Pull Request Explorer

Summary

Fix scope of IssueListEndpoint for guest created_by

Removes an authorization gap that let project guests view issues they didn’t author when requesting specific IDs, ensuring guests only see their own issues unless explicitly allowed.

Health Assessment

• • Quick review and single commit, but long cycle time suggests a backlog or scheduling delay rather than technical complexity.

Summary

Fix cross-project page-version read disclosure

Prevents users from accessing page versions in other projects within the same workspace, enhancing security.

Health Assessment

• • Quick review and single commit resolved a critical security issue within a week.

Summary

Fix ProjectMemberPermission SAFE_METHODS scoping

Corrects an authorization bug that allowed workspace members to access project-level data they shouldn't, tightening security and preventing data leaks.

Health Assessment

• • Security fix addressed quickly with a single review; comprehensive tests added to guard against regressions.

Summary

Fix workspace cycles/modules listing to project membership

Prevents workspace members from enumerating cycles and modules for private projects they are not part of, eliminating an information disclosure vulnerability.

Health Assessment

• • The PR had a long cycle time but a quick review and minimal rework, indicating a straightforward fix with limited scope.

Summary

Clean up React Doctor warnings in admin app

Improves admin app health by fixing 49 diagnostics, raising React Doctor score from 61 to 89, with no UI changes, enhancing accessibility and performance.

Health Assessment

• • Quick turnaround with minimal rework; AI‑assisted review helped identify issues swiftly.

Summary

Fix asset access control for project membership

This PR closes an IDOR vulnerability by restricting workspace asset operations to project members, preventing unauthorized access to project-bound assets.

Health Assessment

• • Security fix approved quickly after a single review; large code change but minimal iteration, indicating focused and efficient resolution of a critical access control issue.

Summary

Prevent ORM injection in issue endpoints

Validates group_by and sub_group_by parameters to block injection attacks, enhancing security and stability of issue listing endpoints.

Health Assessment

• • Security fix with immediate review and minimal rework; large code addition but straightforward.

Summary

Fix authz on member is_active toggle

Prevents project members from deactivating other members without proper permissions, eliminating a critical privilege escalation risk.

Health Assessment

• • The PR was addressed in a single commit with rapid review, indicating a focused, high‑impact security fix that was efficiently validated by AI‑assisted review.

Summary

Fix cross-tenant CycleIssue reassignment security

Prevents cross-tenant reassignment of cycle issues, securing the API against BOLA. Adds safeguards to ensure only authorized work items are reassigned within the same workspace and project.

Health Assessment

• • Quick review and minimal rework, but the fix addresses a critical security vulnerability, indicating high business impact.

Summary

Sanitize order_by on external API list endpoints

Fixes a security vulnerability by sanitizing order_by parameters to prevent data exfiltration and DoS attacks.

Health Assessment

• • Security fix required extensive testing; review was quick but overall cycle time was long due to integration and regression testing.

Summary

Fix project invitation scope to workspace

This fix prevents cross‑workspace project invitations by ensuring only validated project IDs are processed, addressing a high‑severity security vulnerability.

Health Assessment

• • The PR was reviewed immediately and merged after a single commit, indicating a straightforward fix with minimal friction.

Summary

Fix link security by normalizing href

Prevents XSS by blocking whitespace‑prefixed javascript URLs in editor links, enhancing user safety.

Health Assessment

• • Single commit, quick review, minimal changes, low risk

Summary

Block bot user logins to prevent unauthorized access

This PR blocks service accounts from interactive login, ensuring bots can only use API tokens, improving security and preventing accidental human impersonation.

Health Assessment

• • Fast turnaround with no rework indicates a straightforward bug fix with minimal risk.

Summary

Fix missing notifications for API issue actions

Ensures users receive timely notifications and emails when issues are created, updated, or assigned via the REST API, improving communication and reducing missed updates.

Health Assessment

• • Long cycle time due to delayed review, but minimal rework and low complexity.

Summary

Fix race condition in admin sign-up

Prevents duplicate admin creation during concurrent sign-ups, enhancing security and reliability.

Health Assessment

• • The PR was reviewed and fixed quickly with AI assistance, resulting in a fast cycle time and minimal rework.

Summary

Fix attachment security scope and ownership

Ensures attachments are only accessible by the correct issue, preventing unauthorized access and ownership changes, thereby protecting user data and maintaining integrity.

Health Assessment

• • Security fix merged quickly with minimal rework; single review and immediate merge indicate high confidence.

Summary

Prevent project invite email disclosure

Stops sensitive invitee email and token from being exposed to unauthenticated users, reducing data leakage risk.

Health Assessment

• • Single commit with immediate review and minimal changes; long cycle time likely due to scheduling rather than technical complexity.

Summary

Prevent shell injection in feature-deployment workflow

Fixes a security vulnerability in the feature deployment workflow by sanitizing inputs and preventing expression injection, protecting secrets and runner integrity.

Health Assessment

• • Merged within 26 hours with a single review, minimal changes, and no back‑and‑forth, indicating a smooth, low‑risk security fix.

Summary

Enforce workspace membership on entity-search

Adds a guard to the entity-search endpoint to ensure only workspace members can access search results, preventing cross-workspace enumeration. This fixes a security vulnerability (GHSA-32q3-mqpc-3mhv) and brings OSS parity with EE.

Health Assessment

• • Fast review and minimal changes indicate low complexity and quick resolution of a security issue.

Summary

Fix security: scope FileAsset queries to prevent IDOR

Removes cross‑project access to file assets, tightening security and preventing unauthorized data exposure. Ensures only workspace members can view or modify assets.

Health Assessment

• • Security fix required immediate review; minimal rework; long cycle time due to scheduling and backlog.