Security hardening across the macOS and iOS apps#1640

Merged

datlechin merged 13 commits into

mainfrom

security/hardening-pass

Jun 10, 2026

Commits on Jun 10, 2026

fix(connections): strip pre-connect script from imported connections
datlechin
committed
fix(connections): confirm external database links and keep their passwords out of the keychain
datlechin
committed
fix(mcp): enforce per-connection access control and require a token by default
datlechin
committed
fix(plugins): re-verify plugin signature before lazy load
datlechin
committed
fix(plugin-mongodb): escape filter values in regex operators to prevent NoSQL injection
datlechin
committed
fix(ios): validate TLS certificates for verify SSL modes on networked drivers
datlechin
committed
fix(ios): keep copied database values local and auto-expiring on the clipboard
datlechin
committed
fix(ios): drop host and port from the widget shared store
datlechin
committed
build(ios): source the development team from Secrets.xcconfig
datlechin
committed
build: verify downloaded static libs against the git checksum baseline
datlechin
committed
ci: pass workflow dispatch and matrix tags through env to block script injection
datlechin
committed
docs(changelog): note the security fixes
datlechin
committed
test(connections): match sharing deeplink assertions to the shipped serialization values
datlechin
committed