Security

Blocked HTML Content in Rich Text Editors

CORS Policy on Halo API

CVE-2023-44487 - HTTP/2 Rapid Reset Attack and the Halo Hosted Platform

CVE-2023-4863

CVE-2024-6200 - Stored Cross-Site Scripting in Tickets

CVE-2024-6201 - Emailing Template Injection

CVE-2024-6202 - SAML XML Signature Wrapping (XSW)

CVE-2024-6203 - Password Reset Poisoning

CVE-2025-40846 - Open Redirect

Data Storage And Security

Enable HTTP strict transport security (HSTS)

Enabling Reference Tokens

Enabling Secure Cookies in the Web Application

Google reCAPTCHA Integration

How are user passwords stored?

Http to Https redirect in web app

IP Addresses for Whitelisting

The article provides a list of IP addresses to whitelist for hosted Halo users, covering different regions: UK, USA/Americas, AUS/APAC, DE/Frankfurt/EU, CA/Canada, ZA, and Bahrain. These IP addresses are essential for allowing API requests and email connections through SMTP/IMAP/POP. The article also advises adding specific DNS listings to the sending domain's SPF record for proper email delivery.

Protect token signing keys with a certificate

Read-only connection for reports

Redacting Card and Social Security Numbers (SSN)

Security Management and Architecture

The article provides security documentation for Halo, addressing common questions about processes, data encryption, and compliance. Backup data is retained in various schedules, and customer data is stored in regional AWS S3 buckets, encrypted with AES-256. Halo complies with ISO 27001 and AWS standards such as SOC and PCI DSS. The release schedule includes stable and beta paths with specific upgrade and patch protocols. Rollbacks occur for critical issues, targeting a 99.95% uptime and a 4-hour recovery time. Customer systems have isolated databases but shared backend infrastructure. IP restrictions are generally not standard.

Setting up Two Factor Authentication

The article provides guidance on setting up Two-Factor Authentication (2FA) to enhance security for Halo accounts. It offers instructions for enabling 2FA for personal accounts, either via email/SMS or an authenticator app like Google or Microsoft Authenticator. The summary includes steps to enable 2FA individually and also how to enforce it for all agents and users through security settings in the Halo configuration. The use of 2FA is recommended for data protection and added security, especially when accessing Halo on mobile devices or in public spaces.

SQL Injection Security Vulnerability

SQL Injection Vulnerability Patched

Update to SAML Validation

X.509 for encryption