Skip to content

v1.2 — Security Hardening & Code Quality

Choose a tag to compare

View all tags
@Tenstu Tenstu released this 19 Jun 07:28
· 18 commits to main since this release
v1.2
b772365

v1.2 — Security Hardening & Code Quality

Security Fixes

  • API key leak fix: Embedding provider abstraction now supports env-var configuration for both local and API-based providers, eliminating hardcoded credentials
  • Path traversal guards: Added path validation in server.py and question_bank.py to prevent directory traversal attacks
  • Profile schema whitelist: update_user_profile now validates against an allowlist of permitted fields
  • vector_store.rebuild(): Now emits an explicit warning before silently clearing the vector store index

Changelog

4 cherry-picked commits from dev branch, addressing Copilot review findings and proactive security hardening.

Assets 2
Loading