Repository navigation

Security, performance and dead-code audit - #4

Merged

beingsuz merged 13 commits into

mainfrom

claude/project-thread-5f1pob

Oct 9, 2026

Merged

Security, performance and dead-code audit#4
beingsuz merged 13 commits into
mainfrom
claude/project-thread-5f1pob

Commits on Sep 28, 2026
- Refuse depot writes through symlinks and bound chunk read-backs
  claude
  committed
  f24c3f3
- Bound chunk and manifest decompression by the declared size
  claude
  committed
  5b170f2
- Bound CM, directory and HTTP reads and reuse one TLS config
  claude
  committed
  6e22290
- Cap the unsolicited CM frames a session holds
  claude
  committed
  8286a96
- Keep the token file line format intact and zeroize what was read
  claude
  committed
  9e561f7
- Stop GMA extraction failing for addons past 64 MiB
  claude
  committed
  812a58b
- Drop dead code and history-style comments
  claude
  committed
  99e4b03
Commits on Oct 9, 2026
- Give up on a CM request Steam never answers
  claude
  committed
  efcaba6
- Bound the chunk-size line and drop chunks once copied
  claude
  committed
  3d6735a
- Inflate zip entries a piece at a time
  claude
  committed
  05c211e
- Fetch old Workshop links over TLS and refuse http:// outright
  claude
  committed
  1fa849b
- Check what a legacy item and a manifest claim to be
  claude
  committed
  73e3aeb
- Size-check stored gma entries and drop half-written files
  claude
  committed
  397295e