Issues · unicodeveloper/globalthreatmap · GitHub

Labels Milestones New issue

/!\ Access token exposed on demo on railway

#43

· Hag-Zilla opened

on Apr 2, 2026

Docker image runs as root; no non-root user defined

#42

· Hag-Zilla opened

on Apr 2, 2026

No TLS enforcement, no `Strict-Transport-Security` header

#41

· Hag-Zilla opened

on Apr 2, 2026

In-memory singleton Valyu client shares a single API key across all requests

#40

· Hag-Zilla opened

on Apr 2, 2026

IDOR on deep-research task results — no ownership check

#39

· Hag-Zilla opened

on Apr 2, 2026

No input validation on user-supplied query parameters before forwarding to Valyu/OpenAI

#38

· Hag-Zilla opened

on Apr 2, 2026

No rate-limiting, no CORS policy, no CSP headers

#37

· Hag-Zilla opened

on Apr 2, 2026

Detailed third-party error responses forwarded to the client

#36

· Hag-Zilla opened

on Apr 2, 2026

`VALYU_CLIENT_SECRET` used with non-null assertion — crash when absent

#35

· Hag-Zilla opened

on Apr 2, 2026

Open proxy relay in `valyu-proxy` — no path allow-list

#34

· Hag-Zilla opened

on Apr 2, 2026

Bearer access token transmitted in URL query string (logged by every proxy/CDN)

#33

· Hag-Zilla opened

on Apr 2, 2026

NEXT_PUBLIC_MAPBOX_TOKEN` baked into the Docker image at build time

#32

· Hag-Zilla opened

on Apr 2, 2026