Security review
The repo records fixes from reviews between 2026-09-02 and 2026-10-28. This pack did not run its own audit.
- Fixed: scanner bypass, path traversal, injection guard, approval persistence, DNS rebinding, private address ranges, redaction of tokens.
- Open: see known-issues.json.
- SECURITY.md has one paragraph about DNS rebinding that is older than the fix in PR #22.
See also:Threat model
Checked against the source at commit f4fd89f on 29 Oct 2026. Everything here is merged on the main branch; no release has been tagged yet. The source is private, so these pages are the public description.