fix: security hardening from aardvark/codex scanner findings - #352

Merged

johntmyers merged 13 commits into

mainfrom

fix/l7-rest-parser-overread-smuggling

Mar 16, 2026

Commits on Mar 16, 2026

fix(sandbox): prevent overread request smuggling in L7 REST parser
johntmyers
committed
9b47113
fix(server): harden sandbox TLS secret volume permissions to 0400
johntmyers
committed
7b6b943
fix(sandbox): stop using cmdline paths for binary policy matching
johntmyers
committed
fde0d7e
fix(sandbox): reject symlink and non-dir read_write paths before chown
johntmyers
committed
50bc502
fix(server): redact provider credentials in gRPC CRUD responses
johntmyers
committed
2d3e643
fix(sandbox): enforce non-root fallback when process user unset
johntmyers
committed
1a980f1
fix(sandbox): deny forward proxy for L7-configured endpoints
johntmyers
committed
8f188de
test(e2e): add regression test for forward proxy L7 bypass
johntmyers
committed
7b3da53
fix: update tests for cmdline path and TLS volume changes
johntmyers
committed
04525fe
test(e2e): update provider e2e tests for credential redaction
johntmyers
committed
11e6cb8
chore: reformat for Rust 1.94 assert! macro style
johntmyers
committed
9950592
fix(sandbox): make drop_privileges tests root-aware for CI
johntmyers
committed
c14b694
fix(sandbox): allow non-directory read_write entries like /dev/null
johntmyers
committed
d536278