sandrodachandClaude Opus 5.5 9d9698186c fix(security): demo sends nothing, hidden SMTP password, body limits (FLAW-33..38) ...

- Demo: senders for mail, Discord and webhooks refuse, no alarm ticker;
  test alarm, SMTP test, server settings, backups, account and session
  changes of the shared demo accounts answer 403; the session list only
  shows the own device. The UI shows the notices and disables the controls.
- SMTP password is never sent back (smtpPassSet), empty keeps it.
- ?token= on webhook ingest accepts only API keys.
- Request bodies capped at 2 MB (sync 8 MB, imports 101 MB).
- Deleting an account removes its server backups.
- Backup downloads, exports and import uploads get 30 minutes.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

2026-10-29 19:43:23 +01:00

..

rest.md

fix(security): demo sends nothing, hidden SMTP password, body limits (FLAW-33..38)

2026-10-29 19:43:23 +01:00

websocket.md

docs: fresh review – new flaw list (FLAW-28 to 41) and feature ideas

2026-10-29 17:02:02 +01:00