starred/warmbly

mirror of https://github.com/warmbly/warmbly.git synced 2026-10-03 16:02:02 +00:00

Files

T

History

Matthew Meszaros e668a2a36b feat: complete the ADA CASA v2.1.1 AL1 control set across authentication, sessions, access control, cryptography, input validation and configuration, adding a breached-password denylist and per-account login throttling, enforced multi-factor authentication on the admin panel, step-up confirmation before an action that mints a lasting credential, purpose-scoped session tokens, single-use TOTP steps, tenant verification on every cross-referenced identifier, security headers on every surface, encrypted webhook signing secrets, per-organization idempotency, PKCE and a minimal two-scope Gmail consent on the mailbox OAuth flow, bounded spreadsheet and archive decoding, a patched Go toolchain with govulncheck in CI, and the evidence pack under compliance/casa

2026-09-19 08:18:35 +02:00

..

breached.txt

feat: complete the ADA CASA v2.1.1 AL1 control set across authentication, sessions, access control, cryptography, input validation and configuration, adding a breached-password denylist and per-account login throttling, enforced multi-factor authentication on the admin panel, step-up confirmation before an action that mints a lasting credential, purpose-scoped session tokens, single-use TOTP steps, tenant verification on every cross-referenced identifier, security headers on every surface, encrypted webhook signing secrets, per-organization idempotency, PKCE and a minimal two-scope Gmail consent on the mailbox OAuth flow, bounded spreadsheet and archive decoding, a patched Go toolchain with govulncheck in CI, and the evidence pack under compliance/casa

2026-09-19 08:18:35 +02:00

README.md

feat: complete the ADA CASA v2.1.1 AL1 control set across authentication, sessions, access control, cryptography, input validation and configuration, adding a breached-password denylist and per-account login throttling, enforced multi-factor authentication on the admin panel, step-up confirmation before an action that mints a lasting credential, purpose-scoped session tokens, single-use TOTP steps, tenant verification on every cross-referenced identifier, security headers on every surface, encrypted webhook signing secrets, per-organization idempotency, PKCE and a minimal two-scope Gmail consent on the mailbox OAuth flow, bounded spreadsheet and archive decoding, a patched Go toolchain with govulncheck in CI, and the evidence pack under compliance/casa

2026-09-19 08:18:35 +02:00

README.md

Breached-password denylist

breached.txt is the UK National Cyber Security Centre's list of the 100,000 most commonly breached passwords (published from the Have I Been Pwned corpus), reduced to the 46,528 entries that are 8 to 128 characters long. Anything shorter is already refused by the length rule, so carrying it here would only make the file bigger.

Entries are lowercased, deduplicated and sorted. The comparison in crypt.CheckPassword lowercases the candidate, so the casing here is not a weakening: Password123 and password123 are both refused.

Source: https://github.com/danielmiessler/SecLists (Passwords/Common-Credentials/100k-most-used-passwords-NCSC.txt)

Refreshing it is a matter of re-running that filter and committing the result. Nothing else needs to change.