Article loader joins file to the KB dir with no sanitisation - traverse out: ?file=../secret_config.txt or ?file=../../etc/passwd.
# Password Policy - Minimum 12 characters. - Rotate every 90 days. - Never reuse the last 5 passwords. Password reset links are single-use and expire in 30 minutes (in theory).