Alpamys 7bee22052b v0.10.10: Security hardening — Web UI auth, CORS, SSRF, path traversal protection ... Security fixes across all HTTP surfaces: - Web UI: Bearer token auth on mutating endpoints, CORS restricted to served origin, path traversal protection on /api/data/inspect, config validated before training, removed user-controlled config_path from API - Serve/vLLM: max_tokens capped at 16384, generic error messages (no stack traces) - Generate: SSRF protection (--api-base blocks non-HTTPS for remote URLs), --api-key deprecated in favor of OPENAI_API_KEY env var - Export: llama.cpp pinned to tag b5270 (supply-chain safety) - Push: --token deprecated in favor of HF_TOKEN env var - Rewards: warning before executing custom .py reward files - Tests: all 40 UI tests updated with auth headers, 666 tests pass Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>		2026-03-25 12:14:10 +05:00
..
__init__.py	Initial project setup: CLI skeleton + config + trainer + data pipeline	2026-02-20 16:14:56 +05:00
dpo.py	v0.10.7: Fix PPO resume_from_checkpoint and CPU meta tensor errors	2026-03-24 16:21:10 +05:00
grpo.py	v0.10.8: Fix GRPO chat_template + PPO dataset tokenization for CPU/trl compat	2026-03-24 21:42:54 +05:00
ppo.py	v0.10.8: Fix GRPO chat_template + PPO dataset tokenization for CPU/trl compat	2026-03-24 21:42:54 +05:00
reward_model.py	v0.10.7: Fix PPO resume_from_checkpoint and CPU meta tensor errors	2026-03-24 16:21:10 +05:00
rewards.py	v0.10.10: Security hardening — Web UI auth, CORS, SSRF, path traversal protection	2026-03-25 12:14:10 +05:00
sft.py	v0.10.7: Fix PPO resume_from_checkpoint and CPU meta tensor errors	2026-03-24 16:21:10 +05:00