GHSA-h5fq-653g-gxrm ots has a negative expire override that can bypass its secret retention policy

• Go github.com/Luzifer/ots: < 1.21.5 → fixed in 1.21.5

Summary The `/api/create` endpoint accepted negative `expire` query values. For the memory storage backend, negative values were passed to secret creation as a negative duration and treated as no expiry, allowing callers to create secrets that persisted longer than intended. Impact Unauthenticated users could bypass configured retention expectations for secrets they create by sending `POST /api/create?expire=-1`. This does not allow reading or modifying secrets created by other users. Secrets remain one-time-read and, in the normal web flow, client-side encrypted. Affected versions Versions up to and including v1.21.4 are affected. Patched versions Fixed in v1.21.5. Workarounds Disable expiry overrides via `disableExpiryOverride: true` until upgrading. Credit Reported by Chai Cheng Xun via email.