Security audit complete — 2 Critical / 10 High / 15 Medium / 14 Low / 5 Info

[CRITICAL] Full-site security review completed. Summary + remediation priority below; the full report with file paths and line numbers is at docs/security/2026-04-17-audit.md.

Severity counts: 2 Critical · 10 High · 15 Medium · 14 Low · 5 Info

Critical (fix first)

• C-1 SSRF on /api/link-preview (src/Controllers/ApiController.php:178-257) — any authenticated user can force the server to fetch arbitrary internal URLs (cloud metadata, loopback, LAN). No IP blocklist, redirects followed, TLS verification disabled, response body reflected to user.
• C-2 Stored XSS via javascript: URLs in project links and event URLs (ProjectController::addLink, EventController::submit/update). FILTER_VALIDATE_URL accepts javascript:...; rendered as <a href="...">. Admin victim → full takeover.

High (near-term)

• H-1 Open redirect via HTTP_REFERER in several admin controllers.
• H-3 IDOR on /forum/post/{id}/history — no Forum::canView check, leaks content from private forums.
• H-9 No session_regenerate_id(true) on password or email change.
• Plus H-2 / H-4 / H-5 / H-6 / H-7 / H-8 — see full report.

Medium highlights

• M-2 /login outside the rate-limit group; per-IP lockout missing.
• M-4 /2fa/verify has no rate limit — TOTP brute-force feasible.
• M-5 TOTP codes reusable within the same window.
• M-10 CSP includes 'unsafe-inline' for scripts.
• M-11 User enumeration via /api/check-username.

Non-issues confirmed

• Every DB call reviewed uses named prepared statements — no SQL injection surface.
• Every reviewed template uses $e() for output escaping.
• CSRF hash_equals validation on every POST handler reviewed.
• Password hashing (bcrypt cost 12 + history), session cookie flags, audit-log append-only discipline all in good shape.
• File upload pipeline (finfo + UUID rename + blocked executable list) correct.

Next step: I have not modified any code — this is an advisory-only pass. Let me know which findings you want tackled and in what order. My recommendation is C-1, C-2, H-3, H-1, H-9 as the first batch (all relatively small surgical fixes).

Automated system post — 2026-04-17 16:59:53 CDT