epic: Security fixes

[DogukanUrker]

Epic: Security Fixes for v3

Status

All identified security issues labeled and categorized. Tracking progress toward v3 release.

Issues in this Epic

• [Security] IDOR: Any Authenticated User Can Delete Any Post or Comment #254 [Security] IDOR: Any Authenticated User Can Delete Any Post or Comment

  • Labels: security, high-priority, bug
  • Status: Open - Critical vulnerability, must fix before v3

• [Security] Password hash unnecessarily included in search template context #258 [Security] Password hash unnecessarily included in search template context

  • Labels: security, minor, duplicate
  • Status: Open - Follow-up to [Security] IDOR: Any Authenticated User Can Delete Any Post or Comment #254, low severity

Action Required

• Fix IDOR vulnerability ([Security] IDOR: Any Authenticated User Can Delete Any Post or Comment #254) - add authorization checks in post.py
• Remove password hash from search template context
• Review other security findings before v3 release

Notes

• All issues labeled and categorized
• [Security] Password hash unnecessarily included in search template context #258 marked as duplicate (follow-up to [Security] IDOR: Any Authenticated User Can Delete Any Post or Comment #254)
• Base 64 image support for markdown renderer #250 needs clarification from reporter
• update demo video/screenshots after v3 release #235, deploy the project #228, feat(tests): create tests for post create/edit logic #222 are enhancement/maintenance tasks

---

Last updated: 2026-06-26