Mauricio Siu 68ea9f7771 fix(security): redact git provider secrets from application.one response ...

findApplicationById eagerly loads the github/gitlab/gitea/bitbucket relations
(needed server-side to clone) including OAuth tokens, the GitHub App private key
and webhook secret. application.one returned them to the client, exposing them to
any member with service:read even when hasGitProviderAccess was false.

Adds redactApplicationGitSecrets() in the application service (blanks the secret
columns, immutably) and applies it to application.one. No client feature reads
these secrets (verified in the frontend); server-side clone paths use
findApplicationById directly, so behaviour is unchanged.

Closes GHSA-hg9j-j5mc-phf5, GHSA-wx75-vxph-2m2f

2026-07-19 21:28:02 -06:00

..

api

Feat/tailwind v4 shadcn update (#4706)

2026-06-30 15:45:23 -06:00

dokploy

fix(security): redact git provider secrets from application.one response

2026-07-19 21:28:02 -06:00

monitoring

fix: enhance container metrics query to support wildcard matching for container names

2026-03-08 16:16:45 -06:00

schedules

Feat/tailwind v4 shadcn update (#4706)

2026-06-30 15:45:23 -06:00