security: remediate September 2026 audit findings (WebSocket, sessions, identity, auth core) - #26

Merged

JedimEmO merged 8 commits into

security/hardening-2026-09

Sep 5, 2026

Commits on Sep 5, 2026

security: remediate September 2026 audit findings (24 issues, W1-F2)

JedimEmO
and
claude
committed
36ac13a
test(bidirectional-server): W2 transport-level frame limit regression test

JedimEmO
and
claude
committed
3ec0a02
security: close revocation race, atomic admission, global caps, log sanitizing

JedimEmO
and
claude
committed
1716cf1
security: make subscription limits and admission manager invariants

JedimEmO
and
claude
committed
26126ca
security: enforce subscription limits in the server, independent of the manager

JedimEmO
and
claude
committed
c23cf24
security: make ConnectionContext::subscribe the single checked mutation path

JedimEmO
and
claude
committed
f2e1feb
test(bidirectional-server): level-triggered release in concurrency tests

JedimEmO
and
claude
committed
c44b189
ci: nextest, coverage PR comments, flake detector; deadline-based waits in tests

JedimEmO
and
claude
committed
9d0f059