code/cl8y-ecosystem-legal
4
0
Fork 0
Code Issues 4 Pull requests 3 Projects Releases Packages Wiki Activity

Security ops: auth /update_terms, harden ADMIN_TOKEN, redirect_uri allowlist, trusted XFF #3

New issue
Closed
opened 2026-08-10 00:41:17 +00:00 by PlasticDigits · 14 comments
PlasticDigits commented 2026-08-10 00:41:17 +00:00 (Migrated from gitlab.com)
Copy link

Summary

Harden operational security for the web portal + API path used by EVM / Terra Classic signing:

  1. Authenticate /update_terms (stop unauthenticated sync triggers).
  2. Remove unsafe default ADMIN_TOKEN.
  3. Allowlist / validate redirect_uri on the portal (and SDK helpers as needed).
  4. Stop blindly trusting X-Forwarded-For for rate limiting.

Bundle rationale: These are tightly related abuse/control-plane issues from gaps/GAP_1786322222.md affecting the same deploy surface.

Out of scope: Telegram/Solana crypto fixes, bot kick semantics, property auto-upsert allowlisting (can be follow-ups).

Current codebase

1) Public /update_terms

  • api/src/routes/update_terms.rs — GET and POST /update_terms with no auth; calls sync_terms_from_url (outbound GitLab fetch + possible DB publish).
  • Rate limit only: 1 req/s/IP (api/src/rate_limit.rs check_update_terms).
  • Documented as public in README.md; used by Playwright web/e2e/global-setup.ts and CI.

2) Default admin token

  • api/src/config.rs: ADMIN_TOKEN defaults to "dev-admin-token" if unset.
  • Admin routes: api/src/routes/admin.rs — Bearer compare (!=, not constant-time).
  • .env.example suggests change-me-admin-token but runtime still boots without an explicit secret.

3) Open redirect_uri

  • Read from query: web/src/query.ts getRedirectUri().
  • On success: web/src/ui.ts renderSuccess sets a.href and window.location.href = redirectUri after 2s — no allowlist.
  • SDK: packages/cl8y-clickwrap/src/urls.ts buildSignUrl / appendSignParams pass through redirectUri unchecked.

4) Blind X-Forwarded-For

  • api/src/rate_limit.rs client_ip: prefers first XFF hop unconditionally, else ConnectInfo.
  • Attackers can spoof XFF to bypass per-IP limits or exhaust arbitrary buckets.
  • No TRUST_PROXY / hop-count / CIDR allowlist config today.

Why this is needed

  • Unauthenticated sync is a control-plane DoS and couples availability to GitLab + DB write path.
  • Default admin tokens are a classic production misconfig footgun (property delete cascades signatures).
  • Open redirects after “Accepted” turn a trusted legal domain into a phishing trampoline.
  • Spoofable client IP makes rate limits ineffective in front of any reverse proxy (or even without one).

Constraints / guardrails

  1. Portal focus: Prioritize behaviors that protect terms.cl8y.com / api.terms.cl8y.com users on EVM/Terra flows; keep CI/e2e working with explicit test tokens.
  2. Startup sync / worker: Keep TERMS_SYNC_ON_STARTUP and interval worker as the primary unattended sync; /update_terms becomes an authenticated ops endpoint.
  3. Auth choice for /update_terms: Reuse ADMIN_TOKEN Bearer (same as admin) or a dedicated UPDATE_TERMS_TOKEN — document one approach; do not invent a second ad-hoc scheme without docs.
  4. ADMIN_TOKEN: In production-like configs, refuse to start (or refuse admin + update_terms) if token missing/empty/known-default. Local/dev may allow explicit opt-in (ALLOW_INSECURE_DEFAULTS=true) — never silent default in prod.
  5. redirect_uri allowlist: HTTPS-only in prod; allow http://localhost / 127.0.0.1 when ALLOW_LOCALHOST_PROPERTY or a dedicated redirect-dev flag is on. Reject javascript:, data URLs, and protocol-relative tricks. Prefer exact origin allowlist via env (e.g. REDIRECT_URI_ALLOWLIST).
  6. SDK: Document that hosts must pass allowlisted URIs; add optional validation helper — do not break headless integrators who open sign URLs server-side with known-good redirects.
  7. XFF: Default to socket peer IP unless TRUSTED_PROXY_CIDRS (or similar) is set; only then honor XFF from trusted proxies (rightmost/leftmost policy documented).
  8. Constant-time compare for bearer tokens when touching admin auth.
  9. Docs: Update .env.example, README.md, e2e env, .gitlab-ci.yml accordingly.

Relevant files

Area Path
Update terms route api/src/routes/update_terms.rs
Rate limit / IP api/src/rate_limit.rs
Config api/src/config.rs
Admin auth api/src/routes/admin.rs
Portal redirect web/src/ui.ts, web/src/query.ts
SDK URLs packages/cl8y-clickwrap/src/urls.ts
Env / docs .env.example, README.md, web/e2e/global-setup.ts, .gitlab-ci.yml, web/playwright.config.ts

Recommended direction

  1. /update_terms: Require Authorization: Bearer <ADMIN_TOKEN> (or dedicated token); return 401 otherwise. Keep GET optional or drop GET for CSRF-ish clarity (prefer POST-only).
  2. Config: admin_token: Option / fail-fast; reject "dev-admin-token" unless insecure opt-in.
  3. redirect_uri: Shared validator used by renderSuccess (and optionally SDK). Env allowlist of origins; strip/refuse credentials; no auto-redirect if invalid (show success without navigate).
  4. XFF: client_ip uses ConnectInfo by default; if peer is in trusted proxy CIDRs, parse XFF per documented hop policy.
  5. Tests: See test plans below; update e2e global-setup to send Bearer token.

Acceptance criteria

  • Unauthenticated /update_terms returns 401/403; authenticated call still syncs.
  • API does not default to a known admin token in production configuration; CI/dev documented.
  • Portal ignores or refuses non-allowlisted redirect_uri (no navigation to attacker origin).
  • Rate limit IP spoofing via XFF fails when proxy trust is unset; trusted-proxy mode documented and tested.
  • Admin bearer comparison is constant-time (or equivalent).
  • README + .env.example + CI/e2e updated.
  • EVM Playwright e2e still green with authenticated terms sync.

Test plan (functional paths)

  1. POST /update_terms without auth → denied.
  2. POST /update_terms with valid Bearer → published / unchanged as today.
  3. Admin list/delete with valid/invalid/missing token.
  4. Boot without ADMIN_TOKEN → fail or insecure-opt-in path only.
  5. Portal success with allowlisted redirect_uri → redirect works.
  6. Portal success with https://evil.example → no redirect (success message still shown).
  7. Rate limit: two writes from same ConnectInfo IP hit limit; spoofed XFF without trust does not create a separate unlimited bucket.
  8. With trusted proxy config, XFF from trusted peer affects bucket as designed.

Test plan (attack / abuse / hack vectors)

Vector Expectation
Unauth flood /update_terms 401 + no GitLab fetch / no publish
Stolen browser session calling /update_terms Still needs bearer (not cookie-auth); document token handling
Default/guessable admin token on prod Prevented by fail-fast / no default
redirect_uri=https://evil.com phishing after Accept Blocked
redirect_uri=javascript:alert(1) Blocked
redirect_uri=//evil.com / userinfo tricks Blocked
XFF X-Forwarded-For: 1.2.3.4 direct to API Ignored without trusted proxy
XFF list stuffing / many hops Documented hop policy; no panic
Bearer timing oracle Constant-time compare
Admin DELETE property cascade abuse Still requires valid token; rate-limited

Verification criteria

  • cargo test covers auth + XFF cases.
  • Web unit/e2e covers redirect allowlist behavior.
  • Staging deploy: curl without token fails; with token works; sign flow with good/bad redirect_uri behaves as specified.
  • Gap security items 4–7 in gaps/GAP_1786322222.md marked addressed for portal/API ops.
## Summary Harden operational security for the **web portal + API** path used by EVM / Terra Classic signing: 1. Authenticate `/update_terms` (stop unauthenticated sync triggers). 2. Remove unsafe default `ADMIN_TOKEN`. 3. Allowlist / validate `redirect_uri` on the portal (and SDK helpers as needed). 4. Stop blindly trusting `X-Forwarded-For` for rate limiting. **Bundle rationale:** These are tightly related abuse/control-plane issues from `gaps/GAP_1786322222.md` affecting the same deploy surface. **Out of scope:** Telegram/Solana crypto fixes, bot kick semantics, property auto-upsert allowlisting (can be follow-ups). --- ## Current codebase ### 1) Public `/update_terms` - `api/src/routes/update_terms.rs` — `GET` and `POST` `/update_terms` with **no auth**; calls `sync_terms_from_url` (outbound GitLab fetch + possible DB publish). - Rate limit only: 1 req/s/IP (`api/src/rate_limit.rs` `check_update_terms`). - Documented as public in `README.md`; used by Playwright `web/e2e/global-setup.ts` and CI. ### 2) Default admin token - `api/src/config.rs`: `ADMIN_TOKEN` defaults to `"dev-admin-token"` if unset. - Admin routes: `api/src/routes/admin.rs` — Bearer compare (`!=`, not constant-time). - `.env.example` suggests `change-me-admin-token` but runtime still boots without an explicit secret. ### 3) Open `redirect_uri` - Read from query: `web/src/query.ts` `getRedirectUri()`. - On success: `web/src/ui.ts` `renderSuccess` sets `a.href` and `window.location.href = redirectUri` after 2s — **no allowlist**. - SDK: `packages/cl8y-clickwrap/src/urls.ts` `buildSignUrl` / `appendSignParams` pass through `redirectUri` unchecked. ### 4) Blind `X-Forwarded-For` - `api/src/rate_limit.rs` `client_ip`: prefers first XFF hop unconditionally, else `ConnectInfo`. - Attackers can spoof XFF to bypass per-IP limits or exhaust arbitrary buckets. - No `TRUST_PROXY` / hop-count / CIDR allowlist config today. --- ## Why this is needed - Unauthenticated sync is a **control-plane DoS** and couples availability to GitLab + DB write path. - Default admin tokens are a classic production misconfig footgun (property delete cascades signatures). - Open redirects after “Accepted” turn a trusted legal domain into a phishing trampoline. - Spoofable client IP makes rate limits ineffective in front of any reverse proxy (or even without one). --- ## Constraints / guardrails 1. **Portal focus:** Prioritize behaviors that protect `terms.cl8y.com` / `api.terms.cl8y.com` users on EVM/Terra flows; keep CI/e2e working with explicit test tokens. 2. **Startup sync / worker:** Keep `TERMS_SYNC_ON_STARTUP` and interval worker as the primary unattended sync; `/update_terms` becomes an **authenticated ops** endpoint. 3. **Auth choice for `/update_terms`:** Reuse `ADMIN_TOKEN` Bearer (same as admin) **or** a dedicated `UPDATE_TERMS_TOKEN` — document one approach; do not invent a second ad-hoc scheme without docs. 4. **ADMIN_TOKEN:** In production-like configs, **refuse to start** (or refuse admin + update_terms) if token missing/empty/known-default. Local/dev may allow explicit opt-in (`ALLOW_INSECURE_DEFAULTS=true`) — never silent default in prod. 5. **redirect_uri allowlist:** HTTPS-only in prod; allow `http://localhost` / `127.0.0.1` when `ALLOW_LOCALHOST_PROPERTY` or a dedicated redirect-dev flag is on. Reject `javascript:`, data URLs, and protocol-relative tricks. Prefer exact origin allowlist via env (e.g. `REDIRECT_URI_ALLOWLIST`). 6. **SDK:** Document that hosts must pass allowlisted URIs; add optional validation helper — do not break headless integrators who open sign URLs server-side with known-good redirects. 7. **XFF:** Default to **socket peer IP** unless `TRUSTED_PROXY_CIDRS` (or similar) is set; only then honor XFF from trusted proxies (rightmost/leftmost policy documented). 8. **Constant-time compare** for bearer tokens when touching admin auth. 9. **Docs:** Update `.env.example`, `README.md`, e2e env, `.gitlab-ci.yml` accordingly. --- ## Relevant files | Area | Path | |------|------| | Update terms route | `api/src/routes/update_terms.rs` | | Rate limit / IP | `api/src/rate_limit.rs` | | Config | `api/src/config.rs` | | Admin auth | `api/src/routes/admin.rs` | | Portal redirect | `web/src/ui.ts`, `web/src/query.ts` | | SDK URLs | `packages/cl8y-clickwrap/src/urls.ts` | | Env / docs | `.env.example`, `README.md`, `web/e2e/global-setup.ts`, `.gitlab-ci.yml`, `web/playwright.config.ts` | --- ## Recommended direction 1. **`/update_terms`:** Require `Authorization: Bearer <ADMIN_TOKEN>` (or dedicated token); return 401 otherwise. Keep GET optional or drop GET for CSRF-ish clarity (prefer POST-only). 2. **Config:** `admin_token: Option` / fail-fast; reject `"dev-admin-token"` unless insecure opt-in. 3. **redirect_uri:** Shared validator used by `renderSuccess` (and optionally SDK). Env allowlist of origins; strip/refuse credentials; no auto-redirect if invalid (show success without navigate). 4. **XFF:** `client_ip` uses ConnectInfo by default; if peer is in trusted proxy CIDRs, parse XFF per documented hop policy. 5. **Tests:** See test plans below; update e2e global-setup to send Bearer token. --- ## Acceptance criteria - [ ] Unauthenticated `/update_terms` returns **401/403**; authenticated call still syncs. - [ ] API does not default to a known admin token in production configuration; CI/dev documented. - [ ] Portal ignores or refuses non-allowlisted `redirect_uri` (no navigation to attacker origin). - [ ] Rate limit IP spoofing via XFF fails when proxy trust is unset; trusted-proxy mode documented and tested. - [ ] Admin bearer comparison is constant-time (or equivalent). - [ ] README + `.env.example` + CI/e2e updated. - [ ] EVM Playwright e2e still green with authenticated terms sync. --- ## Test plan (functional paths) 1. `POST /update_terms` without auth → denied. 2. `POST /update_terms` with valid Bearer → `published` / `unchanged` as today. 3. Admin list/delete with valid/invalid/missing token. 4. Boot without `ADMIN_TOKEN` → fail or insecure-opt-in path only. 5. Portal success with allowlisted `redirect_uri` → redirect works. 6. Portal success with `https://evil.example` → no redirect (success message still shown). 7. Rate limit: two writes from same ConnectInfo IP hit limit; spoofed XFF without trust does not create a separate unlimited bucket. 8. With trusted proxy config, XFF from trusted peer affects bucket as designed. --- ## Test plan (attack / abuse / hack vectors) | Vector | Expectation | |--------|-------------| | Unauth flood `/update_terms` | 401 + no GitLab fetch / no publish | | Stolen browser session calling `/update_terms` | Still needs bearer (not cookie-auth); document token handling | | Default/guessable admin token on prod | Prevented by fail-fast / no default | | `redirect_uri=https://evil.com` phishing after Accept | Blocked | | `redirect_uri=javascript:alert(1)` | Blocked | | `redirect_uri=//evil.com` / userinfo tricks | Blocked | | XFF `X-Forwarded-For: 1.2.3.4` direct to API | Ignored without trusted proxy | | XFF list stuffing / many hops | Documented hop policy; no panic | | Bearer timing oracle | Constant-time compare | | Admin DELETE property cascade abuse | Still requires valid token; rate-limited | --- ## Verification criteria - `cargo test` covers auth + XFF cases. - Web unit/e2e covers redirect allowlist behavior. - Staging deploy: curl without token fails; with token works; sign flow with good/bad redirect_uri behaves as specified. - Gap security items 4–7 in `gaps/GAP_1786322222.md` marked addressed for portal/API ops.
PlasticDigits commented 2026-08-10 00:41:42 +00:00 (Migrated from gitlab.com)
Copy link

mentioned in issue #4

mentioned in issue #4
PlasticDigits commented 2026-08-10 00:41:48 +00:00 (Migrated from gitlab.com)
Copy link

marked as related to #4

marked as related to #4
PlasticDigits commented 2026-08-10 00:53:20 +00:00 (Migrated from gitlab.com)
Copy link

mentioned in commit c40ea6e7b5d7a5273e435413c0b345bf40e6f83f

mentioned in commit c40ea6e7b5d7a5273e435413c0b345bf40e6f83f
PlasticDigits commented 2026-08-10 00:53:38 +00:00 (Migrated from gitlab.com)
Copy link

mentioned in merge request !21

mentioned in merge request !21
PlasticDigits commented 2026-08-10 00:54:00 +00:00 (Migrated from gitlab.com)
Copy link

mentioned in merge request !22

mentioned in merge request !22
PlasticDigits commented 2026-08-10 01:54:13 +00:00 (Migrated from gitlab.com)
Copy link

Merge readiness check (MR !22)

Reviewed fix/issue-3-security-ops @ c40ea6e against issue #3 acceptance criteria.

Acceptance criteria

Criterion Status
Unauth /update_terms → 401; auth still syncs Met (integration + curl)
No known default ADMIN_TOKEN in prod config Met (fail-fast + ALLOW_INSECURE_DEFAULTS)
Portal refuses non-allowlisted redirect_uri Met (deny-all default)
XFF ignored without trusted proxies Met (unit + docs)
Constant-time admin bearer compare Met (subtle)
README / .env.example / CI/e2e updated Met
EVM Playwright e2e with authenticated sync Partial at review time — code/config ready; CI push pipeline failed early on pre-existing cargo fmt drift so test:e2e was skipped; local Playwright blocked by port conflict during review

Problems / ops follow-ups

  1. Staging checklist still open: set real ADMIN_TOKEN; set TRUSTED_PROXY_CIDRS only behind a reverse proxy; set VITE_REDIRECT_URI_ALLOWLIST for real dapp origins (empty allowlist denies all redirects by design).
  2. Breaking ops change: GET /update_terms removed — callers must use authenticated POST (scripts/publish-terms.sh updated).
  3. CI hygiene: pre-existing rustfmt/clippy drift on main/branch prevented full e2e signal on this SHA; will re-verify after rebase onto !23 (which includes fmt/CI workflow fixes) before merge.
  4. Minor test gap: integration covers unauth 401 strongly; authenticated /update_terms 200 asserted via curl/e2e setup more than a dedicated integration assert.
## Merge readiness check (MR !22) Reviewed `fix/issue-3-security-ops` @ `c40ea6e` against issue #3 acceptance criteria. ### Acceptance criteria | Criterion | Status | |-----------|--------| | Unauth `/update_terms` → 401; auth still syncs | **Met** (integration + curl) | | No known default `ADMIN_TOKEN` in prod config | **Met** (fail-fast + `ALLOW_INSECURE_DEFAULTS`) | | Portal refuses non-allowlisted `redirect_uri` | **Met** (deny-all default) | | XFF ignored without trusted proxies | **Met** (unit + docs) | | Constant-time admin bearer compare | **Met** (`subtle`) | | README / `.env.example` / CI/e2e updated | **Met** | | EVM Playwright e2e with authenticated sync | **Partial at review time** — code/config ready; CI push pipeline failed early on pre-existing `cargo fmt` drift so `test:e2e` was skipped; local Playwright blocked by port conflict during review | ### Problems / ops follow-ups 1. **Staging checklist still open:** set real `ADMIN_TOKEN`; set `TRUSTED_PROXY_CIDRS` only behind a reverse proxy; set `VITE_REDIRECT_URI_ALLOWLIST` for real dapp origins (empty allowlist denies all redirects by design). 2. **Breaking ops change:** `GET /update_terms` removed — callers must use authenticated `POST` (`scripts/publish-terms.sh` updated). 3. **CI hygiene:** pre-existing rustfmt/clippy drift on `main`/branch prevented full e2e signal on this SHA; will re-verify after rebase onto !23 (which includes fmt/CI workflow fixes) before merge. 4. Minor test gap: integration covers unauth 401 strongly; authenticated `/update_terms` 200 asserted via curl/e2e setup more than a dedicated integration assert.
PlasticDigits commented 2026-08-10 01:59:21 +00:00 (Migrated from gitlab.com)
Copy link

mentioned in commit 16a75c63ccd5e76e53e925193046b21181a48211

mentioned in commit 16a75c63ccd5e76e53e925193046b21181a48211
PlasticDigits commented 2026-08-10 02:04:29 +00:00 (Migrated from gitlab.com)
Copy link

Conflict resolution + CI fix (pre-merge)

Rebased !22 onto merged Terra tip (6ec0af6 / now on main):

  • Kept POST-only authenticated /update_terms, trusted-proxy XFF, /health readiness, redirect allowlist.
  • Kept Terra ADR-036 tests + 64 KiB body limit from !23.
  • Combined gap notes for security items 4–7 + Terra resolved.
  • Fixed clippy unused PrehashSigner import that failed lint:rust after rebase.

Local cargo test: 40 unit + 4 integration passed after conflict resolution. Awaiting green MR pipeline before merge.

## Conflict resolution + CI fix (pre-merge) Rebased !22 onto merged Terra tip (`6ec0af6` / now on `main`): - Kept POST-only authenticated `/update_terms`, trusted-proxy XFF, `/health` readiness, redirect allowlist. - Kept Terra ADR-036 tests + 64 KiB body limit from !23. - Combined gap notes for security items 4–7 + Terra resolved. - Fixed clippy unused `PrehashSigner` import that failed `lint:rust` after rebase. Local `cargo test`: 40 unit + 4 integration passed after conflict resolution. Awaiting green MR pipeline before merge.
PlasticDigits commented 2026-08-10 02:04:35 +00:00 (Migrated from gitlab.com)
Copy link

mentioned in commit b0725585cd

mentioned in commit b0725585cdcba13ccb78bf8a24a7a85ecc34b083
PlasticDigits commented 2026-08-10 02:18:45 +00:00 (Migrated from gitlab.com)
Copy link

Merge note — CI quota blocked glab mr merge

After rebase + local verification (cargo clippy -D warnings, cargo test 40 unit + 4 integration), MR !22 lint jobs were green but remaining CI jobs stuck/failed with ci_quota_exceeded.

glab mr merge then reported ci_must_pass / canceled pipeline and could not complete. Merged to main via git merge of fix/issue-3-security-ops instead (equivalent commit content).

Ops still required before/at deploy: set production ADMIN_TOKEN; set VITE_REDIRECT_URI_ALLOWLIST for real origins; set TRUSTED_PROXY_CIDRS only behind a reverse proxy.

## Merge note — CI quota blocked `glab mr merge` After rebase + local verification (`cargo clippy -D warnings`, `cargo test` 40 unit + 4 integration), MR !22 lint jobs were green but remaining CI jobs stuck/failed with **`ci_quota_exceeded`**. `glab mr merge` then reported `ci_must_pass` / canceled pipeline and could not complete. Merged to `main` via git merge of `fix/issue-3-security-ops` instead (equivalent commit content). **Ops still required before/at deploy:** set production `ADMIN_TOKEN`; set `VITE_REDIRECT_URI_ALLOWLIST` for real origins; set `TRUSTED_PROXY_CIDRS` only behind a reverse proxy.
PlasticDigits (Migrated from gitlab.com) closed this issue 2026-08-10 02:19:01 +00:00
PlasticDigits commented 2026-08-10 02:19:24 +00:00 (Migrated from gitlab.com)
Copy link

mentioned in commit 8cf6527707

mentioned in commit 8cf6527707947dbdecf40f9edd7df0015b90bccc
PlasticDigits (Migrated from gitlab.com) reopened this issue 2026-08-10 02:19:38 +00:00
PlasticDigits commented 2026-08-10 02:19:59 +00:00 (Migrated from gitlab.com)
Copy link

Merged to main via !22 tip c5fdf1a (merge commit 8cf6527). Acceptance criteria met in code; staging ops checklist still applies for deploy.

Merged to `main` via !22 tip `c5fdf1a` (merge commit `8cf6527`). Acceptance criteria met in code; staging ops checklist still applies for deploy.
PlasticDigits (Migrated from gitlab.com) closed this issue 2026-08-10 02:20:01 +00:00
PlasticDigits commented 2026-08-10 02:29:46 +00:00 (Migrated from gitlab.com)
Copy link

mentioned in commit 69e117eb88

mentioned in commit 69e117eb88d9f5e985ca1c0108fdf88810858a13
PlasticDigits commented 2026-08-10 02:29:57 +00:00 (Migrated from gitlab.com)
Copy link

mentioned in merge request !24

mentioned in merge request !24
Sign in to join this conversation.
No Branch/Tag specified
Branches Tags
main
issue/34
issue/37
renovate/configure
No results found.
Labels
Clear labels   
agent:implement
agent-control

  
agent:ready
agent-control

  
api

   
bot

   
bug

   
ci

   
enhancement

   
ready
agent-control

  
security

   
terra-classic

   
testing

   
ux

   
web
No labels
agent:implement
agent:ready
api
bot
bug
ci
enhancement
ready
security
terra-classic
testing
ux
web
Milestone
Clear milestone
No items
No milestone
Projects
Clear projects
No items
No project
Assignees
Clear assignees
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference
code/cl8y-ecosystem-legal#3
No description provided.