Block a user
Audit logging for security-sensitive operations
Webhook delivery tracking and retry
Email notification channel for CVE alerts
license_summary and SBOM export fetch entire dataset without limits
Webhook server port is hardcoded to 3002
No graceful shutdown — in-progress scans left in running state
get_attack_chain has no pagination — long sessions return unbounded data
sort_by query parameter is a NoSQL injection vector
CVE monitor loads entire SBOM collection into memory
Scheduled scans run sequentially — one slow repo blocks all others
Graph endpoints load full node/edge collections without pagination
No request body size limit on API and webhook servers
Health endpoint does not verify database connectivity
JWKS cache never expires — key rotation requires restart
JWT audience validation disabled — cross-app token reuse
Webhook auth bypass when webhook_secret is None
sharang
released v0.2.0 — AI-Native Security & Compliance Platform at sharang/compliance-scanner-agent
2026-03-30 13:19:40 +00:00
fix: CVE notifications during scan + help chat doc loading + Dockerfile