Release Pulse v1.0.4 — Security Hardening, Rate Limiting & Biometric Gate · miftahganzz/Pulse

Pulse v1.0.4 (Build 104) — Comprehensive Security Hardening & Zero-Trust

This release brings enterprise-grade zero-trust security hardening across both the Linux Pulse Agent and the macOS Pulse App.

Brute-Force & Port Scanning Defense: Built-in sliding-window rate limiter blocks malicious IPs automatically for 15 minutes after 5 consecutive failed authentication or pairing attempts.
Pairing Session Lockout: 6-digit pairing sessions are immediately revoked and session files destroyed upon 5 invalid attempts, completely preventing PIN brute-forcing.
Cross-Site WebSocket Hijacking (CSWSH) Defense: Enforces strict origin checking on WebSocket handshakes to prevent browser-based session hijacking.
Security Headers & Strict File Permissions: Automatically serves HSTS, CSP (default-src 'none'), X-Frame-Options: DENY, and X-Content-Type-Options: nosniff.
Tamper-Resistant Action Audit Log: Every action execution (systemd service restarts, Docker container actions, system runbooks) is recorded in an append-only $PULSE_DIR/audit.log with timestamp, client identity, and execution status.
pulse doctor Security Audits: Audits file permissions on agent.json and key.pem to ensure strict 0600 permissions.

TOFU TLS Certificate Pinning: Implements Trust-On-First-Use (TOFU) SHA-256 certificate fingerprint pinning securely stored in macOS Keychain. Warns and halts connection if the remote TLS certificate changes or is intercepted.
Biometric Security Gate (Touch ID / Apple Watch): Destructive and high-impact operations (system reboots, container kill, service stops) can now require Touch ID / Apple Watch / Mac Password confirmation before execution.
Clipboard Token Auto-Clearing: Automatically purges copied bearer tokens and pairing codes from the macOS pasteboard after 60 seconds.
Dedicated Security Settings Tab: New Security preference tab to configure biometric protection, clipboard security, and certificate pinning policies.