Skip to content

Forge v1.0.4

Choose a tag to compare

View all tags
@Docteur-Parfait Docteur-Parfait released this 17 Sep 18:06
v1.0.4
ee17276
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

Security

  • Close Playwright popup SSRF by installing context-wide network interception and fulfilling requests through IP-pinned HTTP with preserved SNI.
  • Require an expiring tenant-specific TXT ownership challenge before promoting custom domains or requesting ACM.
  • Centralize paid RODI generation authorization and rate-limit on-demand security reviews.
  • Frame vision/charter image content as untrusted third-party data.
  • Validate OAuth return paths after WHATWG URL normalization.

Credits

  • BOUE Hodabalo Raphaël (@BOUEHodabaloRaphael) — popup SSRF, custom-domain takeover
  • Aliou Cisse (@KevineCharles) — open redirect, security-review gate, vision prompt injection

Contributors

BOUEHodabaloRaphael and KevineCharles
Assets 2
Loading