📦
审计历史
extension-email-calendar-events - 1 审计
审计版本 1 最新
2026年7月24日 10:12
All 24 static findings are false positives caused by Markdown links, code fences, module references, and ordinary Motoko uid identifiers. Semantic review found a medium-severity invitation abuse risk because public registration accepts unverified email addresses that are later included as event attendees.
1
已扫描文件
328
分析行数
4
复核项
0
已忽略误报
已确认安全问题 (1)
中
Unverified Email Enrollment Enables Unwanted Invitations
Any caller can register an arbitrary unique email address without ownership verification. Registered addresses become event attendees and can later receive administrator-triggered invitations.
The example stores caller-supplied email addresses after only uniqueness checks, adds every stored profile to events, and provides an invitation-send operation.
风险因素
⚙️ 外部命令 (6)
🌐 网络访问 (1)
📁 文件系统访问 (1)
审计者: codex