All pull requests

Pull requests

• fix(auth): verify signed OAuth state and GitHub identity in private task callback (#1626)

  #1661·alfredoalvarado53-ui opened Nov 10, 2026·

  ·
  1

• fix(security): prevent unauthenticated email relay on task invite, funding, and report (#1624)

  #1660·alfredoalvarado53-ui opened Nov 10, 2026·

  ·
  1

• fix(security): prevent IDOR in PUT /wallets/:id (#1622)

  #1659·alfredoalvarado53-ui opened Nov 10, 2026·

  ·
  1

• fix(security): prevent IDOR in order and wallet-order read endpoints (#1625)

  #1658·alfredoalvarado53-ui opened Nov 10, 2026·

  ·
  1

• fix(plan): preserve feePercentage=0 for open source bounties >= 5000 (#1655)

  #1657·alfredoalvarado53-ui opened Nov 10, 2026·

  ·
  1

• Charge no fee on invoices for open source bounties of 5000 or more

  #1656·5eBeKs opened Nov 7, 2026·

  ·
  1

• fix(tasks): return authoritative payment state after update (#1200)

  #1654·ameenalqershi opened Nov 7, 2026·

  ·
  1

• build(deps): bump lodash from 4.17.23 to 4.18.1

  dependenciesjavascript
  #1653·dependabot[bot] opened Nov 4, 2026Bot·

  ·

• fix(tasks): enforce owner authorization on task assignment removal (#1623)

  #1652·alfredoalvarado53-ui opened Nov 4, 2026·

  ·
  1

• build(deps): bump postcss-selector-parser in /frontend

  dependenciesjavascript
  #1651·dependabot[bot] opened Nov 1, 2026Bot·

  ·

• build(deps): bump fast-uri from 3.1.2 to 3.1.9 in /frontend

  dependenciesjavascript
  #1650·dependabot[bot] opened Oct 31, 2026Bot·

  ·

• build(deps): bump fast-uri from 3.1.2 to 3.1.9

  dependenciesjavascript
  #1649·dependabot[bot] opened Oct 31, 2026Bot·

  ·

• build(deps): bump undici from 7.28.0 to 7.30.1 in /frontend

  dependenciesjavascript
  #1648·dependabot[bot] opened Oct 30, 2026Bot·

  ·

• fix(orders): enforce wallet ownership in wallet-funded order creation (IDOR)

  #1647·zF4ke opened Oct 29, 2026·

  ·
  1

• fix(security): prevent IDOR in wallet-funded order creation (#1613)

  #1646·alfredoalvarado53-ui opened Oct 29, 2026·

  ·
  1

• build(deps): bump body-parser

  dependenciesjavascript
  #1645·dependabot[bot] opened Oct 28, 2026Bot·

  ·

• fix(security): enforce order ownership in POST /orders/:id/payments (#1627)

  #1644·alfredoalvarado53-ui opened Oct 28, 2026·

  ·
  1

• Fix organization task sorting before pagination

  #1643·newworldba opened Oct 27, 2026·

  ·
  1

• fix: authorize and cap task payments

  #1642·newworldba opened Oct 27, 2026·

  ·
  1

• fix: scope order read endpoints to owner

  #1641·newworldba opened Oct 27, 2026·

  ·
  1

• fix: require wallet ownership on update

  #1640·newworldba opened Oct 27, 2026·

  ·
  1

• fix(security): enforce task ownership check in removeAssignedUser (#1623)

  #1639·boumarate opened Oct 27, 2026·

  ·
  1

• fix: resolve #1623 - [Bug]: Missing ownership check in PUT /tasks/{id}/assignment

  #1638·fangjian-bit opened Oct 27, 2026·

  ·
  1

  1

• fix: resolve #1613 - GitPay Security Finding #1613

  #1637·fangjian-bit opened Oct 27, 2026·

  ·
  1

  1

• fix: resolve #1626 - [Bug]: Unverified userId query parameter in /callback/github

  #1636·fangjian-bit opened Oct 27, 2026·

  ·
  1

  2