Skip to content

v0.7.0 — Security hardening & first-run honesty

Choose a tag to compare

View all tags
@fabriziosalmi fabriziosalmi released this 29 Jun 10:31
v0.7.0
d9a2a58
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

Security hardening, first-run honesty, and a documentation/site overhaul. Minor bump (0.6.2 → 0.7.0): some changes affect existing deployments — see Security and Changed.

⚠️ Upgrade notes

  • GATEWAY_INTERNAL_SECRET is now mandatory. Backend services fail closed (HTTP 503) if it's unset, instead of trusting X-Wildbox-* headers. Set it in .env.
  • Backend ports now bind to 127.0.0.1. Only the gateway (80/443/8080) is published; reach services via the gateway or an SSH tunnel.
  • AI config moved to ANTHROPIC_*. OPENAI_API_KEY/Stripe were removed from the env templates.

Security

  • Gateway auth fails closed when GATEWAY_INTERNAL_SECRET is unset, across the shared dependency, the per-service auth.py wrappers, and the Guardian middleware (#163).
  • Backend service ports bound to 127.0.0.1; only the gateway is public (#164).
  • SSRF guard extended to file_url/app_url/download_url (#165).

Added

  • Dashboard error.tsx, not-found.tsx, and a top-level global-error.tsx boundary (#166).
  • make generate-secrets / make validate-secrets targets (#170).

Fixed

  • CSPM reports unimplemented checks as NOT_IMPLEMENTED (never PASSED); compliance score counts only checks that ran (#158).
  • Data/Guardian/Responder DATABASE_URL falls back to the shared value so the stack no longer crashes on boot (#170).

Changed

  • Standardized AI analysis on ANTHROPIC_*; removed leftover OpenAI/Stripe config (#169).
  • Hid unbacked dashboard header chrome (fake notification badge, always-green status pill, dead search) until data-driven (#168).

Removed

  • Dead dashboard nav links + mockRuns fallback, replaced with real empty/error states (#167).
  • Committed status-report doc churn (#160).

Documentation

  • Redesigned the GitHub Pages site (de-slop, fixed markup/logo, honest copy) (#210).
  • Documentation Quality CI fully green for the first time — Markdown Linting, Spell Check, Link Validation (#211).
  • Reconciled README/SETUP_GUIDE/quickstart to one source of truth — INITIAL_ADMIN_*, /auth/jwt/login, real Compose service names (#171).

Full changelog: v0.6.2...v0.7.0

Assets 2
Loading