All pull requests

Pull requests

• fix(security): restrict Origin allowlist to exact frontend origins in tokenless loopback mode

  #89·nithiink opened Oct 6, 2026Owner·

  ·
  1

• fix(security): close CSRF / DNS-rebinding / prompt-injection paths to the command backend

  #87·nithiink opened Oct 4, 2026Owner·

  ·
  1

• fix(security): close tokenless cross-origin paths to the command-executing backend

  #85·nithiink opened Oct 3, 2026Owner·

  ·
  1

• fix(security): defeat DNS rebinding by pinning request Host to local addresses

  #83·nithiink opened Oct 2, 2026Owner·

  ·
  1

• fix(security): block DNS-rebinding CSRF at the proxy with an absolute Host allowlist

  #81·nithiink opened Sep 30, 2026Owner·

  ·
  1

• fix(security): don't trust arbitrary localhost/LAN origins in tokenless mode

  #79·nithiink opened Sep 29, 2026Owner·

  ·
  1

• fix(security): close CSRF/SSRF gaps in tokenless mode (daily review 2026-09-28)

  #77·nithiink opened Sep 28, 2026Owner·

  ·
  1

• fix(security): block DNS rebinding on /api proxy via Host allowlist

  #75·nithiink opened Sep 27, 2026Owner·

  ·
  1

• fix(security): strict Origin allowlist for in-app auth in tokenless mode

  #73·nithiink opened Sep 26, 2026Owner·

  ·
  1

• fix(security): scope Origin allowlist to exact frontend in tokenless mode; redact auth token from access logs

  #71·nithiink opened Sep 25, 2026Owner·

  ·
  1

• fix(security): pin HTTP Host header to defeat DNS rebinding

  #69·nithiink opened Sep 24, 2026Owner·

  ·
  1

• fix(security): scope broad LAN Origin allowlist to token mode

  #67·nithiink opened Sep 23, 2026Owner·

  ·
  1

• fix(security): add Host allowlist to /api proxy to block DNS-rebinding CSRF

  #65·nithiink opened Sep 22, 2026Owner·

  ·
  1

• fix(security): restrict Origin auth-gate to exact frontend origins in tokenless mode

  #63·nithiink opened Sep 21, 2026Owner·

  ·
  1

• fix(security): gate broad LAN/any-port Origin regex on token (tokenless loopback CSRF/drive-by)

  #61·nithiink opened Sep 19, 2026Owner·

  ·
  1

• fix(security): clickjacking headers, prompt-injection authority, WebFetch egress gate

  #59·nithiink opened Sep 18, 2026Owner·

  ·
  1

• Feat/yuri phase 7

  #57·techbot11 opened Sep 5, 2026·

  ·

• fix(security): validate Host header to defeat DNS rebinding (daily review 2026-07-31)

  #56·nithiink opened Jul 31, 2026Owner·

  ·
  1

• Bump next from 16.2.6 to 16.2.11 in /frontend in the npm_and_yarn group across 1 directory

  dependenciesjavascript
  #54·dependabot[bot] opened Jul 28, 2026Bot·

  ·

• fix(security): fail closed on plan-approval declines; add frontend security headers

  #53·nithiink opened Jul 21, 2026Owner·

  ·

• README: prominent 'Watch the full demo' button under the preview

  #51·nithiink opened Jul 6, 2026Owner·

  ·

• security: validate tool_use_id path component; drop --reload in network mode

  #50·nithiink opened Jun 22, 2026Owner·

  ·
  1

• fix: stop set_mode from freezing the voice agent on a busy session

  #48·nithiink opened Jun 16, 2026Owner·

  ·

• fix(ui): gate voice orb on a true ready signal, not start() returning (#38)

  #47·nithiink opened Jun 16, 2026Owner·

  ·
  1

• Fix stale UI prompt after a permission/question is answered in the CLI

  #44·nithiink opened Jun 15, 2026Owner·

  ·