Diego Rodrigues de Sa e Souza
aa0ac7da87
docs(security): document full LOCAL_ONLY route set + GHSA-fhh6-4qxv-rpqj + audit path ( #5599 ) ( #5748 )
...
Expand ROUTE_GUARD_TIERS.md Tier 1 (LOCAL_ONLY):
- link the GHSA advisory and explain the attack class (RCE via a subprocess spawn
reachable from non-loopback traffic)
- replace the 3-example prefix table with the full LOCAL_ONLY set, mirroring
LOCAL_ONLY_API_PREFIXES / LOCAL_ONLY_API_PATTERNS in routeGuard.ts (the
authoritative source; check-route-guard-membership enforces the code side)
- add an "Operator guidance & auditing" section for users behind
nginx/Cloudflare/Tailscale: don't forge X-Forwarded-For loopback, keep the
manage-scope bypass minimal, and how to audit non-loopback access
Docs-only; SECURITY.md already links here.
Closes #5599
2026-07-01 01:09:20 -03:00
..
2026-05-15 02:08:12 -03:00
2026-05-15 01:30:18 -03:00
2026-06-11 04:01:24 -03:00
2026-05-26 23:51:47 -03:00
2026-05-15 02:24:45 -03:00
2026-05-14 23:24:52 -03:00
2026-05-15 00:28:36 -03:00
2026-05-15 01:51:55 -03:00
2026-05-15 02:47:49 -03:00
2026-05-15 03:24:50 -03:00
2026-05-26 23:51:47 -03:00
2026-05-26 23:51:47 -03:00
2026-06-19 06:49:01 -03:00
2026-06-19 06:49:01 -03:00
2026-05-15 02:47:49 -03:00
2026-06-21 08:56:51 -03:00
2026-05-15 00:52:15 -03:00
2026-05-15 05:11:18 -03:00
2026-05-26 23:51:47 -03:00
2026-05-14 23:24:52 -03:00
2026-05-15 09:13:56 -03:00
2026-05-15 02:24:45 -03:00
2026-05-15 03:24:50 -03:00
2026-05-15 10:24:30 -03:00
2026-06-20 07:09:43 -03:00
2026-06-20 07:09:43 -03:00
2026-06-28 06:58:29 -03:00
2026-06-23 03:08:29 -03:00
2026-05-15 02:05:06 -03:00
2026-06-01 14:30:17 -03:00
2026-05-14 23:54:49 -03:00
2026-05-15 02:27:20 -03:00
2026-05-15 09:13:56 -03:00
2026-05-15 02:47:49 -03:00
2026-05-15 03:00:52 -03:00
2026-05-15 02:47:49 -03:00
2026-05-20 23:41:39 -03:00
2026-05-26 23:51:47 -03:00
2026-05-15 02:25:58 -03:00
2026-05-14 22:38:59 -03:00
2026-05-20 02:05:50 -03:00
2026-05-14 23:24:52 -03:00
2026-06-20 14:55:24 -03:00
2026-06-29 08:40:06 -03:00
2026-05-15 04:51:23 -03:00
2026-05-20 09:12:49 -03:00
2026-05-15 02:26:41 -03:00
2026-05-14 23:11:30 -03:00
2026-06-14 02:02:02 -03:00
2026-06-29 16:51:03 -03:00
2026-05-15 02:47:49 -03:00
2026-06-20 07:09:43 -03:00
2026-07-01 01:09:20 -03:00
2026-06-20 07:09:43 -03:00
2026-07-01 01:09:20 -03:00
2026-06-20 07:09:43 -03:00
2026-06-20 07:09:43 -03:00
2026-06-20 07:09:43 -03:00
2026-06-20 07:09:43 -03:00
2026-06-20 07:09:43 -03:00
2026-06-20 07:09:43 -03:00
2026-06-20 07:09:43 -03:00
2026-06-29 08:40:06 -03:00
2026-06-20 07:09:43 -03:00
2026-06-12 23:49:22 -03:00
2026-05-15 00:45:35 -03:00
2026-05-15 01:24:36 -03:00
2026-05-26 23:51:47 -03:00
2026-05-15 00:18:53 -03:00
2026-05-15 00:36:41 -03:00
2026-05-15 02:27:56 -03:00
2026-05-15 02:47:49 -03:00
2026-05-15 02:47:49 -03:00
2026-05-15 09:48:30 -03:00
2026-06-19 06:49:01 -03:00
2026-05-15 02:25:24 -03:00
2026-05-15 04:07:20 -03:00
2026-05-15 10:24:30 -03:00
2026-06-21 08:56:51 -03:00
2026-05-15 00:59:21 -03:00
2026-05-15 01:53:09 -03:00