gstack

History

Garry Tan 47a8277567 security: fix path validation bypass, CORS restriction, cookie-import path check - startsWith('/tmp') matched '/tmpevil' — now requires trailing slash - CORS Access-Control-Allow-Origin changed from * to http://127.0.0.1:<port> - cookie-import now validates file paths (was missing validateReadPath) - 3 new tests for prefix collision and cookie-import path traversal Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>		2026-03-12 20:49:34 -07:00
..
bin	Phase 3: /qa skill — systematic QA testing with health scores	2026-03-12 13:34:06 -07:00
src	security: fix path validation bypass, CORS restriction, cookie-import path check	2026-03-12 20:49:34 -07:00
test	security: fix path validation bypass, CORS restriction, cookie-import path check	2026-03-12 20:49:34 -07:00
SKILL.md	Phase 2: Rewrite SKILL.md as QA playbook + command reference	2026-03-12 13:33:54 -07:00