The HTTPS listener sets no tls.Config.MinVersion or cipher policy (cmd/gitbayd/main.go); it relies on Go's defaults, which are sound in current Go but not stated anywhere an auditor can check.
- Set
MinVersion: tls.VersionTLS12explicitly and document it on the Admin page.
referenced in commit 4e0958a163 by cmc: plans: open issues from the architecture and UX reviews
2026-09-28 05:43 UTC