This repository has been archived on 2026-08-19. You can view files and clone it. You cannot open issues or pull requests or push a commit.

Hermes (Server) 77a20422be Security-Fixes aus dem flutter-security Audit ...

CRIT:
- Cloud-Token jetzt in flutter_secure_storage (Keystore/Keychain) statt SharedPreferences, mit Migration alter Eintraege
- usesCleartextTraffic entfernt (kein HTTP-Klartext mehr)
HIGH:
- Path-Traversal gefixt: p.basename bei YouTube-Download, Navidrome-Download und Cloud-Auto-Sync
MED:
- allowBackup=false (kein Backup von Token-Daten)
- Navidrome-Salt kryptographisch sicher (Random.secure statt Timestamp)

2026-08-01 13:10:18 +02:00

..

audio_handler.dart

Fix: Review-Findings korrigiert (Tag-Leiste, Profil, Singleton u.a.)

2026-07-31 15:42:54 +02:00

cloud_service.dart

Security-Fixes aus dem flutter-security Audit

2026-08-01 13:10:18 +02:00

download_service.dart

Security-Fixes aus dem flutter-security Audit

2026-08-01 13:10:18 +02:00

favoriten_service.dart

Fix: Review-Findings korrigiert (Tag-Leiste, Profil, Singleton u.a.)

2026-07-31 15:42:54 +02:00

id3_reader.dart

Fix: Review-Findings korrigiert (Tag-Leiste, Profil, Singleton u.a.)

2026-07-31 15:42:54 +02:00

melo_logger.dart

Security: Cloud-Auth auf Bearer-JWT umgestellt (IDOR-Luecke geschlossen)

2026-07-31 14:31:12 +02:00

musik_scanner.dart

Fix: Review-Findings korrigiert (Tag-Leiste, Profil, Singleton u.a.)

2026-07-31 15:42:54 +02:00

navidrome_service.dart

Security-Fixes aus dem flutter-security Audit

2026-08-01 13:10:18 +02:00

player_service.dart

Fix: Review-Findings korrigiert (Tag-Leiste, Profil, Singleton u.a.)

2026-07-31 15:42:54 +02:00

playlist_service.dart

Fix: Review-Findings korrigiert (Tag-Leiste, Profil, Singleton u.a.)

2026-07-31 15:42:54 +02:00