Diego Rodrigues de Sa e Souza aa0ac7da87 docs(security): document full LOCAL_ONLY route set + GHSA-fhh6-4qxv-rpqj + audit path (#5599) (#5748) ...

Expand ROUTE_GUARD_TIERS.md Tier 1 (LOCAL_ONLY):
- link the GHSA advisory and explain the attack class (RCE via a subprocess spawn
  reachable from non-loopback traffic)
- replace the 3-example prefix table with the full LOCAL_ONLY set, mirroring
  LOCAL_ONLY_API_PREFIXES / LOCAL_ONLY_API_PATTERNS in routeGuard.ts (the
  authoritative source; check-route-guard-membership enforces the code side)
- add an "Operator guidance & auditing" section for users behind
  nginx/Cloudflare/Tailscale: don't forge X-Forwarded-For loopback, keep the
  manage-scope bypass minimal, and how to audit non-loopback access

Docs-only; SECURITY.md already links here.

Closes #5599

2026-07-01 01:09:20 -03:00

..

cli

docs(security): document full LOCAL_ONLY route set + GHSA-fhh6-4qxv-rpqj + audit path (#5599) (#5748)

2026-07-01 01:09:20 -03:00

_ops-common.sh

Release v3.8.40

2026-06-29 08:40:06 -03:00

cold-start-bench.sh

Release v3.8.40

2026-06-29 08:40:06 -03:00

mcp-server.mjs

Release v3.8.24 (#3747)

2026-06-13 17:27:40 -03:00

nodeRuntimeSupport.mjs

Release v3.8.40

2026-06-29 08:40:06 -03:00

omniroute.mjs

Release v3.8.34 (#4614)

2026-06-23 03:08:29 -03:00

reset-password.mjs

Release v3.8.13 (#3327)

2026-06-06 19:13:11 -03:00

restore-data.sh

Release v3.8.40

2026-06-29 08:40:06 -03:00

restore-policies.sh

Release v3.8.40

2026-06-29 08:40:06 -03:00

rollback.sh

Release v3.8.40

2026-06-29 08:40:06 -03:00

snapshot-data.sh

Release v3.8.40

2026-06-29 08:40:06 -03:00