gstack

mirror of https://github.com/garrytan/gstack.git synced 2026-05-05 13:15:24 +02:00

Files

T

Garry Tan d81229f9f2 fix(security): redact form fields with sensitive names, not just type=password

Form redaction only applied to type="password" fields. Hidden and text
fields named csrf_token, api_key, session_id, etc. were exposed unredacted
in LLM context, leaking secrets.

Extend redaction to check field name and id against sensitive patterns:
token, secret, key, password, credential, auth, jwt, session, csrf, sid,
api_key. Uses the same pattern style as SENSITIVE_COOKIE_NAME.

Closes #860

Co-Authored-By: Gus <garagon@users.noreply.github.com>

2026-04-13 09:34:13 -07:00

bin

feat: multi-agent support — gstack works on Codex, Gemini CLI, and Cursor (v0.9.0) (#226 )

2026-03-19 18:20:50 -07:00

scripts

fix: Windows support — Node.js server fallback for Playwright (#255 )

2026-03-20 12:22:11 -07:00

src

fix(security): redact form fields with sensitive names, not just type=password

2026-04-13 09:34:13 -07:00

test

fix(security): cookie-import path validation bypass + hardcoded /tmp