← Back to list security
Security Hardening - Formula Injection, Self-Delete, Last-Admin
Four targeted security patches and one custom exception handler for consistent JSON responses.
Problem
Several specific attack surfaces: Excel formula injection, admin self-delete, and token reuse.
Decision
Five focused patches with narrow negative tests.
Result
Coverage matrix improved from 64/70 to 67/70; no happy-path regression.
Implementation
- Formula injection escape on every user-controlled Excel field.
- Self-delete + last-admin + token revoke guards close lockout and reuse paths.
- Custom exception handler forces JSON responses for all /api/* routes.