veilor-org/infra
1
0
Fork 0
Code Issues 7 Pull requests Projects Releases Packages Wiki Activity Actions

F8: signup-txt has no rate limiting #2

New issue
Open
opened 2026-05-06 10:56:40 +01:00 by s8n · 0 comments
s8n commented 2026-05-06 10:56:40 +01:00
Owner
Copy link

Severity: High — Risk Score open
Status: Open — pattern exists for Misskey signup-strict, mirror needed.

The /signup endpoint on signup.txt.s8n.ru has no Traefik rate-limit middleware nor nginx limit_req zone. Bot/spammer flood would create thousands of Matrix accounts in seconds.

Fix: Add Traefik rate-limit-signup-txt@file middleware (1 req / 30s, burst 3 — match signup-strict for Misskey) AND nginx-level limit_req in signup-txt config block.

Verification: k6 / siege test — 5 req in 1s should see 4 dropped 429.

Source: security/nullstone-server/2026-05-02.md §F8.

**Severity:** High — Risk Score open **Status:** Open — pattern exists for Misskey signup-strict, mirror needed. The `/signup` endpoint on `signup.txt.s8n.ru` has no Traefik rate-limit middleware nor nginx `limit_req` zone. Bot/spammer flood would create thousands of Matrix accounts in seconds. **Fix:** Add Traefik `rate-limit-signup-txt@file` middleware (1 req / 30s, burst 3 — match `signup-strict` for Misskey) AND nginx-level `limit_req` in signup-txt config block. **Verification:** k6 / siege test — 5 req in 1s should see 4 dropped 429. Source: `security/nullstone-server/2026-05-02.md` §F8.
s8n added the
audit
high
infra
security
 labels 2026-05-06 10:56:40 +01:00
Sign in to join this conversation.
No Branch/Tag specified
Branches Tags
main
backup/pre-rename-2026-05-07/main
No results found.
Labels
Clear labels   
audit

   
critical

   
deferred

   
high

   
infra

   
medium

   
security
No labels
audit
critical
deferred
high
infra
medium
security
Milestone
Clear milestone
No items
No milestone
Projects
Clear projects
No items
No project
Assignees
Clear assignees
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference: veilor-org/infra#2
No description provided.
Delete branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?