Report privately — do not open a public issue.

Use GitHub's private vulnerability reporting: Report a vulnerability. If that is unavailable, contact the maintainer through their GitHub profile.

Please include the affected version or commit, reproduction steps, and what an attacker gains. A first response should arrive within 7 days.

These are documented rather than hidden. Anyone deploying ZKAPI needs to know them before it faces a network.

Program.cs calls app.UseAuthorization() but registers no authentication scheme, and no controller or action carries [Authorize].

Every endpoint is fully open. Anyone who can reach the port can read, create, modify and delete employee records, departments, and the complete attendance history — that is, biometric-derived records of when identifiable people entered and left a building.

Severity: high. This is the most serious open issue in the repository.

Mitigation until it is fixed: do not expose ZKAPI beyond a trusted network segment. Bind to localhost where possible, and place it behind an authenticating reverse proxy if it must be reachable.

UseSwagger() and UseSwaggerUI() are called unconditionally, outside the usual IsDevelopment() guard. The complete API surface — every route, payload and model — is discoverable in production. Combined with issue 1, this hands an attacker the full map.

ZKAPI/appsettings.json contained a live connection string:

server=localhost;port=3306;database=att;user=root;password=root

Removing a secret from HEAD does not unpublish it. The value remains reachable by commit SHA, and in any clone, fork or cache made while it was public.

Required follow-up:

1. Rotate the MySQL password. Treat root/root as compromised. This is the only step that actually resolves the exposure — the rest is cleanup.
2. Purge the value from history with git filter-repo, then force-push. This rewrites every commit SHA and requires every clone to be re-cloned.
3. Never grant the API a root account. Create a dedicated user limited to the att database.

.vs/ was tracked, including .suo, applicationhost.config, design-time build caches, and Copilot semantic indices (CodeChunks.db, SemanticSymbols.db) containing indexed source. Untracked on 7 September 2026 and now covered by .gitignore. Still present in history.

ZUtility pushes to ZKAPI over plain HTTP (http://localhost:5159). On a single host this is fine. If the collector and API are ever split across machines, attendance data crosses the network unencrypted.

This system processes personal data: employee names, and biometric-derived timestamps establishing an identifiable person's physical presence. Depending on jurisdiction, that is likely to be regulated — including obligations around retention limits, access control, and the lawful basis for collection.

Nothing in this repository implements those obligations. There is no retention policy, no audit log, no access control (see issue 1), and no anonymisation path. This is stated so that it is a known gap and not an assumption.

In scope: authentication and authorisation flaws, injection, data exposure, dependency vulnerabilities with a practical path to exploitation.

Out of scope: the issues already listed above (report new findings), and anything requiring pre-existing access to the host or database.