| Commit message (Collapse) | Author | Age | Files | Lines | |
|---|---|---|---|---|---|
| * | docs: mark M3 fixed in the third security review | Christophe Besson | 2026-09-01 | 1 | -15/+38 |
| | | | | | | | | | | | Link-preview SSRF surface bounded: per-connection + node-wide rate limit, port allowlist, connect-address re-check, decompression-bomb guard. Summary, findings table and action plan updated; original M3 text kept for the record. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_011pG75yGK3NthNfyjH74omG | ||||
| * | docs: mark M2 fixed in the third security review | Christophe Besson | 2026-09-01 | 1 | -27/+40 |
| | | | | | | | | | | | QUIC chat/stream handlers brought to WebRTC parity, and the QUIC listener gated off by default. Executive summary, findings table and action plan updated; the original M2 finding text is kept for the record. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_011pG75yGK3NthNfyjH74omG | ||||
| * | docs: add third security review (2026-09-01) | Christophe Besson | 2026-09-01 | 1 | -0/+635 |
| Code-level review focused on what changed since second-review.md: the unified handshake, device linking, account recovery, email verification, reCAPTCHA, the hub instance-policy store, MHP federation, the relay registry, chat link previews, and the node's loopback control API. The second review's critical/high list is confirmed closed. New findings H1, H2, M1 and M6 are fixed in the preceding commits and annotated as such; M2 (QUIC chat handlers regress NS6/H1/H6), M3 (link-preview SSRF), M4 (federation trust), M5 (no SPA CSP) and the L-list remain. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_011pG75yGK3NthNfyjH74omG | |||||