Skip to content

loobric-server 0.6.1 — security assumptions ledger

Choose a tag to compare

View all tags
@sliptonic sliptonic released this 27 Jul 19:51
· 26 commits to master since this release
v0.6.1
90f9763

Added

  • docs/SECURITY_ASSUMPTIONS.md — every security assumption mapped to the test that proves it, with the standing rule: a new assumption lands with its row and its test in the same commit. Includes the ranked not-yet-covered list (rate limiting doesn't exist; CSRF untested) and the post-mortem of how unenforced scopes shipped.
  • Missing security tests closed: bind door, negative sync, admin door, and first-ever cross-account isolation tests over HTTP (session + fully-scoped key, all five entities). All passed on first run — correct but previously unproven.

Deploy note: this includes 0.6.0's BREAKING scope enforcement — existing API keys become read-only until rotated (loobric create-key --preset agent|controller|cam|full).

Assets 2
Loading