Xiangzhe 49a4ad31e4 fix(security): require auth for db-backups export/import under requireLogin=false ...

/api/db-backups/export and /import sat outside ALWAYS_PROTECTED_API_PATHS, so with
requireLogin=false an anonymous caller could stream the full SQLite database
(api_keys, provider credentials, OAuth tokens) or replace it wholesale. Adding
/api/db-backups to the Tier-2 allowlist requires a credential for all three
sibling routes, matching the trade-off /api/settings/database already makes.

Reported by @ntdat812 via GHSA-mghq-58h3-qcqj.

2026-08-21 13:05:05 -03:00

..

_helpers

…

_setup

…

benchmarks

…

boundary

…

e2e

fix(providers): validate bailian-coding-plan against the Token Plan host (#10634)

2026-08-18 05:51:34 -03:00

fixtures

feat(providers): add local ZCode ACP backend (#10184)

2026-08-16 00:13:36 -03:00

golden-set

…

helpers

fix(responses): replace synthetic reasoning keepalive (#10806)

2026-08-20 09:49:55 -03:00

homolog

…

integration

fix(cline): stop generating proxy task ids (#10279)

2026-08-21 02:13:00 -03:00

live

…

llm-security

…

load

…

manual

…

security

…

snapshots

fix(cline): stop generating proxy task ids (#10279)

2026-08-21 02:13:00 -03:00

translator

…

unit

fix(security): require auth for db-backups export/import under requireLogin=false

2026-08-21 13:05:05 -03:00

_cp_mock_hook.mts

…

_cp_mock_module.mts

…

_run_dns_guard_test.sh

…

e2e-tool-calls.sh

…

theoldllm-stress.test.ts

…