SOCFortress CoPilot focuses on providing a single pane of glass for all your security operations needs. Prior to 0.1.76, verify_graylog_header in backend/app/active_response/routes/graylog.py and verify_velociraptor_header in backend/app/incidents/routes/incident_alert.py authenticate webhooks against GRAYLOG_API_HEADER_VALUE and VELOCIRAPTOR_API_HEADER_VALUE with the same publicly hardcoded fallback. The same default is shipped in .env.example. Deployments that leave either setting unset or unchanged permit an anonymous caller with the known header value to bypass the JWT authentication required by normal APIs. POST /api/graylog/invoke forwards attacker-selected COMMAND, ACTION, VALUE and AGENT_ID to the configured Wazuh manager without the command-enum validation of the authenticated…