Questions:

• What is the acceptable max length for comments?

How big do you consider this to be a security risk since the commenting is restricted only to users who have access to particular request? In most of the instances the users who are authenticated in the system are verified and part of the institution who runs the instance, therefore the malicious intent is quite limited. Please let me know if you are aware of other cases - otherwise I wouldn't consider this as a v12 release blocker

Thanks for the comment @kpsherva . While logged-in users are generally trusted, risks include:

• ORCID Logins: Easy to obtain, not highly secure, can be misused.
• Insider Threats: Verified users can still be malicious.
• Human Error: Unintentional long inputs can cause instability.
• Best Practices: Limiting input length is standard for security and stability.
  Of course, it's not a blocker, but it's a low-risk improvement that enhances security and stability, so why not include it in V12?

After a DM on Discord, it’s decided that v12 will focus on critical fixes due to resource constraints for testing.
This could be included in v12.1 if the scope is clear and resources are available.

This issue was automatically marked as stale.

This issue was automatically marked as stale.