48 lines
1.5 KiB
JSON
48 lines
1.5 KiB
JSON
[
|
|
{
|
|
"bug_id": "IDOR / Missing Auth",
|
|
"previous_issue": "Unauthenticated client can send messages/turns to any session ID",
|
|
"current_status_code": 200,
|
|
"fixed": false,
|
|
"evidence": "Request to /v1/onboarding/ONB-270B683F/message returned status code 200 (Expected 401/403)"
|
|
},
|
|
{
|
|
"bug_id": "Session Hard Deletion",
|
|
"previous_issue": "Completed session is hard-deleted from DB, causing misleading 404 error on second call",
|
|
"current_status_code": 404,
|
|
"fixed": false,
|
|
"evidence": "Second call to /complete returned status 404, body: {'detail': 'Onboarding session not found'}"
|
|
},
|
|
{
|
|
"bug_id": "CORS Policy",
|
|
"previous_issue": "Access-Control-Allow-Origin: * combined with Access-Control-Allow-Credentials: true",
|
|
"current_status_code": 200,
|
|
"fixed": false,
|
|
"evidence": "Access-Control-Allow-Origin: '*', Access-Control-Allow-Credentials: 'true'"
|
|
},
|
|
{
|
|
"bug_id": "Age Validation",
|
|
"previous_issue": "Negative age (age = -50) accepted with 200 OK",
|
|
"current_status_code": 200,
|
|
"fixed": false,
|
|
"evidence": "POST /v1/onboarding/start with age=-50 returned status code 200"
|
|
},
|
|
{
|
|
"bug_id": "Rate Limiting",
|
|
"previous_issue": "No rate limiting attached to session creation / AI endpoints",
|
|
"current_status_code": [
|
|
200,
|
|
200,
|
|
200,
|
|
200,
|
|
200,
|
|
200,
|
|
200,
|
|
200,
|
|
200,
|
|
200
|
|
],
|
|
"fixed": false,
|
|
"evidence": "Status codes for 10 rapid requests: [200, 200, 200, 200, 200, 200, 200, 200, 200, 200]"
|
|
}
|
|
] |