Security & reliability hardening: dashboard auth, SSRF pinning, tool policy, corpus integrity, signed findings log - #21

Open

pt-act wants to merge 20 commits into

JailbrokenAI:mainfrom

pt-act:upstream-contrib/security-remediation

Commits on Jul 19, 2026

M0 audit remediation: dashboard auth+CSRF, tool policy, egress guard, path confinement, log redaction, atomic state, image-judge + provider hardening
Poncho (audit-remediation M0)
committed
fc4fd90
TG1.4: wire SPA auth token (X-WB-Token); token IS the CSRF defense
rial1
committed
7b35b98
TG4.2: close providers at the tool-call boundary (REL-2)
rial1
committed
8c1f904
TG4.3: run lifecycle — force-stop, overall timeout, bounded queue (REL-6/7)
rial1
committed
560ccd9
TG5.3+5.4+5.5: cache deltas+compaction, request_gate notify, RunLog lock (RACE-2/3/4)
rial1
committed
d0e5144
TG3.4-3.6: Pydantic models, global 500 handler, startup log-and-continue (SEC-11/REL-8)
rial1
committed
813465f
Gate 3: wire PBT security properties + _int_setting OverflowError fix (M1-backend)
rial1
committed
b048c4c
Merge pull request #1 from ra-co88/fix/audit-remediation-m0
ra-co88
authored
9bb8af5

Commits on Jul 22, 2026

Frontend audit remediation TG6-8: reliability primitives + WCAG 2.2 AA + visual consistency
Poncho (frontend TG6-8)
committed
b3934bf
Merge pull request #2 from ra-co88/feat/audit-remediation-frontend
ra-co88
authored
f1fc70b
P3 hardening: DNS-rebind pinning, require_auth=True default, Gate 4B PBT, REL-13 retry cap
rial1
committed
4ffaa66
Gate 4 sign-off: add wallbreaker-audit.md with closure header, CHANGELOG with full remediation history
rial1
committed
0b37a28
Merge pull request #3 from ra-co88/p3-hardening
ra-co88
authored
6822499

Commits on Jul 23, 2026