All pull requests

Pull requests

• fix(security): reject untrusted Host on the /api proxy (DNS-rebinding CSRF)

  #103·nithiink opened Oct 14, 2026Owner·

  ·
  1

• fix(security): pin Host header & scope origin regex to token mode

  #101·nithiink opened Oct 12, 2026Owner·

  ·
  1

• fix(security): route WebFetch/WebSearch through the voice permission gate

  #99·nithiink opened Oct 11, 2026Owner·

  ·
  1

• fix(security): close CSRF/drive-by gaps in default localhost mode

  #97·nithiink opened Oct 10, 2026Owner·

  ·
  1

• fix(security): pin Host header at the /api/* proxy to close DNS rebinding (#94)

  #95·nithiink opened Oct 9, 2026Owner·

  ·
  1

• fix(security): add backend Host-header allowlist (DNS-rebinding defense)

  #93·nithiink opened Oct 8, 2026Owner·

  ·

• fix(security): close default-mode CSRF/CSWSH/DNS-rebind RCE paths + token/TLS hygiene

  #91·nithiink opened Oct 7, 2026Owner·

  ·
  1

• fix(security): restrict Origin allowlist to exact frontend origins in tokenless loopback mode

  #89·nithiink opened Oct 6, 2026Owner·

  ·
  1

• fix(security): close CSRF / DNS-rebinding / prompt-injection paths to the command backend

  #87·nithiink opened Oct 4, 2026Owner·

  ·
  1

• fix(security): close tokenless cross-origin paths to the command-executing backend

  #85·nithiink opened Oct 3, 2026Owner·

  ·
  1

• fix(security): defeat DNS rebinding by pinning request Host to local addresses

  #83·nithiink opened Oct 2, 2026Owner·

  ·
  1

• fix(security): block DNS-rebinding CSRF at the proxy with an absolute Host allowlist

  #81·nithiink opened Sep 30, 2026Owner·

  ·
  1

• fix(security): don't trust arbitrary localhost/LAN origins in tokenless mode

  #79·nithiink opened Sep 29, 2026Owner·

  ·
  1

• fix(security): close CSRF/SSRF gaps in tokenless mode (daily review 2026-09-28)

  #77·nithiink opened Sep 28, 2026Owner·

  ·
  1

• fix(security): block DNS rebinding on /api proxy via Host allowlist

  #75·nithiink opened Sep 27, 2026Owner·

  ·
  1

• fix(security): strict Origin allowlist for in-app auth in tokenless mode

  #73·nithiink opened Sep 26, 2026Owner·

  ·
  1

• fix(security): scope Origin allowlist to exact frontend in tokenless mode; redact auth token from access logs

  #71·nithiink opened Sep 25, 2026Owner·

  ·
  1

• fix(security): pin HTTP Host header to defeat DNS rebinding

  #69·nithiink opened Sep 24, 2026Owner·

  ·
  1

• fix(security): scope broad LAN Origin allowlist to token mode

  #67·nithiink opened Sep 23, 2026Owner·

  ·
  1

• fix(security): add Host allowlist to /api proxy to block DNS-rebinding CSRF

  #65·nithiink opened Sep 22, 2026Owner·

  ·
  1

• fix(security): restrict Origin auth-gate to exact frontend origins in tokenless mode

  #63·nithiink opened Sep 21, 2026Owner·

  ·
  1

• fix(security): gate broad LAN/any-port Origin regex on token (tokenless loopback CSRF/drive-by)

  #61·nithiink opened Sep 19, 2026Owner·

  ·
  1

• fix(security): clickjacking headers, prompt-injection authority, WebFetch egress gate

  #59·nithiink opened Sep 18, 2026Owner·

  ·
  1

• Feat/yuri phase 7

  #57·techbot11 opened Sep 5, 2026·

  ·

• fix(security): validate Host header to defeat DNS rebinding (daily review 2026-07-31)

  #56·nithiink opened Jul 31, 2026Owner·

  ·
  1