Repository navigation

Security review fixes (v1.10.2) - #2

Merged

TheJakeBraun merged 12 commits into

security/2026-09-review-fixes

Sep 29, 2026

Merged

Security review fixes (v1.10.2)#2
TheJakeBraun merged 12 commits into
masterfrom
security/2026-09-review-fixes

Commits on Sep 29, 2026
- Narrow Docker volume mounts and stop chmodding the host home
  
  TheJakeBraun
  and
  claude
  committed
  5696110
- Document node RPC safety requirements in README
  
  TheJakeBraun
  and
  claude
  committed
  8f09b62
- Write config migration backups as config.backup-<ts>.php
  
  TheJakeBraun
  and
  claude
  committed
  3de6890
- Only flatten configs that pass a token allowlist
  
  TheJakeBraun
  and
  claude
  committed
  53b66c5
- Refuse untrusted FileCache directories and escape latest version
  
  TheJakeBraun
  and
  claude
  committed
  9111de0
- Rebuild expired cache entries single-flight
  
  TheJakeBraun
  and
  claude
  committed
  b87f14b
- Deny web access to modules/, scripts/ and repo metadata
  
  TheJakeBraun
  and
  claude
  committed
  7a9b4ef
- Render API errors as text instead of innerHTML
  
  TheJakeBraun
  and
  claude
  committed
  c179df2
- Send nosniff and Referrer-Policy headers on the status page
  
  TheJakeBraun
  and
  claude
  committed
  1b4e82d
- Use EXTERNAL_TIMEOUT for the monitor release lookup
  
  TheJakeBraun
  and
  claude
  committed
  98f5832
- Pin workflow actions to commit SHAs
  
  TheJakeBraun
  and
  claude
  committed
  c44af42
- Bump PROJECT_VERSION to 1.10.2 and document hardening in AGENT.md
  
  TheJakeBraun
  and
  claude
  committed
  0e06289