From 192c4660bf3d6ec473b02e88cc25f8af8e291ec4 Mon Sep 17 00:00:00 2001 From: Jan-Piet Mens Date: Fri, 24 Jul 2026 13:06:46 +0200 Subject: [PATCH] add ws endpoint --- doc/SECURITY.md | 1 + 1 file changed, 1 insertion(+) diff --git a/doc/SECURITY.md b/doc/SECURITY.md index 71ba84e..7f9fdd6 100644 --- a/doc/SECURITY.md +++ b/doc/SECURITY.md @@ -17,3 +17,4 @@ Implementing HTTP caused a whole slew of additional issues we needed to resolve, Very specifically we need to warn Recorder users using HTTP: - any client permitted to access the `/pub` endpoint can publish data to the Recorder - any client permitted to access the `/api` endpoint can access any user's data, and even destroy it, depending on whether or not the Recorder was built with the `WITH_KILL` flag. +- any client permitted to access the `/ws` endpoint can access users' LAST locations