Repository navigation

Harden client log endpoints and settings/debug disclosure - #1457

Merged

Tim020 merged 17 commits into

devfrom

feature/security-logs-and-disclosure

Oct 21, 2026

Merged

Harden client log endpoints and settings/debug disclosure#1457
Tim020 merged 17 commits into
devfrom
feature/security-logs-and-disclosure

Commits on Oct 19, 2026
- Harden WebSocket message handling and stop logging secrets
  
  Tim020
  and
  claude
  committed
  2b2d4a7
- Require auth and bound client log posts; stop disclosing server paths and /debug
  
  Tim020
  and
  claude
  committed
  8d9e2fc
- Security hygiene: JSON body helper, 403 for non-admin, RBAC validation, settings allow-list, security headers
  
  Tim020
  and
  claude
  committed
  357b376
- Move /debug access test next to the existing debug endpoint tests
  
  Tim020
  and
  claude
  committed
  207c03a
- Make log redaction setting authoritative and default it on
  
  Tim020
  and
  claude
  committed
  10c39b1
- Redistribute tests into modules mirroring the code under test
  
  Tim020
  and
  claude
  committed
  cad9f11
Commits on Oct 20, 2026
- Reduce cognitive complexity of REST body logging and WS session op dispatch
  
  Tim020
  and
  claude
  committed
  603542e
- Merge remote-tracking branch 'origin/feature/security-websocket' into feature/security-hygiene
  Tim020
  committed
  78d830e
- Merge remote-tracking branch 'origin/dev' into feature/security-hygiene
  Tim020
  committed
  5637276
- Merge dev; non-admin show delete now returns 403
  
  Tim020
  and
  claude
  committed
  1c91d98
- Address review: fix redaction crash on absent decorated path, log malformed WS frames per setting
  
  Tim020
  and
  claude
  committed
  abd282e
- Merge remote-tracking branch 'origin/feature/security-websocket' into feature/security-hygiene
  Tim020
  committed
  1298148
- Merge feature/security-hygiene into feature/security-logs-and-disclosure
  Tim020
  committed
  1446211
- Mark sensitive settings with a define() kwarg instead of a key allow-list
  
  Tim020
  and
  claude
  committed
  3a63505
- Shrink the client logger change to cut new-code duplication
  
  Tim020
  and
  claude
  committed
  954a0be
- Merge dev into feature/security-logs-and-disclosure
  Tim020
  committed
  a578c92
Commits on Oct 21, 2026
- Address review: filter file-reload broadcast, harden log parsing, refetch settings on login
  
  Tim020
  and
  claude
  committed
  a7db686

Commits

Commits on Oct 19, 2026

Commits on Oct 20, 2026

Commits on Oct 21, 2026