weblate/docs/security
Kartik Ohri 592733f42a
fix(github-app): protect against DDOS (#20354)
* fix(github): expire pending installation webhooks

Limit pending GitHub App installation storage to the small metadata needed to finish setup after workspace authorization. Pending rows now keep only the installation action, installation/app IDs, and account login/type instead of the full webhook payload and repository list.

Reject stale pending installation rows during setup replay and add a periodic Celery cleanup task for expired rows so unauthorised installation webhooks do not accumulate indefinitely.

* fix(github): rate limit account setup

Apply Weblate's configurable rate limiter to the GitHub App setup callback before exchanging the GitHub OAuth code or calling the GitHub API. The new GITHUB_SETUP scope defaults to 100 attempts per hour.

Surface clear retry guidance when setup is rate limited or when GitHub API sync leaves the connected account pending.

* address PR feedback
2026-06-29 15:53:15 +00:00
..
data-residency.rst docs: extend data residency (#19989) 2026-06-12 07:49:59 +00:00
dependencies.rst docs: clarify release policy, lifecycle and security support 2026-06-16 11:06:51 +02:00
disaster-recovery-plan.rst docs: fix typo 2025-05-26 08:49:31 +02:00
governance.rst docs: clarify release policy, lifecycle and security support 2026-06-16 11:06:51 +02:00
incident-response-plan.rst docs: clarify release policy, lifecycle and security support 2026-06-16 11:06:51 +02:00
index.rst docs: clarify release policy, lifecycle and security support 2026-06-16 11:06:51 +02:00
issues.rst docs: clarify release policy, lifecycle and security support 2026-06-16 11:06:51 +02:00
localization-threat.rst docs: describe threat modeling for localization (#16283) 2025-09-23 07:27:01 +00:00
passwords.rst docs: document password security 2025-05-22 15:19:34 +02:00
privacy-compliance.rst feat(utils): add OpenTelemetry tracing support 2026-05-25 17:38:01 +02:00
product-information.rst docs: clarify release policy, lifecycle and security support 2026-06-16 11:06:51 +02:00
release-artifacts.rst docs: clarify release policy, lifecycle and security support 2026-06-16 11:06:51 +02:00
releases.rst docs: clarify release policy, lifecycle and security support 2026-06-16 07:06:19 +02:00
threat-model.rst fix(github-app): protect against DDOS (#20354) 2026-06-29 15:53:15 +00:00
us-compliance.rst docs: update links 2026-05-04 08:42:58 +02:00