fix(sms+auth): close open SMS relay, restore-flow rate limit#125
Merged
Conversation
DELETE /api/sms/send-notification — it accepted an arbitrary phoneNumber + message from any anonymous caller and sent it via the app's Twilio creds with no auth, rate limiting, or origin check. It was orphaned (no caller anywhere in the app) and is the likely vector behind the runaway SMS billing (SMS-pumping/toll fraud). The legitimate offline-message SMS path is unaffected: it runs through SMSNotificationService, invoked server-side from the WebSocket handler. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Restoring E2EE keys on a new device fires several GET /api/auth/key-backup calls per attempt (on-mount hasBackup check + the restore itself), so the old 5-per-hour cap locked users out after ~2 restore attempts for a full hour. Raise to 10 requests and shorten the window to 15 min so legitimate multi-attempt restores work and any lockout clears quickly. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
vu1nz Security Review0 finding(s) in PR #? No security issues found. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
/api/sms/send-notification— unauthenticated, unrate-limited open SMS relay using app Twilio creds; orphaned (no caller). Likely vector behind the SMS-billing drain (SMS pumping).GET /api/auth/key-backupwas 5/hour; new-device E2EE key restore fires several GETs per attempt, locking users out for an hour after ~2 tries. Now 10 per 15 min.Related infra (already applied, not in this diff)
rate_limit_sms_sentlowered 30 → 10/hour as a hard global cost cap.🤖 Generated with Claude Code