Skip to content

Secure ENV 0.8.7

Latest
Latest

Choose a tag to compare

View all tags
@web3blind web3blind released this 08 Nov 03:04
v0.8.7
8874c96

Secure ENV 0.8.7

Retained exact-parent login, saved TOTP and protected payment filling now follow native Hermes Browser Vault origin, classifier and stamped-control selection behavior. CSS, geometry and presentation/history changes are not treated as additional security boundaries. Explicit layout semantics and asynchronous owner/profile, original-transport, human-lease, cancellation and expiry checks remain.

  • Preserve bounded frame/Shadow traversal through non-HTTPS intermediate documents without treating those documents as secret destinations.
  • Stop explicit payment traversal once the complete declared mapping has been found; unrelated later frames do not veto a complete layout.
  • Include complete test helpers, fixture licenses/provenance and runtime resources in the source distribution.

Installation and disclosures

Requires Hermes >=0.22.2. Catalog installation uses only secure_env_ingress/, never the administrative repository root. A repository release does not itself update the Hermes catalog.

The plugin runs in-process and uses internal Hermes Vault/browser/gateway/redaction/config APIs as well as the public captured-CDP and registration APIs. Internal dependencies can break on host updates. Runtime scan CAUTION findings cover approved privileged setup instructions, fixed-argv OpenSSL verification and payment Luhn digit reversal. No core function override or login backend is registered.

One-use links authorize their holder. The TLS listener binds all interfaces by default. Native encrypted card storage includes CVC. Site input callbacks can authorize or submit even without a plugin submit click. Verify unknown outcomes externally before retry. Explicit .env ingress adds approved missing keys; setup bootstrap directly reads selected-profile owner IDs. Allowlisted SHA-256-pinned operation consumers run unsandboxed with gateway privileges; none are enabled by default, and cancelling ingress cannot stop an already-running consumer.

Verification

  • 96 focused source tests passed.
  • 69 focused tests passed against the final installed wheel, plus 3 exact-pin installation/discovery/entrypoint checks.
  • Canonical current-upstream plugin admission validation: all 15 checks passed, with disclosed CAUTION/private-import and in-process warnings.
  • Wheel RECORD and all 39 runtime/resource hashes verified; runtime-only archive and isolated exact-pin installation match the candidate bytes.

These focused checks are not a full Hermes test suite, every-messenger certification or proof of universal site compatibility. No production installation or gateway restart is part of this release publication.

Assets 6
Loading