zmf 8a527fec91 fix(security): SSRF guard on search baseUrl, default-password remote login, and request-details redaction ...

- resolveBaseUrl() rejects client-supplied non-public baseUrls via assertPublicUrl (SSRF guard on /v1/search)
- fresh-install remote login with default password returns 403 without issuing a JWT
- /api/usage/request-details redacts request/providerRequest/providerResponse/response payloads
- declare chalk and prop-types in package.json (used but previously undeclared)

2026-08-13 11:50:25 +07:00

2.0 KiB

Raw Blame History

View Raw