Skip to content

Repository navigation

v0.2.0

Choose a tag to compare

View all tags
@CGSeb CGSeb released this 10 Oct 10:10
· 102 commits to main since this release
v0.2.0
55d3f1d
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

Security hardening

Result of the security review (#111):

  • Learners can see and end their browser sessions, and see and disconnect the AI apps connected to their account (#182, #183).
  • MCP tokens are scoped per tool, with read and write permissions (#181).
  • The app runs as a least-privilege database role (#180).
  • The CSP no longer uses 'unsafe-inline'; scripts and styles are allowed by hash (#179).
  • Security headers, rate limits and request or import size limits on the web app, the MCP server and the OAuth endpoints (#162, #159).
  • The total size of saved progress is capped on every write (#177).
  • App names are marked as unverified on the consent page, and unused OAuth clients are purged (#178).
  • Sign-in redirects, no-sign-in mode and session settings are hardened (#154).
  • Docker images are pinned by digest, and dependencies, the image and the CI supply chain are hardened (#176, #165).
  • The infrastructure was reviewed and the backup script hardened (#153).
  • Tests check that learners reach only their own data and that it stays out of logs (#155).

Dashboard

  • New mobile top menu: the links open from a menu button on phones (#186).
  • On the courses page, the theme counters follow the search and the Recommended filter (#187).
Assets 2
Loading