sandrodachandClaude Opus 5.5 300fd6a7be fix(security): API keys only deliver data; one auth check everywhere ...

Until API keys get scopes they have exactly one right: POST /api/v1/inbox
(thought or task via target) and the webhook ingest; every other endpoint
answers 403 for a key. Middleware and webhook ingest share one token check
(revocation list, token_version, active account), closing FLAW-08.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

2026-10-29 07:39:29 +01:00

..

api

fix(security): API keys only deliver data; one auth check everywhere

2026-10-29 07:39:29 +01:00

auth

fix(security): resolve FLAW-08 with token_version invalidation and jwt blacklist

2026-10-27 12:09:15 +01:00

collab

feat(notes): compact the operation log and purge old tombstones

2026-10-28 15:08:13 +01:00

config

fix(security): never sign tokens with a known JWT secret (FLAW-04)

2026-10-29 07:35:45 +01:00

domain

fix(security): SSRF protection for alarm webhooks (FLAW-05)

2026-10-29 07:37:39 +01:00

storage

fix(security): SSRF protection for alarm webhooks (FLAW-05)

2026-10-29 07:37:39 +01:00

ws

feat(notes): push, long polling and fallback detection for note sync

2026-10-28 14:10:29 +01:00