Skip to content

security: update CSRF threat model to reflect a manual audit

Warren Gifford requested to merge sg/update-csrf-model into main

Created by: slimsag

I manually audited our code / pages to confirm there were no instances in which we would embed any sensitive user data into the response of GET requests, and so we can remove these sections from our CSRF threat model simplifying it further. 🎉

Signed-off-by: Stephen Gutekanst [email protected]

Merge request reports