Search results

🟠 [Launch-blocker] Missing security headers (XSS/clickjacking risk)

Status: Open.

#68 In serenakeyitan/tdoc;

· serenakeyitan opened on Jul 4, 2026

🟠 [Launch-blocker] Auth endpoint has no rate limiter (brute-force risk)

Status: Open.

#67 In serenakeyitan/tdoc;

· serenakeyitan opened on Jul 4, 2026

🟡 [Minor] Security improvements checklist

Status: Open.

#66 In serenakeyitan/tdoc;

· serenakeyitan opened on Jul 3, 2026

🟠 [Launch-blocker] Your CORS config welcomes the entire internet

Status: Open.

#65 In serenakeyitan/tdoc;

· serenakeyitan opened on Jul 3, 2026

🟠 [Launch-blocker] Your auth endpoint is a free brute-force playground

Status: Open.

#64 In serenakeyitan/tdoc;

· serenakeyitan opened on Jul 3, 2026

🟠 [Launch-blocker] You serve other people's HTML on your own origin with zero security headers

Status: Open.

#63 In serenakeyitan/tdoc;

· serenakeyitan opened on Jun 30, 2026

🟠 [Launch-blocker] Your auth endpoint is a free brute-force playground

Status: Open.

#62 In serenakeyitan/tdoc;

· serenakeyitan opened on Jun 30, 2026

[REVIEW] P3 backlog — 29 latent/hardening findings (tracking)

Status: Open.

#33 In serenakeyitan/tdoc;

· serenakeyitan opened on Jun 5, 2026

[REVIEW] 2758-line single-IIFE overlay with no module boundaries, no exports, no unit-testable surface

Status: Open.

#23 In serenakeyitan/tdoc;

· serenakeyitan opened on Jun 5, 2026