Security audit fixes + hardening (v0.11.0)#1

Merged

thinkbig1979 merged 10 commits into

mainfrom

security/audit-fixes

Jun 3, 2026

Commits on Jun 3, 2026

fix(security): confine DR-restore path server-side (C1) and close login timing oracle (H3)

thinkbig1979
and
claude
committed
fix(security): bump dependencies to clear CVEs (H4/H5)

thinkbig1979
and
claude
committed
fix(security): symlink-aware path containment + snapshot ID validation (H1/M2/M1/M5)

thinkbig1979
and
claude
committed
fix(security): derive at-rest storage key via HKDF, decoupled from JWT_SECRET (H2)

thinkbig1979
and
claude
committed
fix(security): web + settings hardening (M3/M4/M6/M7, L4/L5)

thinkbig1979
and
claude
committed
fix(security): low/info hardening (L1/L2/L8/L9/L10)

thinkbig1979
and
claude
committed
fix(backup): DR-restore targets the configured restic repo, not a separate dir

thinkbig1979
and
claude
committed
docs: document STORAGE_KEY, X-Forwarded-Proto, and upgrade notes for security changes

thinkbig1979
and
claude
committed
docs(readme): add Application Security section

thinkbig1979
and
claude
committed
docs(readme): refresh to match implementation; drop untracked references

thinkbig1979
and
claude
committed