krz/gitbay

Rate limit keys by RemoteAddr, email add is unthrottled, repo owner has no foreign key #136

closed cmc opened this on 2026-09-03 05:17 UTC · ops security · milestone v1.9.0

Discussion

cmc 2026-09-03 05:17 UTC
  • internal/httpd/apilimit.go:108 keys anonymous callers by RemoteAddr. Correct with no proxy; wrong the day one is added, when every anonymous caller shares one bucket. Worth a config guard.
  • runEmailAdd enqueues verification mail with no per-account throttle. SSH auth and registration are rate-limited; this path is not.
  • repos.owner_id is polymorphic (migrations/0001_init.up.sql:57) with no foreign key; ownership integrity rests on the delete guards in DeleteUser (users.go:72) and DeleteOrg (orgs.go:182).

referenced in commit 993ef5f203 by cmc: http.trusted_proxies, and a cap on verification mail per account

2026-09-03 18:47 UTC

closed by commit efd3915bb0 by cmc: store: triggers refuse deleting an owner that still owns repositories

2026-09-03 22:24 UTC