fix: security wave 1 — 14 fixes for audit #783 (v0.15.7.0)#810

Merged

garrytan merged 16 commits intomainfrom

garrytan/security-wave-1

Apr 5, 2026

Commits on Apr 5, 2026

fix: DNS rebinding protection checks AAAA (IPv6) records too

committed
fix: validateOutputPath symlink bypass — resolve real path before safe-dir check

committed
fix: validate saved URLs before navigation in restoreState

committed
fix: telemetry-ingest uses anon key instead of service role key

committed
fix: killAgent() actually kills the sidebar claude subprocess

committed
fix(design): bind server to localhost and validate reload paths

committed
fix: add auth gate to /inspector/events SSE endpoint (C3)

garrytan
and
claude
committed
fix: sanitize design feedback with trust boundary markers (C4+H5)

garrytan
and
claude
committed
fix: harden file/directory permissions to owner-only (C5+H9+M9+M10)

garrytan
and
claude
committed
fix: TOCTOU race in setup symlink creation (C6)

garrytan
and
claude
committed
fix: remove CORS wildcard, restrict to localhost (H1)

garrytan
and
claude
committed
fix: make cookie picker auth mandatory (H2)

garrytan
and
claude
committed
fix: gate /health token on chrome-extension Origin header

garrytan
and
claude
committed
test: update server-auth test for chrome-extension Origin gating

garrytan
and
claude
committed
Merge remote-tracking branch 'origin/main' into garrytan/security-wave-1
garrytan
committed
chore: bump version and changelog (v0.15.7.0)

garrytan
and
claude
committed