6fd5f3d393
fix(encrypted-p2p-chat): apply audit findings — true E2EE, session auth, spec-correct crypto
...
This commit applies the actionable plan from docs/plans/2026-04-29-encrypted-p2p-chat-audit-fixes.md.
Backend
- Delete server-side X3DH/Double Ratchet (`app/core/encryption/*`); the server is now an opaque relay for client-encrypted messages.
- Drop `private_key` columns from IdentityKey/SignedPrekey/OneTimePrekey; prekey-bundle endpoint serves only public material.
- Remove RatchetState and SkippedMessageKey models and the deprecated server-encryption code path in message_service.
- Fix the broken `not OneTimePrekey.is_used` SQL filter (`Column.is_(False)` instead of Python `not`); repair the silent OPK-replenish amplification by deleting the server-generated path entirely.
- Stop calling `prekey_service.initialize_user_keys` from registration/login. Server never holds private key material again.
- Add session-cookie auth: opaque token issued in Redis on register/auth complete, `current_user` dependency on every protected route, `/auth/me`, `/auth/logout`. WebSocket authenticates via the same cookie.
- Add room membership checks to WS encrypted_message + typing handlers, GET/DELETE /rooms/{id}, GET /rooms/{id}/messages. broadcast_to_room now filters by participants, not presence.
- Add slowapi rate limits to register/auth/search; per-user sliding-window cap on WS messages.
- WebAuthn: replace username with a 64-byte random `webauthn_user_handle` for `user.id`; fix `backup_eligible` to read `credential_backup_eligible`; switch UserVerificationRequirement to REQUIRED; key authentication challenges by challenge bytes (no more "discoverable" collision).
- Implement GET /rooms/{id} and DELETE /rooms/{id} (cascade delete with ownership check) and fix the N+1 in list_rooms by batching User lookups.
- Remove broken/obsolete tests; add regression tests for the OPK filter bug and session-protected endpoints (401 without cookie).
- Sanitize WebSocket error responses; correlation IDs replace stack-trace leaks.
Frontend
- X3DH: prepend the 32-byte 0xff F prefix to the HKDF input per spec section 2.2.
- Double Ratchet: switch KDF_RK to spec form (HKDF salt=root_key, IKM=dh_output) and use 0x01/0x02 byte tags for KDF_CK.
- Replace base64 helpers in `crypto/primitives.ts` with the URL-safe codec from `lib/base64.ts` (single source of truth, no spread-stack hazard).
- Update auth.service to issue a session via cookies (no more dead token store), call `/auth/me` on app boot, clear crypto state on logout. Delete unused `session.store.ts`.
- Update room.service / Chat page to drop client-supplied user_id arguments; the cookie now identifies the caller.
- Better forward-secrecy UX text for messages predating the device.
- Add Vitest with X3DH and Double Ratchet round-trip + tamper-detection tests.
Tooling
- Add `slowapi>=0.1.9` to backend deps; add `vitest` to frontend devDeps with `pnpm test` script.
- justfile: `test-frontend`, `dev-reset`.
- Adjust `.gitignore` so the Python `lib/` rules no longer hide `frontend/src/lib`.
Migration: existing dev volumes hold private-key columns and KDF-incompatible ratchet states; run `just dev-reset` and re-register before hitting the new code path.
2026-04-29 02:30:10 -04:00
ee684e5307
Merge pull request #196 from CarterPerez-dev/dependabot/pip/PROJECTS/intermediate/api-security-scanner/backend/python-multipart-0.0.26
...
chore(deps): bump python-multipart from 0.0.21 to 0.0.26 in /PROJECTS/intermediate/api-security-scanner/backend
2026-04-26 23:55:34 -04:00
30fa1ce440
chore(deps): bump python-multipart
...
Bumps [python-multipart](https://github.com/Kludex/python-multipart ) from 0.0.21 to 0.0.26.
- [Release notes](https://github.com/Kludex/python-multipart/releases )
- [Changelog](https://github.com/Kludex/python-multipart/blob/main/CHANGELOG.md )
- [Commits](https://github.com/Kludex/python-multipart/compare/0.0.21...0.0.26 )
---
updated-dependencies:
- dependency-name: python-multipart
dependency-version: 0.0.26
dependency-type: direct:production
...
Signed-off-by: dependabot[bot] <support@github.com>
2026-04-27 03:54:00 +00:00
eb1cdb4671
Merge pull request #190 from CarterPerez-dev/dependabot/uv/PROJECTS/advanced/ai-threat-detection/backend/python-dotenv-1.2.2
...
chore(deps): bump python-dotenv from 1.2.1 to 1.2.2 in /PROJECTS/advanced/ai-threat-detection/backend
2026-04-26 23:53:53 -04:00
e8ab86fb68
Merge pull request #192 from CarterPerez-dev/dependabot/uv/PROJECTS/intermediate/dlp-scanner/lxml-6.1.0
...
chore(deps): bump lxml from 6.0.2 to 6.1.0 in /PROJECTS/intermediate/dlp-scanner
2026-04-26 23:53:37 -04:00
4478c8a6a5
Merge pull request #189 from CarterPerez-dev/dependabot/uv/PROJECTS/advanced/encrypted-p2p-chat/backend/python-dotenv-1.2.2
...
chore(deps): bump python-dotenv from 1.2.1 to 1.2.2 in /PROJECTS/advanced/encrypted-p2p-chat/backend
2026-04-26 23:52:07 -04:00
d40293490e
Merge pull request #188 from CarterPerez-dev/dependabot/uv/PROJECTS/beginner/c2-beacon/backend/python-dotenv-1.2.2
...
chore(deps): bump python-dotenv from 1.2.1 to 1.2.2 in /PROJECTS/beginner/c2-beacon/backend
2026-04-26 23:51:57 -04:00
ceb1f28d4d
Merge pull request #187 from CarterPerez-dev/dependabot/pip/PROJECTS/intermediate/api-security-scanner/backend/python-dotenv-1.2.2
...
chore(deps): bump python-dotenv from 1.2.1 to 1.2.2 in /PROJECTS/intermediate/api-security-scanner/backend
2026-04-26 23:51:47 -04:00
d962a5de88
Merge pull request #186 from CarterPerez-dev/dependabot/uv/PROJECTS/advanced/bug-bounty-platform/backend/python-dotenv-1.2.2
...
chore(deps): bump python-dotenv from 1.2.1 to 1.2.2 in /PROJECTS/advanced/bug-bounty-platform/backend
2026-04-26 23:51:36 -04:00
52f48cf6bd
Merge pull request #185 from CarterPerez-dev/auto/update-fullstack-template
...
chore: update fullstack-template submodule
2026-04-26 23:51:25 -04:00
8350f9139e
Merge pull request #191 from CarterPerez-dev/dependabot/uv/PROJECTS/beginner/metadata-scrubber-tool/lxml-6.1.0
...
chore(deps): bump lxml from 6.0.2 to 6.1.0 in /PROJECTS/beginner/metadata-scrubber-tool
2026-04-26 23:51:10 -04:00
6e29b0b386
Merge pull request #193 from CarterPerez-dev/dependabot/cargo/PROJECTS/intermediate/binary-analysis-tool/backend/rand-0.8.6
...
chore(deps): bump rand from 0.8.5 to 0.8.6 in /PROJECTS/intermediate/binary-analysis-tool/backend
2026-04-26 23:50:57 -04:00
2e5c0e1fe6
Merge pull request #195 from CarterPerez-dev/dependabot/uv/PROJECTS/advanced/ai-threat-detection/backend/gitpython-3.1.47
...
chore(deps): bump gitpython from 3.1.46 to 3.1.47 in /PROJECTS/advanced/ai-threat-detection/backend
2026-04-26 23:50:32 -04:00
07d3b3967c
chore(deps): bump gitpython
...
Bumps [gitpython](https://github.com/gitpython-developers/GitPython ) from 3.1.46 to 3.1.47.
- [Release notes](https://github.com/gitpython-developers/GitPython/releases )
- [Changelog](https://github.com/gitpython-developers/GitPython/blob/main/CHANGES )
- [Commits](https://github.com/gitpython-developers/GitPython/compare/3.1.46...3.1.47 )
---
updated-dependencies:
- dependency-name: gitpython
dependency-version: 3.1.47
dependency-type: indirect
...
Signed-off-by: dependabot[bot] <support@github.com>
2026-04-26 01:24:42 +00:00
246462e565
chore(deps): bump rand
...
Bumps [rand](https://github.com/rust-random/rand ) from 0.8.5 to 0.8.6.
- [Release notes](https://github.com/rust-random/rand/releases )
- [Changelog](https://github.com/rust-random/rand/blob/0.8.6/CHANGELOG.md )
- [Commits](https://github.com/rust-random/rand/compare/0.8.5...0.8.6 )
---
updated-dependencies:
- dependency-name: rand
dependency-version: 0.8.6
dependency-type: indirect
...
Signed-off-by: dependabot[bot] <support@github.com>
2026-04-23 02:41:33 +00:00
93567c1450
chore(deps): bump lxml in /PROJECTS/intermediate/dlp-scanner
...
Bumps [lxml](https://github.com/lxml/lxml ) from 6.0.2 to 6.1.0.
- [Release notes](https://github.com/lxml/lxml/releases )
- [Changelog](https://github.com/lxml/lxml/blob/master/CHANGES.txt )
- [Commits](https://github.com/lxml/lxml/compare/lxml-6.0.2...lxml-6.1.0 )
---
updated-dependencies:
- dependency-name: lxml
dependency-version: 6.1.0
dependency-type: direct:production
...
Signed-off-by: dependabot[bot] <support@github.com>
2026-04-21 23:13:03 +00:00
c122bcd914
chore(deps): bump lxml in /PROJECTS/beginner/metadata-scrubber-tool
...
Bumps [lxml](https://github.com/lxml/lxml ) from 6.0.2 to 6.1.0.
- [Release notes](https://github.com/lxml/lxml/releases )
- [Changelog](https://github.com/lxml/lxml/blob/master/CHANGES.txt )
- [Commits](https://github.com/lxml/lxml/compare/lxml-6.0.2...lxml-6.1.0 )
---
updated-dependencies:
- dependency-name: lxml
dependency-version: 6.1.0
dependency-type: indirect
...
Signed-off-by: dependabot[bot] <support@github.com>
2026-04-21 23:10:02 +00:00
066ab85b34
chore(deps): bump python-dotenv
...
Bumps [python-dotenv](https://github.com/theskumar/python-dotenv ) from 1.2.1 to 1.2.2.
- [Release notes](https://github.com/theskumar/python-dotenv/releases )
- [Changelog](https://github.com/theskumar/python-dotenv/blob/main/CHANGELOG.md )
- [Commits](https://github.com/theskumar/python-dotenv/compare/v1.2.1...v1.2.2 )
---
updated-dependencies:
- dependency-name: python-dotenv
dependency-version: 1.2.2
dependency-type: indirect
...
Signed-off-by: dependabot[bot] <support@github.com>
2026-04-21 22:42:21 +00:00
9bfb93e161
chore(deps): bump python-dotenv
...
Bumps [python-dotenv](https://github.com/theskumar/python-dotenv ) from 1.2.1 to 1.2.2.
- [Release notes](https://github.com/theskumar/python-dotenv/releases )
- [Changelog](https://github.com/theskumar/python-dotenv/blob/main/CHANGELOG.md )
- [Commits](https://github.com/theskumar/python-dotenv/compare/v1.2.1...v1.2.2 )
---
updated-dependencies:
- dependency-name: python-dotenv
dependency-version: 1.2.2
dependency-type: indirect
...
Signed-off-by: dependabot[bot] <support@github.com>
2026-04-21 22:39:46 +00:00
67e59f2255
chore(deps): bump python-dotenv in /PROJECTS/beginner/c2-beacon/backend
...
Bumps [python-dotenv](https://github.com/theskumar/python-dotenv ) from 1.2.1 to 1.2.2.
- [Release notes](https://github.com/theskumar/python-dotenv/releases )
- [Changelog](https://github.com/theskumar/python-dotenv/blob/main/CHANGELOG.md )
- [Commits](https://github.com/theskumar/python-dotenv/compare/v1.2.1...v1.2.2 )
---
updated-dependencies:
- dependency-name: python-dotenv
dependency-version: 1.2.2
dependency-type: indirect
...
Signed-off-by: dependabot[bot] <support@github.com>
2026-04-21 22:37:58 +00:00
714909034e
chore(deps): bump python-dotenv
...
Bumps [python-dotenv](https://github.com/theskumar/python-dotenv ) from 1.2.1 to 1.2.2.
- [Release notes](https://github.com/theskumar/python-dotenv/releases )
- [Changelog](https://github.com/theskumar/python-dotenv/blob/main/CHANGELOG.md )
- [Commits](https://github.com/theskumar/python-dotenv/compare/v1.2.1...v1.2.2 )
---
updated-dependencies:
- dependency-name: python-dotenv
dependency-version: 1.2.2
dependency-type: direct:production
...
Signed-off-by: dependabot[bot] <support@github.com>
2026-04-21 22:33:34 +00:00
f533b41b06
chore(deps): bump python-dotenv
...
Bumps [python-dotenv](https://github.com/theskumar/python-dotenv ) from 1.2.1 to 1.2.2.
- [Release notes](https://github.com/theskumar/python-dotenv/releases )
- [Changelog](https://github.com/theskumar/python-dotenv/blob/main/CHANGELOG.md )
- [Commits](https://github.com/theskumar/python-dotenv/compare/v1.2.1...v1.2.2 )
---
updated-dependencies:
- dependency-name: python-dotenv
dependency-version: 1.2.2
dependency-type: indirect
...
Signed-off-by: dependabot[bot] <support@github.com>
2026-04-21 22:33:33 +00:00
10cb67a7e8
chore: update fullstack-template submodule
2026-04-20 00:25:31 +00:00
83e3b2b762
Merge pull request #184 from CarterPerez-dev/chore/ai-threat-detection-finish
...
chore complete + add pre commit chnages
2026-04-19 18:55:59 -04:00
dc6567ae25
chore complete + add pre commit chnages
2026-04-19 18:54:08 -04:00
b6f75db1a7
Update README.md
2026-04-19 13:27:28 -04:00
1321a813ae
Update badge link for Cybersecurity Projects
2026-04-19 13:25:49 -04:00
30f88d3a6b
Update README.md
2026-04-19 13:24:02 -04:00
d7ebd7956a
Merge pull request #183 from CarterPerez-dev/project/honeypot-network
...
feat: advanced honeypot-network project complete
2026-04-19 13:22:10 -04:00
e35d752289
feat: advanced honeypot-network project complete
2026-04-19 13:13:49 -04:00
e20848b45a
Merge pull request #180 from CarterPerez-dev/dependabot/uv/PROJECTS/advanced/bug-bounty-platform/backend/mako-1.3.11
...
chore(deps): bump mako from 1.3.10 to 1.3.11 in /PROJECTS/advanced/bug-bounty-platform/backend
2026-04-18 03:17:28 -04:00
8ba4e88865
Merge pull request #179 from CarterPerez-dev/dependabot/uv/PROJECTS/advanced/ai-threat-detection/backend/mako-1.3.11
...
chore(deps): bump mako from 1.3.10 to 1.3.11 in /PROJECTS/advanced/ai-threat-detection/backend
2026-04-18 03:17:12 -04:00
3b7b2e4f8f
Merge pull request #178 from CarterPerez-dev/dependabot/uv/PROJECTS/beginner/metadata-scrubber-tool/pypdf-6.10.2
...
chore(deps): bump pypdf from 6.10.1 to 6.10.2 in /PROJECTS/beginner/metadata-scrubber-tool
2026-04-18 03:16:48 -04:00
b419685e6a
Merge pull request #177 from CarterPerez-dev/dependabot/npm_and_yarn/PROJECTS/intermediate/api-security-scanner/frontend/axios-1.15.0
...
chore(deps): bump axios from 1.13.5 to 1.15.0 in /PROJECTS/intermediate/api-security-scanner/frontend
2026-04-18 03:16:32 -04:00
119893c8e6
Merge pull request #182 from CarterPerez-dev/dependabot/uv/PROJECTS/advanced/api-rate-limiter/python-multipart-0.0.26
...
chore(deps): bump python-multipart from 0.0.22 to 0.0.26 in /PROJECTS/advanced/api-rate-limiter
2026-04-18 03:16:19 -04:00
2d59e909af
Merge pull request #181 from CarterPerez-dev/dependabot/go_modules/PROJECTS/intermediate/secrets-scanner/github.com/go-git/go-git/v5-5.18.0
...
chore(deps): bump github.com/go-git/go-git/v5 from 5.17.1 to 5.18.0 in /PROJECTS/intermediate/secrets-scanner
2026-04-18 03:16:11 -04:00
d68cc2e21e
chore(deps): bump python-multipart
...
Bumps [python-multipart](https://github.com/Kludex/python-multipart ) from 0.0.22 to 0.0.26.
- [Release notes](https://github.com/Kludex/python-multipart/releases )
- [Changelog](https://github.com/Kludex/python-multipart/blob/master/CHANGELOG.md )
- [Commits](https://github.com/Kludex/python-multipart/compare/0.0.22...0.0.26 )
---
updated-dependencies:
- dependency-name: python-multipart
dependency-version: 0.0.26
dependency-type: indirect
...
Signed-off-by: dependabot[bot] <support@github.com>
2026-04-17 22:49:17 +00:00
be41a9ac0f
chore(deps): bump github.com/go-git/go-git/v5
...
Bumps [github.com/go-git/go-git/v5](https://github.com/go-git/go-git ) from 5.17.1 to 5.18.0.
- [Release notes](https://github.com/go-git/go-git/releases )
- [Commits](https://github.com/go-git/go-git/compare/v5.17.1...v5.18.0 )
---
updated-dependencies:
- dependency-name: github.com/go-git/go-git/v5
dependency-version: 5.18.0
dependency-type: direct:production
...
Signed-off-by: dependabot[bot] <support@github.com>
2026-04-17 22:41:45 +00:00
e0a9bcbebf
chore(deps): bump mako in /PROJECTS/advanced/bug-bounty-platform/backend
...
Bumps [mako](https://github.com/sqlalchemy/mako ) from 1.3.10 to 1.3.11.
- [Release notes](https://github.com/sqlalchemy/mako/releases )
- [Changelog](https://github.com/sqlalchemy/mako/blob/main/CHANGES )
- [Commits](https://github.com/sqlalchemy/mako/commits )
---
updated-dependencies:
- dependency-name: mako
dependency-version: 1.3.11
dependency-type: indirect
...
Signed-off-by: dependabot[bot] <support@github.com>
2026-04-16 23:24:08 +00:00
786a1ea0c3
chore(deps): bump mako in /PROJECTS/advanced/ai-threat-detection/backend
...
Bumps [mako](https://github.com/sqlalchemy/mako ) from 1.3.10 to 1.3.11.
- [Release notes](https://github.com/sqlalchemy/mako/releases )
- [Changelog](https://github.com/sqlalchemy/mako/blob/main/CHANGES )
- [Commits](https://github.com/sqlalchemy/mako/commits )
---
updated-dependencies:
- dependency-name: mako
dependency-version: 1.3.11
dependency-type: indirect
...
Signed-off-by: dependabot[bot] <support@github.com>
2026-04-16 23:20:58 +00:00
69a1a3989a
chore(deps): bump pypdf in /PROJECTS/beginner/metadata-scrubber-tool
...
Bumps [pypdf](https://github.com/py-pdf/pypdf ) from 6.10.1 to 6.10.2.
- [Release notes](https://github.com/py-pdf/pypdf/releases )
- [Changelog](https://github.com/py-pdf/pypdf/blob/main/CHANGELOG.md )
- [Commits](https://github.com/py-pdf/pypdf/compare/6.10.1...6.10.2 )
---
updated-dependencies:
- dependency-name: pypdf
dependency-version: 6.10.2
dependency-type: direct:production
...
Signed-off-by: dependabot[bot] <support@github.com>
2026-04-16 22:32:38 +00:00
6205385fd4
chore(deps): bump axios
...
Bumps [axios](https://github.com/axios/axios ) from 1.13.5 to 1.15.0.
- [Release notes](https://github.com/axios/axios/releases )
- [Changelog](https://github.com/axios/axios/blob/v1.x/CHANGELOG.md )
- [Commits](https://github.com/axios/axios/compare/v1.13.5...v1.15.0 )
---
updated-dependencies:
- dependency-name: axios
dependency-version: 1.15.0
dependency-type: direct:production
...
Signed-off-by: dependabot[bot] <support@github.com>
2026-04-15 23:58:24 +00:00
cac4a65232
Merge pull request #172 from CarterPerez-dev/dependabot/uv/PROJECTS/beginner/metadata-scrubber-tool/pypdf-6.10.1
...
chore(deps): bump pypdf from 6.10.0 to 6.10.1 in /PROJECTS/beginner/metadata-scrubber-tool
2026-04-15 19:40:51 -04:00
280c1f9aee
Merge pull request #175 from CarterPerez-dev/dependabot/uv/PROJECTS/advanced/encrypted-p2p-chat/backend/python-multipart-0.0.26
...
chore(deps): bump python-multipart from 0.0.22 to 0.0.26 in /PROJECTS/advanced/encrypted-p2p-chat/backend
2026-04-15 19:40:39 -04:00
87ed5c73e6
Merge pull request #174 from CarterPerez-dev/dependabot/uv/PROJECTS/beginner/c2-beacon/backend/python-multipart-0.0.26
...
chore(deps): bump python-multipart from 0.0.22 to 0.0.26 in /PROJECTS/beginner/c2-beacon/backend
2026-04-15 19:40:23 -04:00
d5f3aecfe7
Merge pull request #173 from CarterPerez-dev/dependabot/uv/PROJECTS/advanced/bug-bounty-platform/backend/python-multipart-0.0.26
...
chore(deps): bump python-multipart from 0.0.21 to 0.0.26 in /PROJECTS/advanced/bug-bounty-platform/backend
2026-04-15 19:40:07 -04:00
c0c9b0b931
Merge pull request #176 from CarterPerez-dev/project/systemd-persistence-scanner
...
Project/systemd persistence scanner
2026-04-15 19:39:22 -04:00
cccd383b30
Merge branch 'main' into project/systemd-persistence-scanner
2026-04-15 19:37:43 -04:00
8c8a37c654
docs: add learn folder and update README for systemd persistence scanner
2026-04-15 19:21:56 -04:00
467e5c88ac
chore(deps): bump python-multipart
...
Bumps [python-multipart](https://github.com/Kludex/python-multipart ) from 0.0.22 to 0.0.26.
- [Release notes](https://github.com/Kludex/python-multipart/releases )
- [Changelog](https://github.com/Kludex/python-multipart/blob/master/CHANGELOG.md )
- [Commits](https://github.com/Kludex/python-multipart/compare/0.0.22...0.0.26 )
---
updated-dependencies:
- dependency-name: python-multipart
dependency-version: 0.0.26
dependency-type: direct:production
...
Signed-off-by: dependabot[bot] <support@github.com>
2026-04-15 21:19:02 +00:00
CarterPerez-dev
dependabot[bot]
CarterPerez-dev