Garry Tan c151fabfca fix(security): IPv6 ULA blocking, cookie redaction, per-tab cancel, targeted token (#664) ...

Community PR #664 by @mr-k-man (security audit round 1, new parts only).

- IPv6 ULA prefix blocking (fc00::/7) in url-validation.ts with false-positive
  guard for hostnames like fd.example.com
- Cookie value redaction for tokens, API keys, JWTs in browse cookies command
- Per-tab cancel files in killAgent() replacing broken global kill-signal
- design/serve.ts: realpathSync upgrade prevents symlink bypass in /api/reload
- extension: targeted getToken handler replaces token-in-health-broadcast
- Supabase migration 003: column-level GRANT restricts anon UPDATE scope
- Telemetry sync: upsert error logging
- 10 new tests for IPv6, cookie redaction, DNS rebinding, path traversal

Co-Authored-By: mr-k-man <mr-k-man@users.noreply.github.com>
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

2026-04-05 22:58:06 -07:00

..

functions

fix: security wave 1 — 14 fixes for audit #783 (v0.15.7.0) (#810)

2026-04-04 22:12:04 -07:00

migrations

fix(security): IPv6 ULA blocking, cookie redaction, per-tab cancel, targeted token (#664)

2026-04-05 22:58:06 -07:00

config.sh

fix: Supabase telemetry security lockdown (v0.11.16.0) (#460)

2026-03-24 15:01:31 -07:00

verify-rls.sh

fix: verify-rls.sh matches deployed policy (inserts allowed, HTTP parsing) (#461)

2026-03-24 15:10:50 -07:00