📦
監査履歴
extension-email-calendar-events - 1 監査
監査バージョン 1 最新
2026年7月24日 10:12
All 24 static findings are false positives caused by Markdown links, code fences, module references, and ordinary Motoko uid identifiers. Semantic review found a medium-severity invitation abuse risk because public registration accepts unverified email addresses that are later included as event attendees.
1
スキャンされたファイル
328
解析済み行数
4
レビュー項目
0
誤検知を無視
確認済みのセキュリティ上の懸念 (1)
中
Unverified Email Enrollment Enables Unwanted Invitations
Any caller can register an arbitrary unique email address without ownership verification. Registered addresses become event attendees and can later receive administrator-triggered invitations.
The example stores caller-supplied email addresses after only uniqueness checks, adds every stored profile to events, and provides an invitation-send operation.
リスク要因
⚙️ 外部コマンド (6)
🌐 ネットワークアクセス (1)
📁 ファイルシステムへのアクセス (1)
監査者: codex