Fixed in commit 23c6e0e on branch security/audit-2026-04-17.
Approach. Added sanitizeAssistantErrorMessage() in packages/api/src/router/assistant-tools/helpers.ts (lines 22-55). The…
Resolved in commit 019702c (security: ReDoS hardening on blueprint field validator).
Three-layer defence:
- Save-time (
packages/shared/src/schemas/blueprint.schema.ts:33-54) —…
Acceptance criteria met. pnpm audit --audit-level=moderate on main:
1 vulnerabilities found
Severity: 1 moderate
Resolved upgrades (main commit 534945f):
dompurify→ 3.3.4+…
Resolved across two commits, covering both the stdout logger and the DB audit path.
Layer A — pino stdout redact (main commit 534945f, verified at packages/api/src/lib/logger.ts:8-40):
Reda…
Part 1 — TOTP replay race — resolved in commit 3222bec (security: atomic compare-and-swap for TOTP replay window).
- New helper
packages/api/src/lib/totp-consume.ts::consumeTotpWindow()…
Resolved in commit 4ff7bc9 (security: SSRF guard covers IPv6 + DNS-rebind defence via pinned IP).
SSRF-guard (packages/api/src/lib/ssrf-guard.ts) — blocks full IPv4 private space…
*.openai.com, *.azure.com), unsafe-inline styles, SVG routes skip CSP
Resolved in commit c0c5f76 (security: bound JSONB inputs + whitelist batchUpdateCustomFields keys). Resource.dynamicFields merge now goes through a whitelist of known keys; attacker-controlled…
*.openai.com, *.azure.com), unsafe-inline styles, SVG routes skip CSP
Resolved in commit d1075af (security: tighten CSP — drop provider wildcards, add object/frame/worker-src).
apps/web/src/middleware.ts::buildCsp() now returns:
connect-src 'self'(was…
/api/* — new routes inherit public access
/api/* — new routes inherit public access
Resolved in commit b32160d (security: default-deny /api middleware allowlist). The web app middleware now allowlists known public /api/* routes; new routes default to auth-required.
Resolved in commit 0303063 (security: constant-time authorize + uniform audit summaries). Authorize path now runs Argon2 verify against a dummy hash when the user is missing, and audit summaries…