Harden rate-limit keys, signup answers, owner pages and briefing prices by ankurmans · Pull Request #37 · ankurmans/flockstack

ankurmans · 2026-11-01T18:00:16Z

Four hardening changes, each with a regression test.

Rate limits key on the address Cloudflare sets (cf-connecting-ip) before the client's x-forwarded-for.
On a newsletter that confirms signups, every address gets the same answer; nothing extra is sent to an address that is already subscribed.
/api-keys, /approvals and /agent-activity show an owner-only notice to team seats.
Setting a briefing's own prices is send-class, like raising its budget.

…swer

…'s, not a team seat's

ankurmans added 5 commits November 1, 2026 17:40

Rate limits: key on cf-connecting-ip before the client's x-forwarded-for

868a24f

Signup: on a newsletter that confirms, every address gets the same an…

2d83abd

…swer

Dashboard: API keys, approvals and agent activity pages are the owner…

a7c063f

…'s, not a team seat's

Briefings: setting prices waits for approval like raising the budget

57a7fe7

Merge origin/main into security/hardening-b

f7ed666

Navigation Menu