Attack defenses, test scores and repair
- Open Admin > Security for 16 known attack families and controlled block-test scores. A score is passing assertions divided by attempted assertions, not a real-world block rate, threat coverage or security guarantee. Untested, stale and host-managed defenses have no percentage. The table shows request-guard and abuse-review switch state separately.
- With Tests permission, Run this test executes one safe synthetic category and saves separate timestamped results. Full regression deployment evidence is not replaced. All attack tests also appear under Feature tests and can be run locally with python scripts/test-release.py --suite attack-ID. SQL examples only issue a prepared SELECT; no live accounts, reports, emails, payment services or rules are changed.
- Admin > Help > Security contains every case, its source files, exact isolated command, repair/upgrade procedure and official OWASP references. Failures record the case source line and last successful case. Back up, fix in staging, run selected and full regression suites, and deploy through the controlled uploader. Never clear a failure by weakening a protection.
- Password checks now reject embedded NUL and over-72-byte aliases. Sessions expire after 30 minutes without authenticated requests or 12 hours total; background polling extends idle time but not total lifetime. Existing sessions migrate when next used. Cross-site form submissions are rejected even with a valid token, while older clients without Origin still require valid CSRF.
- Speed checks use scripts/speed-check.mjs with a short evidence label: 18 sequential public requests, three per endpoint, no concurrency or stress load. Results in .deployment include network/body latency and first-request variation, not Core Web Vitals or a host capacity guarantee. List/map photo references use one batched query without changing privacy.
- DDoS, DNS/network/email spoofing, zero-days, malware, stolen credentials and supply-chain threats require additional provider controls, patching and operational review. Application MFA and CAPTCHA remain unimplemented; no bank/payment feature was activated.
Open feature · All guides