fix: three access-control bugs found by a security review, plus a relay teardown bug - #24

Merged

jonaswre merged 11 commits into

mainfrom

fix/security-review-findings

Aug 4, 2026

Commits on Aug 2, 2026

fix(blobs): enforce the per-request-type event mask, not always mask.get

jonaswre
and
claude
committed
8289223
fix(docs): clamp remote sync ranges to the session namespace

jonaswre
and
claude
committed
c401cf9
fix(dns-server): verify DHT packets against the key that was queried

jonaswre
and
claude
committed
9dcb8cb
fix(relay): stop one client's datagram ending another client's session

jonaswre
and
claude
committed
20da667

Commits on Aug 4, 2026

fix(blobs): close the gaps the per-request-type event mask opened

jonaswre
and
claude
committed
b0a6dfd
fix(docs): keep clamp_to_namespace narrowing for every bound shape

jonaswre
and
claude
committed
c65ede5
fix(relay): make non-stream send errors non-fatal by construction

jonaswre
and
claude
committed
519a645
fix(dns): pin the signature length and surface DHT verification failures

jonaswre
and
claude
committed
1b7514c
chore(determinism): re-baseline the boundary inventory

jonaswre
and
claude
committed
ef8bd5f
fix(test): stop asserting on the pusher-side result of a refused push

jonaswre
and
claude
committed
cae5306
fix(test): stop the docs sync tests failing on interleaved live events

jonaswre
and
claude
committed
da3acba