Skip to content

Naragate v0.6.2 — Optional API key at login + security hardening

Choose a tag to compare

View all tags
@masdevid masdevid released this 15 Sep 11:12
· 19 commits to master since this release
v0.6.2
42d471e

Optional API key at login + input/security hardening

Login

  • The login page has an optional "Sectors API Key" field with a helper:
    optional — you can add or change this later in Settings. Provide it to bind
    immediately, or skip it and set it later.
  • The IP-bound wording is gone from the login copy (and the leftover IP i18n
    strings were removed).

Security

  • Narrative input hardened end to end: control characters stripped and
    length capped on the client, and max_length enforced by the API
    (an 8 kB narrative now returns 422).
  • Bulk analysis also redirects to /login when there is no session
    (single-analysis already did).
  • Security headers on the frontend: Content-Security-Policy,
    X-Content-Type-Options, X-Frame-Options, Referrer-Policy,
    Permissions-Policy. (CSP keeps 'unsafe-inline' for the Angular-inlined
    CSS; the app has no innerHTML sinks, so template escaping stays the
    primary XSS defense.)

Backend 406 tests, frontend production build clean.

Assets 2
Loading