sec(web): Host allowlist, body caps, fail-closed sanitization; CI reproducibility - #64

Merged

ZeR020 merged 7 commits into

mainfrom

fix/audit-security

Sep 8, 2026

Commits on Sep 8, 2026

sec(web): Host header allowlist on every route
ZeR020
committed
3282751
sec(web): Bun.serve body cap
ZeR020
committed
9dc7b63
sec(web): app.js defer + fail-closed sanitize
ZeR020
committed
59361cc
sec(sqlite): transcript FTS query sanitization
ZeR020
committed
758ee4b
sec(web): constant-time key compare
ZeR020
committed
2a29185
chore(ci): pin bun, freeze sonar lockfile
ZeR020
committed
d535b5a
docs: unify Unreleased sections across audit branches
ZeR020
committed
f8d3651