Source review · two passes2026-08-20
Payments, Lightning and custody
CoinPay Security Assessment
MethodTwo source-review passes with adversarial modeling and targeted verification.
ScopeAuthentication, RLS, business logic, payment settlement and custody controls. The selected records below are mapped to matching public advisories.
Selected records
Custody-key initialization — When the encryption key was absent, the custody module fell back to a deterministic key composed of 64 zeroes.
x402 settlement validation — The settlement endpoint accepted a successful transaction receipt without verifying its recipient or amount against the payment requirement.
Payment-forwarding authorization — The balance-check endpoint lacked authentication and ownership checks while it could confirm a payment and initiate on-chain forwarding.
Payment-destination binding — Payment creation accepted a request-supplied merchant wallet address without verifying that it belonged to the merchant.
Adversarial modelingBusiness logicCustodyLightning x402Authorization
Source review · dynamic verification2026-08-14
Monorepo
ThreatCrush Monorepo Assessment
MethodStatic source review and targeted HTTP tests in an isolated Podman environment.
ScopeWeb, CLI, desktop and Supabase migrations. CVSS v3.1 was used to record severity in the report.
Selected records
RLS update policy — A missing WITH CHECK condition allowed an authenticated user to modify the administrative flag on their profile.
Daemon module loading — The root-running daemon dynamically imported unsigned modules installed from the public marketplace or arbitrary Git sources.
Server-side metadata fetching — The metadata endpoint issued server-side requests without blocking loopback, private-network or cloud-metadata targets.
Marketplace Markdown rendering — The marketplace renderer inserted unsanitized Markdown-derived HTML and accepted javascript: links in module descriptions.
Source reviewPodmanHTTP verificationSupabase RLS
Application and architecture review2026-08-15
Web application and Supabase
QryptChat Web Assessment
MethodStatic analysis, local dynamic tests and architecture review.
ScopeML-KEM-1024 messaging, Supabase RLS, RPC authorization and web APIs.
Selected records
Migration coverage — An RLS correction was not present in the versioned migrations, so new deployments did not inherit it.
Conversation-participant insertion — The participant INSERT policy allowed an authenticated user to add themselves to an arbitrary conversation without prior membership or an invitation.
Authenticated user-table exposure — A permissive SELECT policy exposed every users-table row, including phone numbers, to any authenticated session.
Source reviewSupabase RPCRLSProtocol review
Source review · dynamic verification2026-08-18
Content syndication and external APIs
rssamplifier Security Assessment
MethodSource review with targeted validation of input handling and outbound API controls.
ScopeFeed rendering, client-side script handling, rate limits, quotas and remediation SQL.
Selected records
Feed content rendering — Unescaped feed content reached public-page rendering and allowed stored script execution during verification.
Outbound API controls — Several proxy endpoints lacked request-rate and consumption limits for paid upstream APIs.
Input handlingAPI quotasDynamic verificationRemediation SQL
Source review · anonymized2026-08-24
Collaboration SaaS
Project PUX Security Assessment
MethodSource-to-sink review with an independent second pass. Dynamic verification was outside the completed scope recorded here.
ScopeWeb, Electron, mobile, Supabase, billing controls and distribution pipeline. Client identifiers are omitted.
Selected records
Plan-assignment RPCs — Three RPC paths assigned paid plans without the intended authorization checks.
Password-reset token validation — The reset flow accepted a valid access token without binding it to the intended reset context.
Desktop distribution boundary — The review documented signing, update-channel and renderer-to-main boundary issues.
Supabase RLSElectron IPCDistributionBilling logic