Ho Lim da0e245db6 fix(security): avoid prototype-chain account path checks (#34982) ...

Merged via squash.

Prepared head SHA: f89cc6a649
Co-authored-by: HOYALIM <166576253+HOYALIM@users.noreply.github.com>
Co-authored-by: dvrshil <81693876+dvrshil@users.noreply.github.com>
Reviewed-by: @dvrshil

2026-03-04 17:38:09 -08:00

..

audit-channel.ts

fix(security): avoid prototype-chain account path checks (#34982)

2026-03-04 17:38:09 -08:00

audit-extra.async.ts

feat(secrets): expand SecretRef coverage across user-supplied credentials (#29580)

2026-03-03 02:58:20 +00:00

audit-extra.sync.test.ts

perf(test): fold secret equality assertions into audit extra suite

2026-02-16 00:18:27 +00:00

audit-extra.sync.ts

feat(web-search): switch Perplexity to native Search API (#33822)

2026-03-03 22:57:19 -06:00

audit-extra.ts

feat(security): audit workspace skill symlink escapes

2026-03-02 23:28:54 +00:00

audit-fs.ts

Doctor/Security: fix telegram numeric ID + symlink config permission warnings (#19844)

2026-02-18 00:09:51 -08:00

audit-tool-policy.ts

refactor(core): dedupe tool policy and IPv4 matcher logic

2026-02-16 16:14:54 +00:00

audit.test.ts

fix(security): avoid prototype-chain account path checks (#34982)

2026-03-04 17:38:09 -08:00

audit.ts

feat(secrets): expand SecretRef coverage across user-supplied credentials (#29580)

2026-03-03 02:58:20 +00:00

channel-metadata.ts

fix(security): separate untrusted channel metadata from system prompt (thanks @KonstantinMirin)

2026-02-03 23:02:45 -08:00

dangerous-config-flags.ts

feat(gateway)!: require explicit non-loopback control-ui origins

2026-02-24 01:57:11 +00:00

dangerous-tools.ts

Deny cron tool on /tools/invoke by default

2026-02-24 04:33:50 +00:00

dm-policy-channel-smoke.test.ts

refactor: unify dm policy store reads and reason codes

2026-02-26 17:47:57 +01:00

dm-policy-shared.test.ts

fix(ci): resolve docs lint and test typing regressions

2026-03-03 00:55:01 +00:00

dm-policy-shared.ts

refactor: harden plugin install flow and main DM route pinning

2026-03-02 21:22:38 +00:00

external-content.test.ts

fix(security): harden spoofed system marker handling

2026-03-02 06:19:16 +00:00

external-content.ts

fix(security): harden spoofed system marker handling

2026-03-02 06:19:16 +00:00

fix.test.ts

refactor(tests): dedupe security fix scenario helpers

2026-03-03 01:54:27 +00:00

fix.ts

refactor(security): enforce account-scoped pairing APIs

2026-02-26 21:57:52 +01:00

mutable-allowlist-detectors.ts

refactor(security): unify dangerous name matching handling

2026-02-24 01:33:08 +00:00

safe-regex.test.ts

refactor(security): split safe-regex parse and bounded matching

2026-03-02 16:47:00 +00:00

safe-regex.ts

refactor(security): split safe-regex parse and bounded matching

2026-03-02 16:47:00 +00:00

scan-paths.ts

fix(security): enforce plugin and hook path containment

2026-02-19 15:37:29 +01:00

secret-equal.ts

fix(security): SHA-256 hash before timingSafeEqual to prevent length leak (#20856)

2026-02-19 03:16:35 -08:00

skill-scanner.test.ts

test: stabilize bun cache invalidation fixtures

2026-03-02 22:09:36 +00:00

skill-scanner.ts

perf(security): cache scanner directory walks

2026-03-02 20:19:10 +00:00

temp-path-guard.test.ts

perf(test): reduce temp fixture churn in guardrail-heavy suites

2026-03-03 01:09:07 +00:00

windows-acl.test.ts

refactor(tests): consolidate repeated setup helpers

2026-03-03 01:06:00 +00:00

windows-acl.ts

fix(security): recognize localized Windows SYSTEM account in ACL audit (#29698)

2026-03-02 08:38:56 -06:00