sec: hardening sweep — webhook sigs, SSRF, nix injection, secret-proxy, token revocation, egress timeout, sandbox, encryption-key#692

Merged

buremba merged 9 commits into

mainfrom

sec/hardening-sweep

May 13, 2026

Commits on May 13, 2026

fix(sandbox): re-enforce SDK manifest, org-slug guard, and allowCrossOrg on __sdk_dispatch host side (#680)
buremba
authored
test(connections): pin webhook signature verification contract (#678)
buremba
authored
fix(egress-judge): hard per-call timeout that fails closed and feeds the breaker (#677)
buremba
authored
fix(orchestrator): block Nix-expression injection in nix-shell -p (#682)
buremba
authored
fix(proxy): harden worker egress proxy against SSRF via IPv6 normalization (#681)
buremba
authored
feat(auth): jti-based token revocation kill switch (WS5) (#683)
buremba
authored
fix(secret-proxy): 24h orphan TTL + per-source failed-resolution throttle (#679)
buremba
authored
fix(core): harden ENCRYPTION_KEY parsing and make worker-token clock skew configurable (#676)
buremba
authored
Merge branch 'main' into sec/hardening-sweep
buremba
committed