security: audit lot 1 — XSS, unauth API, shell allowlist, git tool (+ example compose) - #12

Merged

Kurtisone merged 5 commits into

mainfrom

Aug 12, 2026

Commits on Aug 12, 2026

fix(ui): close stored XSS in the markdown renderer (audit C-3)
Kurtisone
committed
7637371
feat(api): refuse to start unauthenticated unless opted into (audit C-1)
Kurtisone
committed
3743fc7
fix(shell): drop interpreters from the default allowlist (audit C-2)
Kurtisone
committed
af86884
fix(git): remove stash, filter write/exec arguments, restrict env (audit E-3)
Kurtisone
committed
34611a1
docs(deploy): add example compose stack with a real build key (audit follow-up)
Kurtisone
committed
59057c1