fix: remediate 9 security findings from external audit (OS-15 through OS-23) - #744

Merged

johntmyers merged 10 commits into

mainfrom

fix/security-audit-batch-1

Apr 3, 2026

Commits on Apr 2, 2026

fix(install): restrict tar extraction to expected binary member
johntmyers
committed
721f4bd
fix(deploy): quote registry credentials in YAML heredocs
johntmyers
committed
b8307dc
fix(server): redact session token in SSH tunnel rate-limit log
johntmyers
committed
77541a1
fix(server): escape gateway_display in auth connect page
johntmyers
committed
2164677
fix(server): prevent XSS via code param with validation and proper JS escaping
johntmyers
committed
3c0d7e8
fix(sandbox): add byte cap and idle timeout to streaming inference relay
johntmyers
committed
1a96113
fix(policy): narrow port field from u32 to u16 to reject invalid values
johntmyers
committed
f95590f
fix(deps): migrate from archived serde_yaml to serde_yml
johntmyers
committed
71329fb
fix(server): re-validate sandbox-submitted security_notes and cap hit_count
johntmyers
committed
04825ee
chore: apply cargo fmt and update Cargo.lock for serde_yml
johntmyers
committed
938a2b2