harden auth-free redirect, ssrf pinning, first-admin and quota races, service.name - #263

Merged

Polliog merged 8 commits into

fix/security-hardening-leads

Jun 26, 2026

Commits on Jun 26, 2026

validate redirect target in auth-free login/register
Polliog
committed
34de2f2
sanitize otlp service.name at ingestion
Polliog
committed
17d3e5e
pin validated ip in safeFetch to block dns rebinding
Polliog
committed
ad9d64a
serialize first-admin promotion to close bootstrap race
Polliog
committed
2e9c17e
serialize capability count+create to prevent limit races
Polliog
committed
43360ec
changelog for security hardening batch
Polliog
committed
402a1c8
bound capability lock waiters with in-process mutex
Polliog
committed
d92d679
credit kiberblick.de in security acknowledgments
Polliog
committed
56db418