Skip to content

MirvMon v0.6.6

Choose a tag to compare

View all tags
@github-actions github-actions released this 05 Sep 11:13
· 3 commits to master since this release
v0.6.6
1f616ab

MirvMon v0.6.6

Security-contract release for centralized website monitoring.

  • Website targets are explicitly trusted administrator input. Internal DNS, loopback, private and link-local HTTP(S) targets remain supported so MirvMon can monitor services reachable from its own app container.
  • MirvMon no longer documents website monitoring as an SSRF/tenant-isolation boundary that blocks private networks; only administrators can create or modify website checks.
  • The actual egress protections are documented consistently: HTTP(S)-only URLs, URL credentials rejected, ambient proxy disabled, bounded redirects/deadlines/body reads, and auth/sensitive-header stripping across unapproved origins.
  • Response bodies and configured secrets remain absent from monitoring history, diagnostics and rendered HTML.
  • CI now checks this security-model wording together with the existing release-version contract.

For Docker/Portainer use ghcr.io/mirivlad/mirvmon:0.6.6 and perform the normal re-pull/redeploy.

Assets 2
Loading