security: hardening release v1.2.0 - #3

Merged

BrunoAFK merged 12 commits into

mainfrom

security/v1.2.0

Apr 11, 2026

Commits on Apr 10, 2026

remove helm chart
BrunoAFK
committed
8ed7044
core(network): extend isPrivateIP to cover CGNAT, multicast, reserved, mapped IPv6
BrunoAFK
committed
aed956c
core(safe-fetch): SSRF-hardened HTTP client with DNS pinning + redirect revalidation
BrunoAFK
committed
b20a27b
core(handlers): migrate all outbound HTTP from axios to safeFetch (SSRF guard)
BrunoAFK
committed
f8d1a00
core(threats): return canonical SSRF error at top level
BrunoAFK
committed
2edd4b0

Commits on Apr 11, 2026

core(screenshot): SSRF gate + remove --no-sandbox from Chromium
BrunoAFK
committed
7e0a791
api(server): tighten CORS default to false, raise rate limit precision
BrunoAFK
committed
ffde79d
web(nginx): add strict CSP and security headers
BrunoAFK
committed
17eeb97
containers: run as non-root, drop all caps, read-only rootfs
BrunoAFK
committed
8d67803
ci: sign release images with cosign (keyless OIDC) + attach SBOM
BrunoAFK
committed
8bf8581
release: v1.2.0
BrunoAFK
committed
d4f59c4
deps: bump axios to ^1.15.0 and override basic-ftp to ^5.2.2
BrunoAFK
committed
d521e7a