fix: remediate 9 security findings from external audit (OS-15 through OS-23)#744

Merged

johntmyers merged 10 commits intomainfrom

fix/security-audit-batch-1

Apr 3, 2026

Commits on Apr 2, 2026

fix(install): restrict tar extraction to expected binary member
johntmyers
committed
fix(deploy): quote registry credentials in YAML heredocs
johntmyers
committed
fix(server): redact session token in SSH tunnel rate-limit log
johntmyers
committed
fix(server): escape gateway_display in auth connect page
johntmyers
committed
fix(server): prevent XSS via code param with validation and proper JS escaping
johntmyers
committed
fix(sandbox): add byte cap and idle timeout to streaming inference relay
johntmyers
committed
fix(policy): narrow port field from u32 to u16 to reject invalid values
johntmyers
committed
fix(deps): migrate from archived serde_yaml to serde_yml
johntmyers
committed
fix(server): re-validate sandbox-submitted security_notes and cap hit_count
johntmyers
committed
chore: apply cargo fmt and update Cargo.lock for serde_yml
johntmyers
committed