fix: resolve security hardening tickets #367

Merged

dries merged 8 commits from fix/security-tickets into main 2026-07-17 13:17:48 +02:00

Conversation 1 Commits 8 Files changed 42 +1059 -357

dries commented 2026-07-17 11:11:03 +02:00

Owner

Copy link

Summary

• require explicit TLS or trusted-overlay transport for remote administration
• update audited frontend dependencies
• add HTTP limits, security headers, and owner-only state permissions
• block cross-site privileged localhost and terminal access
• isolate child-session output as untrusted JSON data

Fixes #356
Fixes #357
Fixes #358
Fixes #359
Fixes #361
Fixes #362

Testing

• make test
• make lint
• make build
• pnpm audit --prod
• pnpm test -- --coverage

#360 was skipped and documented because its acceptance criteria change existing autoapproval functionality.

## Summary - require explicit TLS or trusted-overlay transport for remote administration - update audited frontend dependencies - add HTTP limits, security headers, and owner-only state permissions - block cross-site privileged localhost and terminal access - isolate child-session output as untrusted JSON data Fixes #356 Fixes #357 Fixes #358 Fixes #359 Fixes #361 Fixes #362 ## Testing - make test - make lint - make build - pnpm audit --prod - pnpm test -- --coverage #360 was skipped and documented because its acceptance criteria change existing autoapproval functionality.

dries added 7 commits 2026-07-17 11:11:03 +02:00

fix: require explicit remote TLS fixes #356 b3a8a39317

chore: update frontend security dependencies fixes #357 1928bc4399

fix: harden HTTP server defaults fixes #358 063e09f01c

fix: secure state database permissions fixes #359 6340d80fc4

fix: block cross-site privileged requests fixes #361 97b6785231

fix: isolate untrusted child messages fixes #362 f580611846

test: close rejected websocket response fixes #361 3e6646723f

dries added 1 commit 2026-07-17 12:10:38 +02:00

fix: stop completed shell turns from blinking 70e1fac4ad

forgejo-actions commented 2026-07-17 12:18:18 +02:00

Copy link

Coverage ratchet: ✅ pass

Suite	Baseline	This PR	Δ
go	76.90%	77.00%	+0.10	✅
frontend	65.42%	65.40%	-0.02	✅

Tolerance: -0.1%. Baseline stored on gh-pages.

<!-- coverage-ratchet --> ### Coverage ratchet: ✅ pass | Suite | Baseline | This PR | Δ | | |---|---|---|---|---| | go | 76.90% | 77.00% | +0.10 | ✅ | | frontend | 65.42% | 65.40% | -0.02 | ✅ | _Tolerance: -0.1%. Baseline stored on `gh-pages`._

dries merged commit 706357630a into main 2026-07-17 13:17:48 +02:00

dries deleted branch fix/security-tickets 2026-07-17 13:17:48 +02:00

Sign in to join this conversation.

Reviewers

No reviewers

Labels

Clear labels   

backend

Go backend code

  

bug

Something is broken or incorrect

  

chore

Maintenance, tooling, or cleanup

  

duplication

Code duplication to be addressed

  

effort:complex

Significant effort or risk

  

effort:medium

Moderate effort required

  

effort:trivial

Quick fix, low complexity

  

enhancement

New feature or capability

  

frontend

TypeScript / React frontend code

  

fullstack

Touches both backend and frontend

  

priority:high

Should be addressed soon

  

ready-for-agent

Agent-grabbable ticket, fully specced

  

refactor

Code restructuring without behaviour change

  

security

Security related

No labels

backend

bug

chore

duplication

effort:complex

effort:medium

effort:trivial

enhancement

frontend

fullstack

priority:high

ready-for-agent

refactor

security

Milestone

Clear milestone

No items

No milestone

Projects

Clear projects

No items

No project

Assignees

Clear assignees

No assignees

2 participants

Notifications

Subscribe

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference

dries/ocman!367

No description provided.