Skip to content

v1.6.3 — Operator protected IP guard, AI model defaults, CF sync clarity

Choose a tag to compare

View all tags
@jmrGrav jmrGrav released this 13 Jun 04:52
· 95 commits to main since this release
v1.6.3
This tag was signed with the committer’s verified signature.
jmrGrav
GPG key ID: E34BC7955D46431A
Verified
Learn about vigilant mode.
c1bdac5
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

v1.6.3 — Security hardening and observability

Fixes

  • Operator-protected IP guard — global.protected_hosts YAML field and SECURITY_AUTOMATION_PROTECTED_HOSTS env var. IPs listed are suppressed before any AbuseIPDB report or Cloudflare propagation via the existing trust registry chokepoint. Includes unit tests and regression guard.

  • AI model safe defaults — When a provider is enabled but the model field is empty (e.g. after credential-store migration), normalizeAIConfig now applies safe defaults: gpt-4.1-mini / claude-sonnet-4-6 / gemini-1.5-pro.

  • CF ban sync page clarity — Dry-run mode now shows a DRY-RUN badge with instructions to enable mutations. Missing decisions source shows config guidance. Mode badge (MUTATIONS ON / DRY-RUN) shown alongside sync status when cycles exist.

Smoke tests

  • Replace Key form: CSRF token present, password field not pre-filled, POST without CSRF rejected with 403.

Deployment note

To activate the protected IP guard on the host, add to /etc/security-automation-go/security-automation.env:

SECURITY_AUTOMATION_PROTECTED_HOSTS=82.65.145.189

Then sudo dpkg -i security-automation-go_1.6.3_amd64.deb && sudo systemctl restart cf-sync.

Assets 3
Loading