Some general security advise

[LilithWittmann]

Some general security advise

[horilla-opensource]

Hi @LilithWittmann ,
Thanks for pointing out to improvising the product.
The team is working on this concerns and will add a patch very soon.
We appreciate the time and efforts that you have to taken for testing Horilla.

With Regards,
Team Horilla

[horilla-opensource]

HI @LilithWittmann ,
We have acknowledged the issues that you have raised.

1. For the demo instance we have added the debug as True for our testing purpose and we did not intend to use it for production purpose.
2. We are updating the production deployment documentation for which we'll mentioning the DEBUG attribute to be set to false.
3. The password auth method has been changed and revised using the default Django's method.
4. We are working on the method to have file access for the document owners only in defined cases.
5. The SQLite3 database which we provide is for the testing purpose and we don't recommend using it for production. That database is solely meant for the testing purpose alone.
6. The bot account user creation method has been changed and the password is not provided now. Also in the initial case, the users won't be able to access the system using the bot account credentials because the authentication works only when an employee records has been created for the same account, but for the bot account no employee records get created which there by restricts the access to the system.
7. We really appreciate the efforts that you have taken on giving out points on improving Horilla. Thank you.☺️

With Regards,
Team Horilla

[BhuviTheDataGuy]

Informative, thanks for the contribution @LilithWittmann :)

[horilla-opensource]

Hi @LilithWittmann ,
The necessary suggestion updates have done and pushed to the main code base.

With Regards,
Team Horilla

[horilla-opensource]

Hi @LilithWittmann ,
We are closing this issue due to inactivity. It seems that there hasn't been any recent activity or discussion, and we believe it may have been resolved or is no longer relevant.
If you feel this issue is still important and should be addressed, please feel free to reopen it or create a new issue with updated details.

With Regards,
Team Horilla