fix(hermes): enforce env secret boundary on sandbox recover - #4959

Merged

cv merged 7 commits into

mainfrom

fix/4957-hermes-recover-secret-boundary

Jun 8, 2026

Commits on Jun 8, 2026

fix(hermes): enforce env secret boundary on sandbox recover
laitingsheng
committed
4658805
fix(hermes): fail closed and kill running gateway on recover boundary violation
laitingsheng
committed
d270573
fix(hermes): surface validator [SECURITY] lines and reject symlinked .env on recover
laitingsheng
committed
bc7d372
refactor(hermes): extract recovery boundary helpers, close TOCTOU, expand tests
laitingsheng
committed
288f540
Potential fix for pull request finding 'CodeQL / Empty except'

cv
and
github-advanced-security[bot]
authored
07517a9
refactor(hermes): split recovery boundary tests, delegate non-regular .env to validator
laitingsheng
committed
3e1dbd9
test(hermes): cover recovery health refusal
cv
committed
e6a7975