Weekend Security Audit on Jo4 Reveals Four Vulnerabilities Including Stack Trace Leaks

A self-conducted weekend security audit of the jo4 platform uncovered four distinct vulnerabilities that had gone unnoticed in production. Spring Security's default X-Frame-Options: DENY header was silently breaking the platform's embeddable stats widgets by blocking browsers from rendering them in iframes. An unvalidated query parameter in the embed controller was exposing full stack traces to users, leaking internal application details on bad input. Duplicate Content Security Policy headers — one from Spring Security defaults and one from custom configuration — were causing browsers to enforce the more restrictive of the two, creating unintended restrictions. The issues were resolved through targeted fixes including per-entity header control, input validation with safe defaults, and consolidating all security headers into a single configuration source.