·
86 commits
to main
since this release
Security fixes
- SSRF protection: Metadata fetch only allowed from claude.ai domains
- Credential store: Node-RED passwords no longer embedded in tokens — stored server-side with TTL
- PKCE hardening: Code verifier length (43-128 chars) and charset validated per RFC 7636
- CORS allowlist: Default restricted to claude.ai only (no more wildcard)
- Session ownership: Sessions bound to authenticated userId
- Localhost in prod: Redirect URI localhost allowed only in non-production
- Debug logs removed: No credentials, tokens or auth data in logs
- code_challenge_method: Must be explicitly S256