Security

Go to release notes

With Stigmi being a solo project, I am obviously not the most experienced at security. Nonetheless, any fixes and patches and loose ends I tie up will be documented here.

If you find a security hole, please let me know! I'll try to fix it, and I'll credit you in this document. Any help would be really appreciated. Ta!

Sep 10, 2026

  • Fixed broken forms from adding CSRF: the issue is that I stupidly closed the form before onsubmit, leaving it there in the open without even noticing LOL
  • Stigs posted from private accounts can no longer be replied to via an ID

Sep 7, 2026

Vulnerabilities and concerns

  • Expired sessions can no longer be used to authenticate
  • If media fails to sanitize, it is now rejected
  • Avatars given on signup are now discarded if the account creation fails for whatever reason
  • Web mutations now require a session bound CSRF token
  • Changing your password now terminates all other sessions

Additions