Unclaimed security issues

Is your feature request related to a problem? Please describe. Currently, the project does not include fuzz tests. This means certain classes of bugs—such as unexpected input handling issues, parsing errors, or edge-case crashes—may go undetected during regular unit or…

The CLI adds a --<check> flag for every enabled check (bin/site-inspector:29-31). The README lists only https, hsts, headers, dns and content (README.md:42-53), and leaves out accessibility, cookies, wappalyzer, wellknown and whois. "What's checked" also has gaps: It has no…

RFC 6797 §6.1.1 makes max-age a required directive. valid? only checks that the header isn't empty and has no stray quotes or whitespace (lib/site-inspector/endpoint/hsts.rb:10-14), so Strict-Transport-Security: includeSubDomains is reported as valid. Acceptance criteria: valid?…

Hsts#preload_ready? checks max_age >= 10_886_400 (18 weeks) (lib/site-inspector/endpoint/hsts.rb:34-37). hstspreload.org now requires at least 31536000 seconds (1 year), so site-inspector reports hsts_preload_ready: true for domains the preload list would reject. Acceptance…

I want to allow users to login to openbao They would do it from the app. I have their email, and it would be nice if I could url_encode their email and it would be a valid username. The restriction that it can only be alphanumeric characters seems arbitrary, and I would love an…

Current Behavior If you have someone who shall set up new projects for teams (including project, alert rules), currently he requires full admin permissions to create them. Proposed Behavior There should be a permission ALERT_RULE_CONFIGURATION which does allow creation and…

This is another pedantic/auditor-only audit most likely: we should flag when a job's runs-on references a pretty old image, e.g. uses: ubuntu-20.04. Ideally we'd do this via a service like https://endoflife.date, if they have a dataset for this.

While InMem is useful for dev mode server, we should drop inmemha backend and switch to PostgreSQL everywhere. I think we can speed up creation of this by a reused global test server, using unique table prefixes for everything. This is only used in the test suite.

Add TypeInfoKind::Error for type poisoning (like rustc's TyKind::Error): pub enum TypeInfoKind { // ... existing variants Error, // Represents a type that couldn't be resolved } Benefits: Prevents cascading errors when a type lookup fails Allows type checking to continue more…