Skip to content

v1.3.2

Choose a tag to compare

View all tags
@ultus-net ultus-net released this 23 Aug 07:32
· 394 commits to main since this release
v1.3.2
11a8d26
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

Patch Changes

  • Harden workspace boundary, secret-read, and operational safety:
    • Expand ~, ~user, $HOME, and fail closed on indeterminate $VARIABLE references in boundary targets
    • Support &>, &>>, >&, >>&, and attached redirects in shell mutation parsing while filtering fd duplication (2>&1, >&2)
    • Generic tee flag skipping (-a, --append, -ai, --) and multi-target boundary validation
    • Enforce external-repository confinement on GIT_DIR= and GIT_WORK_TREE= environment assignments
    • Scan inline interpreter payloads (python -c, node -e, bash -c, sh -c, zsh -c) for secret-file reads and out-of-workspace writes
    • Sanitize desktop notifications against AppleScript command injection on macOS
    • Redact multiline secret value continuations completely in .env schema masking
    • Bounded tail buffering in getRecentAuditEntries to prevent memory spikes on long-lived logs
    • Sanitize base reference inputs in guard_review_rubric
Assets 2
Loading