staging <- dev#125

Merged

ducnmm merged 59 commits into

Apr 30, 2026

Commits on Apr 10, 2026

feat: enable SEAL key-server verification across all SealClient instances (ENG-1422)
ducnmm
committed

Commits on Apr 13, 2026

feat(security): implement MEM-23 Phase 5 Informational best practices
ducnmm
committed

Commits on Apr 14, 2026

clean(mem-23): remove out-of-scope changes; restore MEM-11 CORS/auth, re-apply INFO-6/LOW-12/LOW-16/LOW-17
ducnmm
committed
fix(sec): add body-size limits on unauthenticated public endpoints
hien-p
committed
fix(sec): HIGH-12 — block open redirect on guest sign-in redirectUrl
hien-p
committed
chore: remove accidentally committed local review files
ducnmm
committed
Merge pull request #105 from MystenLabs/sec/body-size-limits
ducnmm
authored
Merge pull request #94 from MystenLabs/feature/mem-23-sec-phase-5-informational
harrymove-ctrl
authored
Merge pull request #106 from MystenLabs/sec/open-redirect-fix
ducnmm
authored
Merge pull request #87 from MystenLabs/enhance/eng-1421-analyze-hardening
harrymove-ctrl
authored
fix(security): MEM-17 cap recall limit and bound restore concurrency (MED-3, MED-6, MED-13)

ducnmm
authored and
hien-p
committed
Merge pull request #96 from MystenLabs/feature/mem-17-sec-harden-concurrency-resource-bounds
harrymove-ctrl
authored
feat(sec): fix MEM-7 by replacing private_key with key_index over the wire

ducnmm
authored and
hien-p
committed
Merge pull request #100 from MystenLabs/feature/mem-7-sec-server-wallet-private-keys-transmitted-per-request-to
harrymove-ctrl
authored
fix(security): MEM-16 replay protection and block deactivated accounts (MED-1, MED-2)

ducnmm
authored and
hien-p
committed
Merge pull request #95 from MystenLabs/feature/mem-16-sec-replay-protection-block-deactivated
harrymove-ctrl
authored
fix(security): MEM-18 rate limiter fail-closed on Redis error (MED-19, MED-20, MED-21)

ducnmm
authored and
hien-p
committed
fix(sec): use pg_advisory_xact_lock in transaction for quota check
ducnmm
committed
Merge pull request #97 from MystenLabs/feature/mem-18-sec-rate-limiting-hardening
harrymove-ctrl
authored
Merge pull request #90 from MystenLabs/sec/eng-1422-seal-verify-key-servers
harrymove-ctrl
authored
fix(sec): MEM-HIGH-4 phase 01+02 — rate limiting, input
hien-p
committed
fix: restore HTTP client timeout and background cache eviction
ducnmm
committed
Merge pull request #104 from MystenLabs/sec/sponsor-rate-limiting
ducnmm
authored

Commits on Apr 15, 2026