 Latte
|
766968fa42
|
ci: pin actions to commit SHAs, guard Docker jobs from forks, scan the image, gate publish on security (SEC-06, SEC-07, SEC-14, SEC-15, SEC-16)
|
2026-10-14 17:40:16 +02:00 |
|
|
Latte
|
6f7a3c0e5b
|
fix: refuse a token store directory owned by another user or left writable (SEC-13)
|
2026-10-14 17:36:21 +02:00 |
|
|
Latte
|
d96c3ac604
|
fix: reject whitespace and control characters in base URLs and warn on plain http Gitea (SEC-10)
|
2026-10-14 17:34:15 +02:00 |
|
|
Latte
|
87f048cc4d
|
fix: quota pending sign-ins and registrations per address, keep young clients, write the store off the loop (SEC-09)
|
2026-10-14 17:32:03 +02:00 |
|
|
Latte
|
f57c237bed
|
fix: rate limit /token and /revoke, bucket IPv6 by /64 and warn about untrusted forwarded headers (SEC-08)
|
2026-10-14 17:29:12 +02:00 |
|
|
Latte
|
782d416e46
|
fix: require a matching Origin on consent and name the binding cookie per flow (SEC-17, SEC-19)
|
2026-10-14 17:26:52 +02:00 |
|
|
Latte
|
8be859243d
|
fix: add OAUTH_REDIRECT_ALLOWLIST for client registration and waive the open default (SEC-05)
|
2026-10-14 17:24:41 +02:00 |
|
|
Latte
|
79aa4f7fc0
|
fix: load ./.env only when private and owned, add --env-file and AEGIS_ENV_FILE (SEC-04)
|
2026-10-14 17:22:29 +02:00 |
|
|
Latte
|
7307214ab6
|
fix: create the audit log 0600 in a 0700 directory and refuse symlinks (SEC-11)
|
2026-10-14 17:18:29 +02:00 |
|
|
Latte
|
fd5e4b71f3
|
fix: record the calling client and only schema-known names in audit entries (SEC-12, SEC-18)
|
2026-10-14 17:14:13 +02:00 |
|
|
Latte
|
43eebd3089
|
fix: write-ahead audit entry so calls stop when the audit log stops accepting writes (SEC-03)
|
2026-10-14 17:11:53 +02:00 |
|
|
Latte
|
5b622e64e2
|
fix: redact stored webhook authorization headers and other secret fields by key name (SEC-02)
|
2026-10-14 17:08:59 +02:00 |
|
|
Latte
|
d5ca530db3
|
fix: cap and type-check the unauthenticated consent POST body (SEC-01)
|
2026-10-14 17:07:06 +02:00 |
|