3-tier architecture, security hardening, parser fixes, and upstream backports#64

Closed

xMinhx wants to merge 41 commits into

xMinhx:pr/upstream-clean

Commits on Jun 27, 2026

Sponsored docker container for the frontend.

Schubert, Stefan
authored and
xMinhx
committed
refactor: implement 3-tier architecture by separating frontend and backend assets

Schubert, Stefan
authored and
xMinhx
committed
refactor: migrate to 3-tier architecture by removing legacy views and adding login page

Schubert, Stefan
authored and
xMinhx
committed
chore(frontend): remove deprecated frontend/src/api/apiClient.ts (migrated to queries/apiClient)

Schubert, Stefan
authored and
xMinhx
committed
Migrate API routes to explicit api/ prefix
xMinhx
committed
Add Docker 3-tier deployment configuration

xMinhx
and
StefanSchubert
committed
Add 3-tier Docker deployment and frontend infrastructure

xMinhx
and
StefanSchubert
committed
chore: fix .gitignore conflict marker, restore render import, add .nvmrc and requirements.lock
xMinhx
committed
docs: align preview/prod runtime guidance
xMinhx
committed
fix(runtime): stabilize preview and align CI with prod
xMinhx
committed
test: mock NVD API calls, add nvd_integration marker
xMinhx
committed
fix: address PR review comments
xMinhx
committed
test: add e2e marker to pytest config
xMinhx
committed
test: add end-to-end report analysis tests
xMinhx
committed
ci: add e2e_test job to CI pipeline
xMinhx
committed
fix: add missing HtmlView/AppView import in urls.py
xMinhx
committed
ci: fix requirements-dev.txt reference in e2e job
xMinhx
committed
security: fix timing attack on API key verification (C1)
xMinhx
committed
security: prevent LDAP injection via username escaping (C2)
xMinhx
committed
security: guard dev auth with IS_DEV check (C3)
xMinhx
committed
security: add permission check to DeleteProjectAPI (H1)
xMinhx
committed
security: validate CVE ID format and add request timeouts (H2)
xMinhx
committed
security: whitelist templates in HtmlView (H5)
xMinhx
committed
security: remove duplicate api_404_view function (M4)
xMinhx
committed
security: improve Docker security configuration (L1/L2/L3)
xMinhx
committed
security: rate limiting, dev creds, CORS, HTTPS settings (H3/H4/M2/M3)
xMinhx
committed
fix(parser): handle dict input in cyclonedx parser
xMinhx
committed
fix(parser): dedupe CVEs by (name, version) in trivy parser
xMinhx
committed
test: add unit tests for trivy and cyclonedx parsers
xMinhx
committed
test(e2e): add e2e tests for trivy and cyclonedx report upload
xMinhx
committed
test: add trivy and cyclonedx test fixtures
xMinhx
committed
docs: update outdated content to match 3-tier architecture and current parsers
xMinhx
committed
26 extended length of fields project_name and project_id

Nils Kreiner
authored and
xMinhx
committed
fixed validation

Nils Kreiner
authored and
xMinhx
committed
finished adding tooltips for the CVSS calculator metrics

Nils Kreiner
authored and
xMinhx
committed
Fix profile picture loading error in production

NikAcc
authored and
xMinhx
committed
added cve description to the details page (upstream #10)

Nils Kreiner
authored and
xMinhx
committed
Replace remote DiceBear avatars with local client-side generation (upstream #22)

xMinhx
and
NikAcc
committed
Remove unused @dicebear/adventurer-neutral dependency (upstream #22)

xMinhx
and
NikAcc
committed
Suppress onRowClick navigation when selecting text in report grid (upstream #38)

xMinhx
and
kreinern
committed
docs: rewrite QUICK_START and API_TEST_GUIDE in clean English
xMinhx
committed