rustunnel v0.8.5

Security

• Constant-time admin_token comparison + failed-auth throttle (CWE-208). The server-wide admin token was compared with plain string equality on the dashboard API and the control-plane Auth handshake, an observable timing discrepancy on two network-reachable entry points with no throttling on failed attempts. Both now use a constant-time comparison, and failed attempts are throttled per source IP (new auth.max_failed_auth_per_minute, default 10, 0 disables). DB-issued tokens were never affected. #102

  Reported privately by Abdurazzoqov Javohir via manual source review. Thank you.

• New SECURITY.md with a private reporting channel.

What's Changed

• docs: /init refresh — document plain_http_mode, add AGENTS.md source-of-truth pointer by @joaoh82 in #99
• fix(server): constant-time admin_token comparison + failed-auth throttle (CWE-208) by @joaoh82 in #102
• Fix broken Smithery badge (returns HTTP 500) by @skillselion in #101
• chore: bump version to 0.8.5 by @joaoh82 in #103 (v0.8.4 binaries reported 0.8.3; manifests now match the tag)

New Contributors

• @skillselion made their first contribution in #101

Full Changelog: v0.8.4...v0.8.5