Hi. Total Opencats noob here. However, I do have background in IT security and share the same concerns.
I'm implementing Opencats on my shared hosting provider, and have gone through extensive security scans and tests in order to make sure I'm not going to cough up user information or personally identifiable information due to a breach. In general, the app has passed all checks and scans, with only one caveat identified by the tinfoil security scanner. Note, I did make modifications to my Apache config, to change a number of security headers. Opencats survived all of those changes and is still working for me.
The one significant security flaw I may have uncovered is Cross-Site Request Forgery (CSRF) exposure. This is on all of the various input forms, especially the login forms. I am still reviewing the mountain of PHP and JavaScript code behind the pages so am not sure if this is a false positive. Details of CSRF exploits and recommended fixes are here:
https://en.wikipedia.org/wiki/Cross-sit ... st_forgery.
From what I see, the team is doing a pretty good job. But I am not an expert or ethical hacker. For the CSRF issue, I see a random token value set in the CATS cookie, but I have yet to find the code that validates it every session. I didn't see a header with it either, so if it's cookie only, then there is a vulnerability as the cookie can be spoofed. If the code IS there though and I haven't found it, this is a false alarm. If not, then it's an opportunity for future security improvements.
Perhaps someone from the development team can chime in here.