- Shipped
- August 19, 2026 at 1:44 AM UTC
- Author
- Kamo
- Commit
- de48f69
SecurityService is anyRequest().permitAll() with @EnableMethodSecurity absent, so every @PreAuthorize is inert and public is the default; APIService relays /api/security/** without authenticating. Two handlers took that literally. DiagnosticsController had no gate on any of its four endpoints. /sessions enumerated kamo:session:* out of Redis, reported the live session count and returned a sample of fifty. /environment returned the process environment filtered by looking for "password" and similar substrings in the key — a denylist, so anything named differently went out with it. Both were reachable from the internet. It now carries a class-level **************** the platform right whose stated purpose is session, heap and connectivity diagnostics across the cluster. Guarding the class rather than the methods means the next endpoint added inherits the gate instead of having to remember it, and the interceptor enforces it before the handler runs so there is no in-handler call to forget. **************** returned the id and title of every organization using a branch type and took no HttpServletRequest at all, so it resolved no caller — the organization estate was readable by anyone who could name a branch type. It now resolves the caller exactly as every sibling endpoint on that controller already did. The ratchet baseline drops 370 to 365, which is the mechanism working: guarding an endpoint requires deleting its line, so the number can only fall. Verified in a clean origin/main worktree with only these three files applied — 724 tests, 0 failures. The working tree's own suite still reports errors from a concurrent session's in-flight BranchTypeController and OrganizationController work, unrelated to this.