mirror of https://github.com/razor-ai/soup.git
7bee22052b
Security fixes across all HTTP surfaces: - Web UI: Bearer token auth on mutating endpoints, CORS restricted to served origin, path traversal protection on /api/data/inspect, config validated before training, removed user-controlled config_path from API - Serve/vLLM: max_tokens capped at 16384, generic error messages (no stack traces) - Generate: SSRF protection (--api-base blocks non-HTTPS for remote URLs), --api-key deprecated in favor of OPENAI_API_KEY env var - Export: llama.cpp pinned to tag b5270 (supply-chain safety) - Push: --token deprecated in favor of HF_TOKEN env var - Rewards: warning before executing custom .py reward files - Tests: all 40 UI tests updated with auth headers, 666 tests pass Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> |
||
|---|---|---|
| .. | ||
| __init__.py | ||
| chat.py | ||
| data.py | ||
| diff.py | ||
| doctor.py | ||
| eval.py | ||
| export.py | ||
| generate.py | ||
| init.py | ||
| merge.py | ||
| push.py | ||
| quickstart.py | ||
| runs.py | ||
| serve.py | ||
| sweep.py | ||
| train.py | ||
| ui.py | ||