You
Where are we on the August pen test findings?
Assistant
Pen test findings from August are 5 of 7 closed.
- Open: missing rate limit on password reset (medium), verbose GraphQL errors (low).
- Both have PRs in review.
You
Explain the password reset finding.
Assistant
The password reset rate limit is the medium finding. Right now /auth/reset allows unlimited requests per address, which enables email flooding and token guessing.
You
What is the state of each PR?
Assistant
Status of the two fixes:
| Finding | PR | State |
|---|---|---|
| Reset rate limit | #744 | Awaiting second review |
| Verbose GraphQL errors | #751 | Approved, CI running |
You
When can the vendor re-test?
Assistant
Re-test is scheduled with the vendor for the week of Nov 9, assuming both PRs ship by Nov 6.