Repository navigation

fix(security): outbound-fetch allow-list, scrape budget, AutoPilot input, auth/XML hardening - #19

Merged

fleizean merged 9 commits into

gsd/quick-261027-security-hardening

Oct 26, 2026

Merged

fix(security): outbound-fetch allow-list, scrape budget, AutoPilot input, auth/XML hardening#19
fleizean merged 9 commits into
developfrom
gsd/quick-261027-security-hardening

Commits on Oct 26, 2026
- feat(security): constrain external release-note fetches to a documentation host allow-list
  
  Enes Yağız
  and
  claude
  committed
  4a91930
- feat(security): route analyze's background scrape through the shared scrape budget
  
  Enes Yağız
  and
  claude
  committed
  9470f0f
- feat(security): fence AutoPilot release notes as untrusted data and reject shell-pipe code blocks
  
  Enes Yağız
  and
  claude
  committed
  73b4e45
- fix(auth): pin JWT validation to HS256
  
  Enes Yağız
  and
  claude
  committed
  a4cc77d
- fix(auth): unify JWT lifetime behind one 8h constant
  
  Enes Yağız
  and
  claude
  committed
  cc8c721
- fix(nuget): harden the two bare nuspec XML parses against XXE
  
  Enes Yağız
  and
  claude
  committed
  9994ddb
- fix(analysis): make the per-IP analysis cap atomic
  
  Enes Yağız
  and
  claude
  committed
  1771f4a
- fix(suggestions): clamp the suggestions limit to [1,50]
  
  Enes Yağız
  and
  claude
  committed
  4507336
- Merge branch 'develop' into gsd/quick-261027-security-hardening
  fleizean
  authored
  b4f517d