zeekay bfbbacccfa security: fix remaining Red team findings (LOW + MEDIUM) ...

MEDIUM: Bridge wallet org isolation — added orgID filter to wallet query
  in handleBridgeSign, prevents cross-tenant signing.
LOW-1: JWT iss/aud claims — tokens now carry issuer "mpc.lux.network"
  and distinct audiences ("mpc-api" vs "mpc-refresh"). Refresh tokens
  can no longer be used as access tokens.
LOW-2: Rate limiter XFF bypass — clientIP uses r.RemoteAddr (set by
  RealIP middleware) instead of parsing X-Forwarded-For directly.
LOW-3: Request body size limit — 1MB maxBodySize middleware prevents OOM
  from oversized payloads.

2026-04-06 23:28:34 -07:00

..

api

security: fix remaining Red team findings (LOW + MEDIUM)

2026-04-06 23:28:34 -07:00

backup

feat: tx lifecycle tracking, Shamir backup sharding, settlement engine

2026-03-02 14:22:05 -08:00

client

Fix remaining import formatting issues

2025-08-02 22:30:28 -05:00

common

chore: sync dependencies and format code

2026-02-04 15:47:51 -08:00

config

fix: goimports formatting + CGO_ENABLED=0 for CI tests

2026-03-22 12:50:58 -07:00

constant

Implement connection for prod

2024-09-21 20:52:40 +07:00

custody

security: fix 15 custody audit findings, add regression + fuzz tests

2026-04-01 09:00:06 -07:00

db

security: fix 15 custody audit findings, add regression + fuzz tests

2026-04-01 09:00:06 -07:00

encoding

chore: sync dependencies and format code

2026-02-04 15:47:51 -08:00

encryption

chore: sync dependencies and format code

2026-02-04 15:47:51 -08:00

event

security: add orgID multi-tenancy isolation, rename badger to zapdb

2026-03-22 12:02:30 -07:00

eventconsumer

fix: per-org MPC isolation — orgID end-to-end threading + security hardening

2026-03-24 16:55:54 -07:00

hsm

fix: rename env vars to MPC_PASSWORD, remove LUX_ prefix

2026-03-30 09:21:51 -07:00

identity

feat: BLS threshold + security hardening + ZapDB KMS-backing

2026-03-19 01:15:33 -07:00

infra

Fix linting issues

2025-08-02 22:27:51 -05:00

integrity

security: fix 15 custody audit findings, add regression + fuzz tests

2026-04-01 09:00:06 -07:00

keyinfo

Fix linting issues

2025-08-02 22:27:51 -05:00

kms

feat(mpc): key listing, KMS backup/restore, API-only backend, CGGMP21 config serialization

2026-03-01 18:12:18 -08:00

kvstore

feat: per-user shard encryption + wallet isolation

2026-03-24 14:58:54 -07:00

logger

fix(ci): goimports formatting, no-panic logger test, remove unconvert

2026-03-01 18:40:56 -08:00

messaging

chore: remove bridge stub, fix all TODOs with real implementations

2025-12-25 10:44:16 -08:00

mpc

security: fix 15 custody audit findings, add regression + fuzz tests

2026-04-01 09:00:06 -07:00

protocol

feat(mpc): key listing, KMS backup/restore, API-only backend, CGGMP21 config serialization

2026-03-01 18:12:18 -08:00

settlement

fix: goimports formatting + CGO_ENABLED=0 for CI tests

2026-03-22 12:50:58 -07:00

smart

fix(ci): goimports with local-prefixes=github.com/luxfi/mpc

2026-03-01 19:10:22 -08:00

threshold

fix(crypto): real Lagrange aggregation, proper ECDSA sign shares, FROST Schnorr verification

2026-03-01 18:16:57 -08:00

transport

security: fix 15 custody audit findings, add regression + fuzz tests

2026-04-01 09:00:06 -07:00

txtracker

fix: goimports formatting with local-prefixes (matches golangci-lint)

2026-03-22 13:17:50 -07:00

types

security: add orgID multi-tenancy isolation, rename badger to zapdb

2026-03-22 12:02:30 -07:00

utils

Fix remaining import formatting issues

2025-08-02 22:30:28 -05:00