Skip to content

v0.13.0

Choose a tag to compare

View all tags
@github-actions github-actions released this 18 Jun 04:41
· 41 commits to main since this release
v0.13.0
4f9f2f6 
v0.13.0 - security hardening

Red-team pass of the launch surface (findings confirmed with PoCs):
- web: reject non-loopback Host (DNS rebinding) and cross-origin Origin
- resume: never auto-launch Codex/Gemini into a session-claimed directory
  (a planted session could load an attacker's AGENTS.md); print the command
- resolve: escape LIKE wildcards so a web id of '%' can't dump a session
- install.sh: honest about checksum scope (corruption, not malicious release)
Assets 10
Loading