echo-hr (superseded)

TESTED AND TRANSFERRED

This repository has been superseded. The canonical, certified version now lives at https://github.com/echoomegaprime/echo-hr

• Destination commit: 836875bebb45eb54b7a9e3057b0ea755a511fee9
• Certification Forge: PRODUCTION_READY — cert_bea7ac383c3fb9ad4297ad2a6ca8ee41d838daec (evidence_merkle_root 6a677a23f18399f79660267c43c1013d02c559f87fd73071981bc6a76a9d43a0)
• GitHub App Suite conformance: .echo/repo-health.md
• Transferred: 2026-08-12

This repository had no README.md of its own; this file exists to carry the transfer notice.

Do not deploy this copy

The source here is preserved unchanged for provenance and still contains the vulnerabilities fixed in the destination repository:

1. Every read route is public. Auth is gated on the HTTP method, so all 22 GET routes answer anyone who supplies a tenant id. /employees runs SELECT e.*, exposing employee names, dates of birth, home addresses, phones, salary and pay rate, payroll tax withholding, performance reviews, leave records, HR documents, the activity log, and emergency-contact details for third parties who never consented.
2. The Stripe webhook fails open — signature verification runs only when its secret happens to be configured.
3. stripe_events is written to but never declared in schema.sql, and the insert is wrapped in a bare catch {}, so webhook idempotency fails silently.

See the destination repository's SECURITY.md for full detail.