Security: sanitize git idents and profile links, revoke stale follows, org invitations, review permissions

AZ-A1: strip <>/newlines/control chars from display names at write time and in formatSignature/signatureNow
(and Co-authored-by trailers) so a PR author cannot forge the commit author mailbox or inject headers.
AZ-A2: profile/repo website validated as absolute http(s) and rendered via safeWebsiteUrl.
AZ-A6: stars/watches/thread subscriptions are purged on collaborator removal, org membership removal and
public->private; the dashboard feed re-applies the visibility clause.
AZ-A8: org members get the org's default permission (read by default) instead of write; adding a
non-member creates a 7-day invitation the user must accept (web + REST).
AZ-A9/A19: thread resolve requires write, PR author or thread author; locked PRs reject review writes from
readers; dismiss requires admin or the reviewer; review comments can be edited/deleted by author/admin;
org rosters can be restricted to members.
AZ-A16: unsubscribe links are per-category HMAC tokens with a 30-day expiry, revoked on password change;
security_alert mail has no unsubscribe link.

taigrrcommitted 13 days agoparent d60578d3cdfe787364b4b3079a950f146a30ef2eccf56d2Browse files