DevEnv nis2-agileandClaude Opus 4.8 e269fb108f [SEC] Redatta chiave API mktg esposta in pagine pubbliche (F1 security audit) ...

La chiave di produzione nis2_mktg_... (scope admin:licenses) era in chiaro in
mktg-api-doc.html e integrazioniext.html, servite pubblicamente -> chiunque poteva
ottenere una chiave di gestione licenze B2B. Sostituita con placeholder
nis2_mktg_xxxxx in entrambe le pagine (6 occorrenze totali).

NOTA: la chiave reale va ANCORA RUOTATA nel DB (api_keys) in coordinamento con
mktg-agile, poiche' resta nella history git e potenzialmente nota. Questo commit
elimina solo l'esposizione web continua.

Trovato da audit sicurezza multi-agente (F1, priorita' top).

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

2026-05-31 16:16:53 +02:00

..

admin

[FEAT] UI Fasi 4+5: Impersonate banner + Preferenze + Branding white-label (v1.6.0)

2026-05-29 13:28:57 +02:00

css

[UX] FAB feedback: pill cyan con label, animazione pulse, stile lg231

2026-03-10 11:27:19 +01:00

docs

[DOCS] Pagina documentazione Testing & Simulazione

2026-03-10 09:40:27 +01:00

integrations

[MIGRATE] Migrazione a nis2.agile.software

2026-03-07 14:07:10 +01:00

js

[FIX] Knowledge Base: token key errata (access_token->nis2_access_token) + init mancante

2026-05-31 15:11:37 +02:00

.htaccess

[FIX] Deploy fixes - Auth header passthrough, dashboard query, landing page

2026-02-17 18:08:43 +01:00

api-status.php

[CORE] Initial project scaffold - NIS2 Agile Compliance Platform

2026-02-17 17:50:18 +01:00

architecture.html

[FEAT] i18n IT/EN, Help Online contestuale, pagina Architettura

2026-02-18 08:34:37 +01:00

assessment.html

[SEC+UX] Hardening sicurezza + miglioramenti UX pre-audit

2026-02-20 12:01:33 +01:00

assets.html

[FIX] ri-review guida: 2 fix guida + 2 fix prodotto UI orfane

2026-05-31 08:51:30 +02:00

companies.html

[FIX] Connettori per-azienda: aggiunti realmente i 4 metodi controller + UI card (commit 0dc2a11 era guscio vuoto, Edit fallite su ancore errate)

2026-05-30 10:53:48 +02:00

cross-analysis.html

[FEAT] L4 AI Cross-Analysis — analisi aggregata multi-org per consulenti

2026-03-09 08:17:53 +01:00

dashboard.html

[FIX] Test multi-agente: dashboard gauge + risks backToList/loadFair

2026-05-31 14:56:10 +02:00

forgot-password.html

[FEAT] Allineamento NIS2 ↔ TRPG (Fasi 1-5): SSO + Sessions + Reset + Impersonate + Branding

2026-05-29 13:18:35 +02:00

guida.html

[FIX] Precisione normativa: relazione finale +1 mese DALLA NOTIFICA + guida allineata

2026-05-31 16:13:21 +02:00

incidents.html

[FIX] incidents.html: apostrofi non-escaped in evalSignificance rompevano l'intera pagina

2026-05-31 11:12:03 +02:00

index-en.html

[FEAT] UI: guida online, landing EN, mobile-conversion, ai-assistant, bug-reporter + help/i18n

2026-05-29 15:42:00 +02:00

index.html

[FEAT] UI: guida online, landing EN, mobile-conversion, ai-assistant, bug-reporter + help/i18n

2026-05-29 15:42:00 +02:00

index.php

[FIX] Auth CRITICI da test multi-agente: register senza jti + revoca sessione singola

2026-05-31 15:01:22 +02:00

integrazioniext.html

[SEC] Redatta chiave API mktg esposta in pagine pubbliche (F1 security audit)

2026-05-31 16:16:53 +02:00

kb.html

[FIX] Knowledge Base: token key errata (access_token->nis2_access_token) + init mancante

2026-05-31 15:11:37 +02:00

licenseExt.html

[FEAT] licenseExt: sezione dati destinatario pre-compila form + link pronto + modale con recipient data

2026-03-10 12:00:26 +01:00

login.html

[FEAT] Allineamento NIS2 ↔ TRPG (Fasi 1-5): SSO + Sessions + Reset + Impersonate + Branding

2026-05-29 13:18:35 +02:00

mktg-api-doc.html

[SEC] Redatta chiave API mktg esposta in pagine pubbliche (F1 security audit)

2026-05-31 16:16:53 +02:00

mobile-conversion.css

[FEAT] UI: guida online, landing EN, mobile-conversion, ai-assistant, bug-reporter + help/i18n

2026-05-29 15:42:00 +02:00

mobile-conversion.js

[FEAT] UI: guida online, landing EN, mobile-conversion, ai-assistant, bug-reporter + help/i18n

2026-05-29 15:42:00 +02:00

nis2-license-api.postman.json

[MKTG-API] Fix: Postman collection in public root

2026-03-07 16:05:49 +01:00

normative.html

[FEAT] Services API, Webhook, Whistleblowing, Normative + integrazioni

2026-03-07 13:20:24 +01:00

onboarding.html

[UX] Standardizzazione login/register/onboarding + Test Runner v2

2026-03-07 17:11:25 +01:00

policies.html

[UX+SEC] Eccellenza pre-audit: idle timeout, loading states, i18n, UX polish

2026-02-20 12:25:52 +01:00

presentation.html

[FEAT] Presentazione NIS2 Agile nel repo (presentation.html)

2026-03-09 15:31:07 +01:00

register.html

[FEAT] Simulatore B2B licenze + registrazione ridotta

2026-03-10 15:26:23 +01:00

reports.html

[FIX] ri-review guida: 2 fix guida + 2 fix prodotto UI orfane

2026-05-31 08:51:30 +02:00

reset-password.html

[FEAT] Allineamento NIS2 ↔ TRPG (Fasi 1-5): SSO + Sessions + Reset + Impersonate + Branding

2026-05-29 13:18:35 +02:00

risks.html

[FIX] Test multi-agente: dashboard gauge + risks backToList/loadFair

2026-05-31 14:56:10 +02:00

service-continuity.html

[FEAT] UI: guida online, landing EN, mobile-conversion, ai-assistant, bug-reporter + help/i18n

2026-05-29 15:42:00 +02:00

settings.html

[FEAT] UI Fasi 4+5: Impersonate banner + Preferenze + Branding white-label (v1.6.0)

2026-05-29 13:28:57 +02:00

setup-org.html

[FIX] Fix annual_turnover field name in setup-org.html

2026-02-17 19:49:57 +01:00

simulate-b2b.html

[FEAT] Simulatore B2B licenze + registrazione ridotta

2026-03-10 15:26:23 +01:00

simulate-nis2-big.php

[FEAT] Services API: full-snapshot endpoint + BigSim SSE wrapper

2026-03-17 15:16:00 +01:00

simulate-nis2.php

[FIX] simulate wrapper: PHP_BINARY→php-cli corretto (FPM≠CLI)

2026-03-10 10:51:48 +01:00

simulate.html

[FIX] simulate.html: card BIG + training user_ids array fix

2026-03-17 15:32:02 +01:00

supplier-assessment.html

[FEAT] Self-assessment fornitori (P3 supply chain) - portale pubblico con token

2026-05-30 10:19:01 +02:00

supply-chain.html

[FIX] supply-chain: selettore modale errato (#app-modal -> #modal-overlay)

2026-05-31 14:40:03 +02:00

test-runner.php

[FIX] test-runner: aggiorna email/password ai valori del simulatore

2026-03-09 10:03:14 +01:00

training.html

[FIX] i18n funzionante + bug audit.html + help system

2026-02-20 11:17:04 +01:00

version.json

[FIX] Precisione normativa: relazione finale +1 mese DALLA NOTIFICA + guida allineata

2026-05-31 16:13:21 +02:00

whistleblowing.html

[FEAT] Services API, Webhook, Whistleblowing, Normative + integrazioni

2026-03-07 13:20:24 +01:00

workflow.html

[FEAT] Compliance Journey — workflow visivo 6 fasi NIS2

2026-03-09 07:54:15 +01:00