Fix CA-key-in-image (HackerOne #3764027) and root-cron privesc in simplerisk - #169

Merged

jsokol merged 3 commits into

security/hackerone-3764027-docker-ssl-and-cron-privesc

Sep 20, 2026

Commits on Sep 20, 2026

Generate simplerisk-minimal TLS cert at runtime, drop baked-in CA (HackerOne #3764027)

jsokol
and
claude
committed
31a4ac1
Run simplerisk cron.php as www-data, not root

jsokol
and
claude
committed
d6860d5
grype: ignore newly published curl binary-classifier false positives

jsokol
and
claude
committed
24528f8