diegosouzapw 34e62d8725 fix(security): crypto-secure cloud-agent IDs + exact-hostname check (CodeQL #251, #252) ...

- #251 (Insecure randomness): baseAgent.generateTaskId/generateActivityId used
  Math.random().toString(36) for IDs that flow into session/external identifiers
  (e.g. jules.ts task externalId). Switched to crypto randomBytes(8).toString("hex").
- #252 (Incomplete URL substring sanitization): the antigravity discovery test
  matched the upstream host via url.includes("…googleapis.com"), which a look-alike
  host could bypass. Switched to an exact `new URL(url).hostname === …` comparison.

2026-05-22 15:09:07 -03:00

..

e2e

Release/v3.8.0 — full changelog with 660+ commits (#2419)

2026-05-20 02:05:50 -03:00

fixtures/cursor

refactor(scripts): organize into build/dev/check/docs/i18n/ad-hoc subfolders

2026-05-13 10:14:25 -03:00

golden-set

feat(compression): expand caveman parity and MCP metadata compression

2026-05-03 09:14:20 -03:00

helpers

feat(auth): enforce dashboard sessions for management routes

2026-04-17 16:45:27 -03:00

integration

Release v3.8.1 (#2441)

2026-05-21 01:29:12 -03:00

live

fix(security): resolve CodeQL ReDoS + URL sanitization alerts

2026-05-17 07:43:32 -03:00

load

chore(release): v3.6.6 — Stabilization (#1241)

2026-04-16 05:26:17 -03:00

manual

Release v3.8.0 (#2073)

2026-05-10 00:55:06 -03:00

security

feat: OmniRoute v1.0.0 — Intelligent AI Gateway & Universal LLM Proxy

2026-02-18 00:02:15 -03:00

translator

chore: apply PR 1495 and update changelog

2026-04-21 21:12:29 -03:00

unit

fix(security): crypto-secure cloud-agent IDs + exact-hostname check (CodeQL #251, #252)

2026-05-22 15:09:07 -03:00

scratch_test.mjs

refactor: implement path utilities, add custom date formatting, improve type safety, and unify database imports

2026-04-21 21:10:48 -03:00