fix: security audit remediation — 12 fixes, 20 tests (v0.13.1.0)#595

Merged

garrytan merged 11 commits intomainfrom

garrytan/fix-security-issues

Mar 28, 2026

Commits on Mar 28, 2026

fix: remove auth token from /health, secure extension bootstrap (CRITICAL-02 + HIGH-03)
garrytan
committed
fix: require auth on cookie-picker data routes (CRITICAL-01)
garrytan
committed
fix: add state file TTL and plaintext cookie warning (HIGH-02)
garrytan
committed
fix: innerHTML XSS in extension content script and sidepanel (MEDIUM-01)
garrytan
committed
fix: symlink bypass in validateReadPath (MEDIUM-02)
garrytan
committed
fix: freeze hook symlink bypass and prefix collision (MEDIUM-03)
garrytan
committed
fix: shell script injection in gstack-config and telemetry (MEDIUM-04)
garrytan
committed
test: 20 security tests for audit remediation
garrytan
committed
Merge remote-tracking branch 'origin/main' into garrytan/fix-security-issues
garrytan
committed
chore: bump version and changelog (v0.13.1.0)

garrytan
and
claude
committed
docs: tone down changelog — defense in depth, not catastrophic bugs

garrytan
and
claude
committed