LoginSign Up
← Back to all sparks
K

Kanboard

PM
Velocity2.5

Free and open source Kanban project management software focused on simplicity and productivity for small teams.

kanboard.org ↗

A mature kanban tool in a methodical security-hardening cycle

kanbanself-hostedsecurity-hardeningphpopen-sourcemaintenance
◆Current state
Kanboard is a stable, self-hosted PHP kanban board whose recent releases are dominated by security work rather than new features. Nearly every point release closes a class of vulnerability — authorization gaps, SSRF, injection, deserialization — alongside small UX fixes and dependency bumps. The product is feature-complete and being maintained defensively.
◆Where it's heading
The arc across 1.2.44 through 1.2.53 is a systematic audit: each release hardens one more surface (LDAP, webhooks, comment visibility, bulk operations, token comparison). New user-facing features are rare and incremental — full-text search opt-in, RTL support, richer API links. This is a project prioritizing trust and long-term maintainability over expansion.
◆Prediction
Expect the pattern to continue: more targeted security fixes and PHP-version-compatibility work in the next release, with occasional small usability additions. No major feature direction is visible in these entries.

◆Recent moves

  1. 18d ago

    Security fixes and opt-in full-text task search

    Continues the hardening cycle — scoped restriction and task-move validation, template escaping, and a per-user option to search task descriptions and comments rather than titles only. The search preference is the one genuinely new user-facing capability here.

    View source ↗
  2. 4mo ago

    Comment visibility rules and timing-safe token checks

    Enforces comment visibility for public and unauthenticated viewers, moves token validation to timing-safe comparison, and replaces raw SQL with parameterized queries. Squarely on the security-audit trajectory.

    View source ↗
  3. 5mo ago

    SSRF protection and safer deserialization

    Adds SSRF controls for webhook notifications, blocks unsafe deserialization in the session handler, and fills in missing API permission checks. Another surface closed in the ongoing audit.

    View source ↗
  4. 6mo ago

    Authorization and CSRF checks across controllers

    Adds missing authorization checks in multiple controllers, enforces project-level checks, and adds CSRF protection for role changes. Consistent with the release-by-release hardening pattern.

    View source ↗
  5. 7mo ago

    LDAP injection fix and trusted-proxy config

    Fixes LDAP injection via placeholder escaping, blocks protocol-relative redirect targets, and adds a trusted-proxy-networks option. Security fixes plus a small keyboard-shortcut restoration.

    View source ↗
  6. 9mo ago

    Public API links, RTL support, subtask counts

    One of the more feature-oriented releases in the window: board/RSS/iCal public links in the API, numeric subtask completion, and basic right-to-left language support, alongside translation additions. A rare stretch of user-facing additions in an otherwise security-focused cycle.

    View source ↗