GHSA-PQG7-V6WH-3PFP TsDProxy: X-Forwarded-For header injection allows IP spoofing in proxied requests to backend services

Description The HTTP reverse proxy handler in tsdproxy does not strip the X-Forwarded-For or X-Real-IP header from incoming requests before calling r.SetXForwarded. This allows an authenticated Tailscale user to inject arbitrary X-Forwarded-For values that are forwarded verbatim to backend...

Insufficient Logging

Overview @hulumi/baseline is a Hardened Pulumi baseline components for AWS and GitHub — SecureBucket, AccountFoundation, AWS organization guardrails, secure primitives, detection foundations, SecureRepository, OrgFoundation. SLSA Build L3 attestation on every release. Affected versions of this...