Security hardening: 30 exploitable vulnerabilities (batches 1–7)#38

Merged

jkyberneees merged 9 commits into

mainfrom

fix/next-security-vulnerabilities-tdd

Jun 13, 2026

Commits on Jun 13, 2026

fix: next 5 security vulnerabilities (browser history, search caps, file-size limits, serve CSRF, untrusted wrappers)
jkyberneees
committed
fix: next 5 security vulnerabilities (shell output, browser timeout, batch_patch, transcribe, tree width)
jkyberneees
committed
fix: next 5 security vulnerabilities (patch, glob, subagent task, transcribe output, session_search get)
jkyberneees
committed
fix: next 5 exploitable vulnerabilities (resource prompt injection, session_search wrapping, resource size, subagent summary, patch expansion)
jkyberneees
committed
fix: cap write_file content, harden file_info, bound WebSocket/session/skill sizes
jkyberneees
committed
fix: wrap tree paths, cap head_tail/AGENTS/IDENTITY, harden search_files symlinks
jkyberneees
committed
fix: next 5 exploitable vulnerabilities (base64 wrapping, browser title/element wrapping + cap, config size cap, resource resolver symlink Lstat)
jkyberneees
committed
fix: clarify head_tail per-file cap + add multi-file cap test

jkyberneees
and
claude
committed
fix: confine @-resource Search to root (CodeQL path-injection)

jkyberneees
and
claude
committed