Harden gateway: insecure-mode guard, cross-sandbox credential theft fix#5

Merged

persimmon16 merged 3 commits intofeat/apple-containerfrom

security/gateway-auth

Apr 1, 2026

Commits on Apr 1, 2026

Require OPENSHELL_ALLOW_INSECURE=1 to confirm --disable-tls
persimmon16
committed
Verify sandbox identity on GetSandboxProviderEnvironment calls
persimmon16
committed
Require x-sandbox-id header; reject requests without it
persimmon16
committed