fix: security release 2026-07-06#4199

Merged

carderne merged 7 commits into

mainfrom

security-release/2026-07-06

Jul 9, 2026

Commits on Jul 9, 2026

fix(webapp): reject replaying a run into an environment outside its project (#52)
carderne
committed
fix(webapp): SSRF hardening for alert webhooks + platform-notification URL XSS (supersedes #40) (#51)
carderne
committed
fix(webapp): redact secrets & PII from logs (worker secret, API key/JWT, Slack) (#41)

d-cs
authored and
carderne
committed
fix(cli): thread --dev-only into McpContext so the env guard fires (#32)

d-cs
authored and
carderne
committed
fix(webapp): query & API endpoint hardening (query authz, prompt-override, ai-title rate limit) (#44)

d-cs
authored and
carderne
committed
fix(webapp): account & access-control hardening (auth, RBAC, org membership, impersonation) (#42)

d-cs
authored and
carderne
committed
fix(webapp): run/batch/trigger tenant scoping & batch-resume authorization (#43)

d-cs
authored and
carderne
committed