kandanapp/kandan — pull request #347 by scouttyg (2014-04-27 15:46:02+00:00)
Title: Complete security overhaul on the application due to possible attack vec...

...tors

I took yesterday and decided to do a security audit on the Kandan app, to look for other vectors. Other users have been awesome enough to submit their security issues, but I wondered if there were more problems than just surface deep.

There were many very worrisome issues that came up that should most likely be addressed immediately if the app is to become one that major organizations and such use. I'll explain below.

*Warning!* While I have made sure all tests pass, have tried to test on my own (signing in with multiple users, updating accounts, etc), this update should be tested multiple times by people before deploying to production, even if it is pulled in. I expected some quirky behavior here until we get any edge cases fixed.