Search results

[SECURITY] No request size limiting on API endpoints - DoS vulnerability

Status: Open.

#331 In geturbackend/urBackend;

· Siddh2024 opened on Jun 20, 2026

[Bug] public-api: bulk insert endpoint silently injects isDeleted/deletedAt fields into validated data after stripping them

Status: Open.

#287 In geturbackend/urBackend;

· Kirtan-pc opened on Jun 7, 2026

[Security] verifyApiKey: cached project document includes sensitive fields — cache bypass exposes stale allowedDomains

Status: Open.

#286 In geturbackend/urBackend;

· Kirtan-pc opened on Jun 7, 2026

[Bug] public-api: Log.create in api_usage.js is fire-and-forget without error isolation — unhandled rejection can crash the logger

Status: Open.

#283 In geturbackend/urBackend;

· Kirtan-pc opened on Jun 7, 2026

[SECURITY] Add IP allowlist/denylist per project — restrict API access to specific IP ranges for enhanced access control

Status: Open.

#280 In geturbackend/urBackend;

· Abhushan187 opened on Jun 6, 2026

[FEATURE] Add collection-level data validation rules — enforce schema constraints (min/max length, regex, required fields) before insert/update

Status: Open.

#279 In geturbackend/urBackend;

· Abhushan187 opened on Jun 6, 2026

[FEATURE] Implement API key rotation flow — allow users to regenerate pk_live/sk_live without invalidating existing sessions

Status: Open.

#277 In geturbackend/urBackend;

· Abhushan187 opened on Jun 6, 2026

[FEATURE] Add webhook retry mechanism with exponential backoff for failed webhook deliveries

Status: Open.

#276 In geturbackend/urBackend;

· Abhushan187 opened on Jun 6, 2026

[Bug] public-api: updateSingleData quota check is susceptible to TOCTOU race — concurrent updates can collectively exceed the database limit

Status: Open.

#260 In geturbackend/urBackend;

· anshul23102 opened on Jun 2, 2026

[Bug] dashboard-api: getGlobalStats opens N sequential MongoDB connections to count users — one per project

Status: Open.

#259 In geturbackend/urBackend;

· anshul23102 opened on Jun 2, 2026

[Bug] dashboard-api: INCR and EXPIRE in dbExport are not atomic — export quota key can persist without TTL if process crashes

Status: Open.

#258 In geturbackend/urBackend;

· anshul23102 opened on Jun 2, 2026

[Bug] dashboard-api: dbExport daily limit check has TOCTOU race — concurrent requests can bypass per-day export cap

Status: Open.

#255 In geturbackend/urBackend;

· anshul23102 opened on Jun 2, 2026