Issues

• Dockerfile copies a second ROOT.war into Tomcat's conf/ directory

  BugDistribution
  OWASP/SecurityShepherd#1034 · Filter by author ismisepaul opened on Oct 25, 2026

• Publish the Tomcat image for linux/arm64 as well as linux/amd64

  DistributionEnhancementgithub_actions
  OWASP/SecurityShepherd#1033 · Filter by author ismisepaul opened on Oct 25, 2026 · 4.0.0

• Publish the MariaDB and MongoDB images to Docker Hub as owasp/security-shepherd-db and owasp/security-shepherd-mongo

  DistributionEnhancementgithub_actions
  OWASP/SecurityShepherd#1025 · Filter by author ismisepaul opened on Oct 25, 2026

• Dependency audit: what we can remove or consolidate (follows trim-reaper)

  dependenciesjavaPlatform
  OWASP/SecurityShepherd#1022 · Filter by author ismisepaul opened on Oct 25, 2026

• Docs: make clear the Docker Compose setup is a quick start, not a production deployment

  DistributionDocumentation
  OWASP/SecurityShepherd#1020 · Filter by author ismisepaul opened on Oct 25, 2026 · 4.0.0

• CsrfChallengeSixGetToken is unreachable and its database user and schema don't exist

  Levels
  OWASP/SecurityShepherd#1006 · Filter by author ismisepaul opened on Oct 25, 2026

• [Security] jtidy r938 in FindXSS loops forever on some short XSS submissions (one request pins a CPU core)

  BugdependenciesPlatform
  OWASP/SecurityShepherd#1002 · Filter by author ismisepaul opened on Oct 25, 2026 · 4.0.0

• Code scanning: redundant new String("...") constructors across src/main/java

  java
  OWASP/SecurityShepherd#999 · Filter by author ismisepaul opened on Oct 25, 2026

• Record the version and source of the vendored clipboard.js, or replace it

  dependenciesWebApp
  OWASP/SecurityShepherd#997 · Filter by author ismisepaul opened on Oct 24, 2026

• lessons/adminOnly/resultKey.jsp loads its script from a path that 404s

  BugWebApp
  OWASP/SecurityShepherd#996 · Filter by author ismisepaul opened on Oct 24, 2026

• index.jsp: CTF countdown never clears, malformed deletePlayers error HTML, debug alert on success messages

  BugWebApp
  OWASP/SecurityShepherd#995 · Filter by author ismisepaul opened on Oct 24, 2026

• [BUG] NoSQL Injection 1 only answers once per Tomcat run: the servlet closes the shared MongoClient

  BugLevels
  OWASP/SecurityShepherd#992 · Filter by author ismisepaul opened on Oct 24, 2026 · 4.0.0

• Published Tomcat image would ship the build's TLS private key and an empty database config

  DistributionPlatform
  OWASP/SecurityShepherd#991 · Filter by author ismisepaul opened on Oct 24, 2026
  1

• [BUG] SQL Injection 5 coupon check throws MissingResourceException on a failed query

  BugLevels
  OWASP/SecurityShepherd#990 · Filter by author ismisepaul opened on Oct 24, 2026

• docs/database-configuration.md documents the wrong Mongo pool property names

  Documentation
  OWASP/SecurityShepherd#989 · Filter by author ismisepaul opened on Oct 24, 2026

• MongoDB in Docker runs without authorisation

  DistributionPlatform
  OWASP/SecurityShepherd#988 · Filter by author ismisepaul opened on Oct 24, 2026
  1

• docker/mongo: the generated mongod.conf is never used, so MONGO_BIND_ADDRESS has no effect

  BugDistribution
  OWASP/SecurityShepherd#987 · Filter by author ismisepaul opened on Oct 24, 2026
  1

• Setup never seeds MongoDB: executeMongoScript uses the removed eval command

  BugPlatform
  OWASP/SecurityShepherd#986 · Filter by author ismisepaul opened on Oct 24, 2026

• 4.0.0 release checklist

  Distribution
  OWASP/SecurityShepherd#979 · Filter by author ismisepaul opened on Oct 24, 2026 · 4.0.0

• Adopt MariaDB Connector/J 4.0: enable TLS for the Docker database and audit executeQuery() calls

  dependenciesPlatform
  OWASP/SecurityShepherd#977 · Filter by author ismisepaul opened on Oct 24, 2026

• [BUG] ChangeUserPassword throws NPE before its null check when player is missing

  BugPlatform
  OWASP/SecurityShepherd#973 · Filter by author ismisepaul opened on Oct 24, 2026 · 4.0.0

• [BUG] CSRF token parameter logged in OpenAllModules servlet

  BugPlatform
  OWASP/SecurityShepherd#972 · Filter by author ismisepaul opened on Oct 24, 2026 · 4.0.0

• [BUG] CSRF tokens logged in Register servlet on token mismatch

  BugPlatform
  OWASP/SecurityShepherd#971 · Filter by author ismisepaul opened on Oct 24, 2026 · 4.0.0

• Default TZ to UTC instead of Europe/Dublin

  DocumentationEnhancementPlatform
  OWASP/SecurityShepherd#970 · Filter by author ismisepaul opened on Oct 24, 2026 · 4.0.0

• AGENTS.md: 'mvn -Pdocker validate' doesn't produce usable docker/mariadb init scripts

  Documentation
  OWASP/SecurityShepherd#962 · Filter by author ismisepaul opened on Oct 24, 2026 · 4.0.0