Security hardening + template safety (v1.4.2–v1.4.4)#1

Open

mt-alarcon wants to merge 9 commits into

bvisible:mainfrom

mt-alarcon:feat/v1.4-hardening-and-globals

Commits on Jun 9, 2026

feat(security): input validation, media path LFI guard, save snapshot/rollback

mt-alarcon
and
claude
committed
fix(mcp): close REST↔Abilities drift and an add-element crash

mt-alarcon
and
claude
committed
test: dependency-free PHP test harness (Validator + Element_Factory)

mt-alarcon
and
claude
committed
docs: fork attribution, CHANGELOG, IMPROVEMENTS, skill sync (v1.4.0)

mt-alarcon
and
claude
committed
fix(security): reject SVG on media import (stored XSS vector)

mt-alarcon
and
claude
committed
feat(security): payload-size ceiling on write requests (SHOULD-6)

mt-alarcon
and
claude
committed
feat(security): tighten capabilities, per-post + per-surface (MUST-FIX-2)

mt-alarcon
and
claude
committed
docs: v1.4.1 security-audit follow-up (README, CHANGELOG, IMPROVEMENTS)

mt-alarcon
and
claude
committed

Commits on Jun 10, 2026

feat(security): v1.4.2–v1.4.4 hardening + template-safety (3 cycles)
mt-alarcon
committed