v0.3.3 — Security Hardening

v0.3.3 — Security Hardening

v0.3.3 hardens the deployment, provider, public API, browser rendering, export,
analytics, streaming, and OCR boundaries identified by an OpenAI Codex Security
review of v0.3.2. It does not change the chat SSE event contract, SQLite as the
system of record, or the no-model-key local fallback.

Security outcome

• Docker Compose requires explicit JWT/admin secrets and binds application
  ports to loopback. Seeding transactionally synchronizes the single
  environment-managed administrator, including username/password changes and
  cleanup of stale privileged rows from earlier starts.
• Model API Base URLs are deployment-owned and read-only to admins. Credentials
  are shared between chat and embedding clients only for the same normalized
  endpoint.
• Chat, login, admin, and public FAQ search limits use IPv6-aware subnet keys.
  Semantic FAQ search also has a separate concurrency limit, bounded input,
  bounded result count, and a public DTO without embedding or operator fields.
• CSV exports neutralize spreadsheet formulas. Markdown rendering drops images
  so untrusted answers cannot trigger third-party browser requests.
• LLM streams have a UTF-8 byte cap and a single application buffer. Dashboard
  overview metrics aggregate directly in SQLite instead of expanding a session
  ID into one bind parameter per row.
• The OCR worker requires a bearer token, compares it in constant time, limits
  PDF pages and image pixels/dimensions, permits one in-flight extraction, and
  bounds processing time and provider/final result sizes. A native inference
  timeout forces worker-process exit; the supported Compose profile restarts
  it with clean state.
• The unused vulnerable xlsx package was removed. bcrypt, uuid, and
  express-rate-limit were upgraded; React Router was upgraded to the newest
  release that fixes the SPA-reachable redirect issues.

Compatibility and limits

• Admins can still change provider and model names, but must change API Base
  URLs through deployment configuration.
• Compose must now be given JWT_SECRET and ADMIN_PASSWORD; the OCR profile
  additionally requires OCR_SERVICE_TOKEN.
• Public FAQ list responses intentionally omit operational timestamps,
  embedding metadata, activation state, and updater identity.
• The remaining npm advisory affects React Router RSC/server-action mode. This
  project is a Vite BrowserRouter SPA and does not use React Router RSC,
  actions, loaders, SSR, or server hydration; see the evidence file.

See v0.3.3 implementation evidence for verification and
the residual-risk record.

---

中文说明

v0.3.3 针对 v0.3.2 的 OpenAI Codex Security 审查结果，收紧部署 Secret、
模型端点与凭据边界、公共 FAQ 资源上限、CSV/Markdown 输出、流式回答、统计
查询和 OCR Worker。聊天 SSE 事件、SQLite 权威数据源以及无模型 Key 的本地
回退路径保持兼容。

Compose 现在必须显式提供 JWT 与管理员密码，应用端口默认只绑定本机；模型
API Base URL 只能通过部署环境修改；IPv6 限流按子网归一，公共语义检索另有
并发上限；公开 FAQ 不再泄漏 embedding、更新时间或操作人；CSV 会中和公式，
Markdown 不加载外链图片；LLM 流和 OCR 输入、执行与输出均增加硬上限。

OCR profile 现在必须提供 OCR_SERVICE_TOKEN。剩余 npm 告警只涉及本项目未
使用的 React Router RSC/server-action 模式，具体可达性判断见验证证据。
管理员环境用户名或密码变更会同步到唯一管理员并清理遗留账号；OCR 原生推理
超时后会强制退出 Worker 进程，由 Compose 监督重启，避免单槽永久占用。