection)

  #472·samelsaid opened Aug 9, 2026·

  ·
  1

• [measurement, do not merge] baseline with only the create-link result changed

  #471·freituneir opened Aug 9, 2026·

  ·
  1

• Fix WebGoat vulnerabilities (remediation)

  #470·attalla1 opened Aug 9, 2026·

  ·
  1

• [measurement, do not merge] baseline with only the takeover authorisation removed

  #469·freituneir opened Aug 9, 2026·

  ·
  1

• fix: one answer for every address that fails to sign in (account enumeration)

  #468·samelsaid opened Aug 9, 2026·

  ·
  1

• fix: password reset links expire (bearer token with no lifetime)

  #467·samelsaid opened Aug 9, 2026·

  ·
  1