Repository navigation

fix(server): security review fixes for the self-hosted server - #29

Merged

HackTuah merged 13 commits into

mainfrom

fix/sec-server

Oct 7, 2026

Merged

fix(server): security review fixes for the self-hosted server#29
HackTuah merged 13 commits into
mainfrom
fix/sec-server

Commits on Oct 7, 2026
- fix(server): stop refused host names flooding the log
  
  Ayla Croft
  and
  claude
  committed
  e223a21
- fix(server): listen on both loopback addresses by default
  
  Ayla Croft
  and
  claude
  committed
  269a648
- fix(server): throttle wrong tokens and add a token proof route
  
  Ayla Croft
  and
  claude
  committed
  eda0e3e
- fix(server): warn about an API token that is easy to guess
  
  Ayla Croft
  and
  claude
  committed
  a2fb973
- fix(server): refuse a password inside LLM_URL, TRANSCRIBE_URL or PUBLIC_URL
  
  Ayla Croft
  and
  claude
  committed
  5e49cfe
- fix(server): warn when a provider key goes over plain HTTP
  
  Ayla Croft
  and
  claude
  committed
  0a1806e
- fix(server): keep refused words out of the debug log without LOG_LOOKUPS
  
  Ayla Croft
  and
  claude
  committed
  c6a1317
- fix(server): refuse a data folder someone else could have planted files in
  
  Ayla Croft
  and
  claude
  committed
  b1b75a1
- fix(server): make the old copy of the words private, and delete it with the data
  
  Ayla Croft
  and
  claude
  committed
  713cb45
- refactor(server): keep only the Sobelow skip the data-folder check needs
  
  Ayla Croft
  and
  claude
  committed
  89fe6d2
- test(server): cover the cap on wrong-token lockout lines
  
  Ayla Croft
  and
  claude
  committed
  64ffaa4
- docs: date the HTTP API reference and architecture reviewed today
  
  Ayla Croft
  and
  claude
  committed
  f59d563
- Merge branch 'main' into fix/sec-server
  HackTuah
  authored
  f07dadb

Commits

Commits on Oct 7, 2026