Skip to content

v0.4.0 — security hardening pass 2

Choose a tag to compare

View all tags
@fif7y fif7y released this 28 Aug 18:51
· 15 commits to main since this release
v0.4.0
de82364

Security hardening pass 2.

Install setup-token gate (only someone with file-system access can claim the admin account on a fresh public instance), Content-Security-Policy on the dashboard, MCP connector token expiry, OAuth state bound to the browser, visitor-id HMAC, and a zip-slip guard on the self-updater. Completes the security audit (builds on v0.3.9's ingest/headers/checksum hardening).

Assets 5
Loading