fix: harden Omarseafile for marketplace security review - #1

Merged

Roddygithub merged 24 commits into

mainfrom

security/marketplace-review

Sep 16, 2026

Commits on Sep 2, 2026

fix: complete security remediation for marketplace review
Roddygithub
committed
147ae59
fix: security review corrections for marketplace #4145
Roddygithub
committed
218363d
fix: restore QML module loading after security remediation broke plugin
Roddygithub
committed
7dc3db9

Commits on Sep 3, 2026

fix: complete marketplace security transport remediation
Roddygithub
committed
99567b5
fix: validate runtime ownership and mode numerically
Roddygithub
committed
60c6878
fix: harden transfer output and process lifecycle
Roddygithub
committed
d659ca0
fix: clear reaped transfer child state
Roddygithub
committed
87edb37
fix: bound API responses and scope transfer authentication
Roddygithub
committed
37fdebc
fix: close API validation bypasses
Roddygithub
committed
3ca030e
docs: add AI operating contract
Roddygithub
committed
402876d
fix: repair secure transfer helper lifecycle
Roddygithub
committed
9b97884

Commits on Sep 4, 2026

fix: bound helper process output and lifecycle
Roddygithub
committed
69bf4f9
fix: isolate helper child process groups
Roddygithub
committed
361edba
fix: bound untrusted QML display text
Roddygithub
committed
99db8a3
fix: require HTTPS for authenticated servers
Roddygithub
committed
fc8cd87
test: derive Finding 2 credential guard coverage
Roddygithub
committed
1b564c6
fix: harden secret temporary file creation
Roddygithub
committed
f13d6e8
test: strengthen secret temporary file security proof
Roddygithub
committed
2f16076

Commits on Sep 5, 2026

fix: harden transfer paths and disk safety
Roddygithub
committed
b714425
fix: fail closed on transfer disk checks
Roddygithub
committed
eae80ee

Commits on Sep 8, 2026

fix: harden Omarseafile for marketplace security review
Roddygithub
committed
3873cd8
fix: close remaining marketplace race conditions
Roddygithub
committed
59303e8
fix: close atomic secret handoff race
Roddygithub
committed
08c4bb0

Commits on Sep 14, 2026

fix: Clear button overflow, Open Local lifecycle proofs
Roddygithub
committed
ff55f31