#security

Auth, RBAC, threat modeling

1. Why does SSO login succeed but the first POST return 403?

   New members using Okta can load `/new` then get Forbidden on publish. `email_verified` is true. The guidelines modal was accepted. Is there another gate on `assert_can_post` we sh...

2. Do private category posts leak into logged-out search?

   Need confirmation this is a bug vs a misconfigured `is_private` flag. A logged-out search for a unique token from a private topic returned a hit in staging last week. Repro token:...

3. Job apply URL accepts javascript: URLs in older clients

   API `optional_url` allows http(s) and site-relative paths. A forged request with `javascript:alert(1)` is rejected. The admin form still did not show a validation error, so staff ...

4. SAML metadata upload in admin, not just OIDC

   Universities still send XML metadata. We support OIDC well. SAML is the remaining procurement blocker. Upload + validate, then show the ACS URL to copy. No custom industry type re...

5. Decline this: public member email in JSON-LD

   Never emit email in `Person` nodes. Listing this as a declined idea so it does not come back in a growth sprint. Profiles can rank without a mailbox.

6. TalkMoro v2.5.1 — Composer excerpt and cover fields

   v2.5.1 Article, Guide, Announcement, and Showcase take a 300-character excerpt for Open Graph and JSON-LD. Upgrade 1. Take a backup of discuss_db . 2. Pull the release tag v2.5.1 . 3. Run new SQL migrations if listed in the notes. 4. Restar

7. TalkMoro v2.6.0 — Job posting template

   v2.6.0 Staff-only. Apply URL is entity_url . Location uses the event location field. Upgrade 1. Take a backup of discuss_db . 2. Pull the release tag v2.6.0 . 3. Run new SQL migrations if listed in the notes. 4. Restart the API so Valkey de

8. TalkMoro v2.6.2 — Legacy prefix 301s

   v2.6.2 /bug-reports , /feature-requests , /help , and /news redirect to canonical folders. Upgrade 1. Take a backup of discuss_db . 2. Pull the release tag v2.6.2 . 3. Run new SQL migrations if listed in the notes. 4. Restart the API so Val

9. TalkMoro v2.7.1 — Topic detail cache v4

   v2.7.1 Includes entity and event columns. Anonymous TTL unchanged. Upgrade 1. Take a backup of discuss_db . 2. Pull the release tag v2.7.1 . 3. Run new SQL migrations if listed in the notes. 4. Restart the API so Valkey detail keys bump. Qu

10. TalkMoro v2.8.1 — Admin filter uses canonical types

    v2.8.1 Searching type=support finds questions after migration. Upgrade 1. Take a backup of discuss_db . 2. Pull the release tag v2.8.1 . 3. Run new SQL migrations if listed in the notes. 4. Restart the API so Valkey detail keys bump. Questi

11. TalkMoro v2.9.1 — Poll template (forum schema)

    v2.9.1 Optional. Votes still use topic upvotes until a dedicated poll table ships. Upgrade 1. Take a backup of discuss_db . 2. Pull the release tag v2.9.1 . 3. Run new SQL migrations if listed in the notes. 4. Restart the API so Valkey deta