hamsa0x7 d8c2298d07 fix(security): patch 5 vulnerabilities from security audit ...

- mask API keys in usage stats/history responses (apiKeyMasked)
- validate proxy URL scheme + reject shell metachars before env write
- escape HTML in OAuth callback page to prevent XSS
- atomic O_EXCL lock file to prevent TOCTOU race in MITM startServer
- set mitmIsRestarting guard synchronously before any await

Co-authored-by: Cursor <cursoragent@cursor.com>

2026-06-26 11:04:51 +07:00

..

app

fix(gemini): validate native model id to block path traversal

2026-06-26 11:01:24 +07:00

i18n

…

lib

fix(security): patch 5 vulnerabilities from security audit

2026-06-26 11:04:51 +07:00

mitm

fix(security): patch 5 vulnerabilities from security audit

2026-06-26 11:04:51 +07:00

models

feat: add OpenCode Go provider and support for custom models

2026-04-22 14:16:21 +07:00

shared

fix(models): show custom provider models in combo picker

2026-06-26 11:03:13 +07:00

sse

Fix usage logging dedupe and reduce stats churn

2026-06-26 10:22:20 +07:00

store

feat(db): migrate from lowdb to SQLite with repos pattern

2026-05-09 17:48:20 +07:00

dashboardGuard.js

fix(gemini): support native TTS generateContent endpoint

2026-06-26 10:50:13 +07:00

proxy.js

fix: use export default in proxy.js for Next.js 16 middleware detection

2026-06-13 09:57:20 +07:00