Edi Life OS v1.1: what a public security pass changed after launching on Hacker News

Description and use

Edi Life OS v1.1 fixed critical vulnerabilities such as XSS, open redirects, missing CSRF protection, weak sign‑in rate limiting, missing security headers, and insecure cookie handling, enhancing user trust.

Problem

The initial release of Edi Life OS exposed multiple security weaknesses such as stored XSS, open redirects, missing CSRF protection, inadequate rate limiting, missing security headers, and insecure cookie handling behind reverse proxies.

Outcome

Edi Life OS v1.1 addressed critical security gaps, improving trust for self‑hosted users and demonstrating a transparent, public audit process.

Workflow

• 1. Reviewed PHP backend and frontend JavaScript for security issues.
• 2. Logged findings in a public GitHub issue and prioritized them.
• 3. Escaped all user‑generated content rendered with innerHTML.
• 4. Restricted redirect parameter to real same‑origin paths.
• 5. Added CSRF token checks to all write endpoints, including the habit tracker API.
• 6. Implemented sign‑in rate limiting (5 failed attempts per 15 minutes per IP).
• 7. Added security headers (CSP, X‑Frame‑Options, Referrer‑Policy, X‑Content‑Type‑Options).
• 8. Introduced LIFEOS_TRUST_PROXY setting for secure cookies and IP‑based rate limiting behind reverse proxies.
• 9. Refactored MCP server to expose a single lifeos_query tool with a type parameter.
• 10. Added new features: multi‑currency display, landing page, CI tests, Docker health check, and light‑theme screenshots.

Evidence

Stored XSS on the dashboard. Goal titles, categories, metrics and finance category names were rendered with innerHTML without escaping.

Source

Open redirect after sign-in. The redirect parameter only had to start with / and not //, which browsers can be tricked around.

Source

Sign-in rate limiting. After 5 failed attempts from one client in 15 minutes you get 429 with Retry-After, and the password isn't even checked.

Source

Security headers. Content-Security-Policy, X-Frame-Options: SAMEORIGIN, Referrer-Policy and X-Content-Type-Options on every response.

Source

HTTPS behind a reverse proxy. A new LIFEOS_TRUST_PROXY setting makes the session cookie Secure based on X-Forwarded-Proto and rate-limits by the real client IP.

Source