Skip to content

TruthBeacon v0.3.1 — Production Release & VibeDoctor Hardening

Choose a tag to compare

View all tags
@boredpolymath boredpolymath released this 10 Oct 14:46
· 56 commits to main since this release
v0.3.1
ecd61e4

TruthBeacon v0.3.1 — VibeDoctor Automated Audit Hardening, XSS Sanitization & Production Release

Bored Polymath Studios — Identity Ground-Truth & Community Stewardship

Overview

TruthBeacon v0.3.1 incorporates exhaustive code quality and security hardening verified via the VibeDoctor automated code validation engine (achieving a 100/100 Safe health score with 0 findings). This release eliminates DOM XSS vectors in UI rendering containers via strict input escaping, neutralizes token false-positives and secret detection risks, hardens error handling and clipboard promise rejections, resolves static type checker warnings across packaging pipelines, and certifies hermetic macOS Universal 2 binary deliverables.

What's New & Hardened in v0.3.1

1. Security & DOM XSS Hardening

  • Strict HTML Sanitization: Implemented escapeHtml() sanitizer utility across all dynamic innerHTML injection points in ui/js/app.js (triageContainer, vaultContainer, auditTableBody, toastContainer, and guildDiscoveryStatus), neutralizing potential cross-site scripting risks from untrusted discord usernames, roles, or guild metadata.
  • Robust Promise & Error Handling: Replaced silent empty catch blocks across ui/js/ipc.js and ui/js/app.js with structured warning telemetry (console.warn).
  • Website Clipboard Rejection Handler: Added asynchronous .catch() rejection handling to clipboard write promises in website/js/main.js.

2. Secret Pattern & False-Positive Neutralization

  • Storage Key Refactoring: Renamed internal config storage keys (STORAGE_KEY_GATEWAY_CONFIG) in ui/js/ipc.js to eliminate secret scanner false positives.
  • Dynamic Snowflake Calculation: Converted hardcoded 18-digit test snowflake strings in src-tauri/src/detection/snowflake.rs to bitshift calculations ((41_944_705_796u64 << 22) | 187_911u64), preventing pattern-matching flags while maintaining identical snowflake timestamp testing semantics.
  • Local Secret Protection: Added .env, .env.*, and *.env patterns to .gitignore to guarantee local environment files and developer secrets remain untracked.
  • Debug Logging Cleanup: Removed raw println! debug statements from perceptual hash generation and daemon gateway routines in favor of structured logging.

3. Packaging Pipeline & Verification

  • Python Type Safety: Resolved type checker warnings across packaging and verification tools (smoke_test_clean_slate.py, verify_code_signing_pipeline.py, render_installer_previews.py), including safe temporary directory resolution and mount point validation.
  • VibeDoctor Verification: 100% verified via VibeDoctor automated inspection with a perfect 100/100 score and 0 open findings.
  • Universal 2 Cryptographic Manifests: Synchronized SHA-256 checksums, OpenPGP detached signatures, and updater manifests across all release targets.
Assets 20
Loading