BenandClaude Sonnet 4.6 bbadebd761 Security hardening: input validation, bounded caches, and cookie secret enforcement ...

- Enforce OWNER_COOKIE_SECRET env var — throw on startup if unset rather than
  falling back to a weak derived secret
- Fix HTTPS detection to use exact string match instead of .includes()
- Cap and validate MQTT login credentials (32 char max, username format regex)
- Validate packetHash query param as hex before hitting the path resolver
- Validate node ID path params as 64-char hex in /nodes/:id/links and /nodes/:id/history
- Bound viableLinksCache to 50 entries with oldest-first eviction
- Bound countedAdvertHashes to 10,000 entries with oldest-first eviction

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

2026-03-08 03:34:08 +00:00

..

src

Security hardening: input validation, bounded caches, and cookie secret enforcement

2026-03-08 03:34:08 +00:00

package-lock.json

Support multibyte path hashes across live pathing

2026-03-07 15:51:29 +00:00

package.json

Support multibyte path hashes across live pathing

2026-03-07 15:51:29 +00:00

tsconfig.json

Initial commit

2026-03-03 19:11:05 +00:00