📦
審計紀錄
extension-email-calendar-events - 1 審計
審計版本 1 最新
2026年7月24日 上午10:12
All 24 static findings are false positives caused by Markdown links, code fences, module references, and ordinary Motoko uid identifiers. Semantic review found a medium-severity invitation abuse risk because public registration accepts unverified email addresses that are later included as event attendees.
1
已掃描檔案
328
分析行數
4
複核項目
0
已忽略的誤報
已確認的安全問題 (1)
中
Unverified Email Enrollment Enables Unwanted Invitations
Any caller can register an arbitrary unique email address without ownership verification. Registered addresses become event attendees and can later receive administrator-triggered invitations.
The example stores caller-supplied email addresses after only uniqueness checks, adds every stored profile to events, and provides an invitation-send operation.
風險因素
⚙️ 外部命令 (6)
🌐 網路存取 (1)
📁 檔案系統存取 (1)
審計單位: codex