diff options
| author | Christophe Besson <cbesson@gmail.com> | 2026-09-01 18:18:05 +0200 |
|---|---|---|
| committer | Christophe Besson <cbesson@gmail.com> | 2026-09-01 18:18:05 +0200 |
| commit | 73a119cbc7641b5f0005d0ce8bc4c7b0b7ae6a6e (patch) | |
| tree | f959a88c36e8f6e63d922e0e517e4db858925cf7 /packages/meshbay-node/src | |
| parent | 30c032f2659fe697f7731dc9ae2cf8b8499177d4 (diff) | |
| download | meshbay-73a119cbc7641b5f0005d0ce8bc4c7b0b7ae6a6e.tar.gz | |
docs: add third security review (2026-09-01)
Code-level review focused on what changed since second-review.md:
the unified handshake, device linking, account recovery, email
verification, reCAPTCHA, the hub instance-policy store, MHP
federation, the relay registry, chat link previews, and the node's
loopback control API.
The second review's critical/high list is confirmed closed. New
findings H1, H2, M1 and M6 are fixed in the preceding commits and
annotated as such; M2 (QUIC chat handlers regress NS6/H1/H6), M3
(link-preview SSRF), M4 (federation trust), M5 (no SPA CSP) and the
L-list remain.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_011pG75yGK3NthNfyjH74omG
Diffstat (limited to 'packages/meshbay-node/src')
0 files changed, 0 insertions, 0 deletions