Files
web/CHANGELOG.md
T
gamertan a18f1dd22a
verify / verify (push) Successful in 3m1s
security: harden first preview boundaries
Sanitized snapshot of private source 13a965dd6ea705dd92499f7dbeaa00c25c15247d. Require same-origin evidence for unsafe methods, fail closed on invalid authentication middleware configuration, and bound untrusted request metadata.

AI-Assistance: OpenAI Codex assisted implementation, testing, and security review.
Signed-off-by: Cole Speelman <crspeelman@gmail.com>
2026-08-16 19:20:14 -04:00

673 B

Changelog

v0.1.0-preview.1 — 2026-08-16

  • Establish independent request metadata, logging, browser security, abuse, authentication, SQLite, and analytics package boundaries.
  • Add a minimal 0BSD net/http starter.
  • Fail closed when unsafe requests lack same-origin evidence or authentication middleware is constructed with invalid cookie/service configuration.
  • Bound untrusted request-record byte and duration fields before aggregation.
  • Support Linux as the maintained release platform; native Windows is not a release gate or compatibility promise.

No compatibility promise is made before a stable release.