Skip to content

v0.2.1 — Security Hardening & Skill Restructuring

Choose a tag to compare

View all tags
@serithemage serithemage released this 14 Mar 22:53
· 12 commits to main since this release
v0.2.1
4a0b081

Security Fixes

  • Timing-safe token comparison: Bearer token (Bridge) and Telegram webhook secret now use timingSafeEqual to prevent timing side-channel attacks
  • S3 path traversal prevention: sessionId and userId validated against ^[a-zA-Z0-9_:-]{1,128}$ before S3 key construction
  • Gateway Lambda log retention: All 7 Lambda functions now have ONE_WEEK log retention (previously unbounded)
  • ECR lifecycle policy: Lambda agent ECR repository limited to 5 images (prevents unbounded storage cost)

Skills (13 total)

5 new skills + 1 release skill + 5 updated:

  • /dev — Build, test, lint, coding conventions
  • /troubleshoot — Common CDK/Docker/Lambda/OpenClaw issues
  • /openclaw — OpenClaw internals reference
  • /cold-start — Cold start optimization history
  • /status — Project progress and deployment info
  • /release — 6 parallel review lanes before release

Documentation

  • 22 issues fixed from comprehensive review (CRITICAL to LOW)
  • All Korean text translated to English
  • Architecture diagrams updated for 9 CDK stacks
  • Migration journey documented from Claude Code work logs

Release Review

6 parallel review lanes executed: Code (APPROVE), Docs (fixed), Tests (APPROVE), Security (HIGH issues fixed), Cost (HIGH issues fixed), Operations (HIGH issue fixed).

268 tests (233 UT + 35 E2E) all passing.

🤖 Generated with Claude Code

Assets 2
Loading