Security hardening: SSRF, headers, Redis TLS, container lockdown#208

Merged

RafaelPo merged 17 commits intomainfrom

feat/security-hardening

Feb 24, 2026

Commits on Feb 24, 2026

Add transport-aware server instructions; security hardening

RafaelPo
and
claude
committed
Security hardening: shell injection, headers, Redis TLS, container lockdown

RafaelPo
and
claude
committed
Security hardening: SSRF TOCTOU, user isolation, token encryption, .dockerignore

RafaelPo
and
claude
committed
Fix Docker build, Redis healthcheck, and cookie prefix test

RafaelPo
and
claude
committed
Handle decrypt failure in upload token retrieval

RafaelPo
and
claude
committed
Fix cookie name mismatch, IPv4-mapped SSRF bypass, HKDF key derivation, healthcheck

RafaelPo
and
claude
committed
Reject uploads exceeding row limit instead of silently truncating

RafaelPo
and
claude
committed
Fail-closed task ownership checks on progress, results, and cancel

RafaelPo
and
claude
committed
Update integration tests for unified input API, revert manifest description

RafaelPo
and
claude
committed
Add two-step upload_data → artifact_id integration test

RafaelPo
and
claude
committed
Configurable trusted IP header, top-level auth imports, manifest fix

RafaelPo
and
claude
committed
Add integration tests for artifact reuse, URL upload, cancel, and error paths

RafaelPo
and
claude
committed
Set TRUSTED_IP_HEADER=CF-Connecting-IP in docker-compose

RafaelPo
and
claude
committed
Clarify redirect exception type, suppress Redis warning in no-auth mode

RafaelPo
and
claude
committed
Increase integration test polling timeout from 30 to 60

RafaelPo
and
claude
committed
Add docker-compose.local.yaml for local dev overrides

RafaelPo
and
claude
committed
Unwrap IPv4-mapped IPv6 in direct IP literal validation

RafaelPo
and
claude
committed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Security hardening: SSRF, headers, Redis TLS, container lockdown#208

Security hardening: SSRF, headers, Redis TLS, container lockdown#208
RafaelPo merged 17 commits intomainfrom
feat/security-hardening

Commits on Feb 24, 2026

Add transport-aware server instructions; security hardening

Security hardening: shell injection, headers, Redis TLS, container lockdown

Security hardening: SSRF TOCTOU, user isolation, token encryption, .dockerignore

Fix Docker build, Redis healthcheck, and cookie prefix test

Handle decrypt failure in upload token retrieval

Fix cookie name mismatch, IPv4-mapped SSRF bypass, HKDF key derivation, healthcheck

Reject uploads exceeding row limit instead of silently truncating

Fail-closed task ownership checks on progress, results, and cancel

Update integration tests for unified input API, revert manifest description

Add two-step upload_data → artifact_id integration test

Configurable trusted IP header, top-level auth imports, manifest fix

Add integration tests for artifact reuse, URL upload, cancel, and error paths

Set TRUSTED_IP_HEADER=CF-Connecting-IP in docker-compose

Clarify redirect exception type, suppress Redis warning in no-auth mode

Increase integration test polling timeout from 30 to 60

Add docker-compose.local.yaml for local dev overrides

Unwrap IPv4-mapped IPv6 in direct IP literal validation