Advisories
Every security issue we have found and fixed, with enough detail to judge it. All of these are resolved. To report a new one, use the form with “security” in the subject; the security page has the policy.
CSRF token not required on logout NS-SA-2021-001
Cookie-session logout did not require the CSRF token, allowing a forced sign-out via a crafted page. Fixed by requiring the token on all cookie-session state changes. No data exposure.
Session fixation on login NS-SA-2022-001
A session id was not rotated on sign-in. Rotated the session id on every login. No accounts were known to be affected.
Login lockout counter could be bypassed NS-SA-2023-001
Concurrent requests could undercount failed sign-ins, weakening the lockout. Made the counter atomic.
Cover upload path handling NS-SA-2024-001
A path-handling bug could write a cover outside the intended directory under rare input. Hardened to opaque identifiers only; no exploitation observed.
Embed response header too permissive NS-SA-2025-001
An embed response set a header more broadly than intended. Scoped it to the embed route. No account data was reachable through it.