Commit history for src/server/security
adddc31⌁
- Embed the owning repo or account id in new row ids so lookups skip the directory and no locator rows are written9878c76⌁taigrr committed
- Remove the migration scaffolding: D1 import path, one-shot cron steps, backfill helpers and unused exports4088d52⌁taigrr committed
- Move security data (advisories, alerts, SARIF, dependencies, settings) into RepoState and signing keys into AccountState7794e8f⌁taigrr committed
- Merge fix/verify-gatec201dc1⌁taigrr committed
- Merge release/scratchcc94bde⌁taigrr committed
- Harden the git proxy and bridges before deploy: trust only ok'd refs, restrict v2 commands, fail closed on unloadable thin-pack bases, rate-limit before auth, shorten public raw caching, and charge bridged bytes to the head owner (CI-P6, GIT-P4..P7, P9..P12, GIT-14/PR-12).23526ca⌁taigrr committed
- Close pre-deploy auth gaps: deploy tokens die with repo transfers, password resets and lost admin; token revocation cascades through every descendant; agent tokens minted over REST stay within the caller's grant; TOTP failures lock out persistently; login, email removal, passkey counters, signing-key lookup and sign-out-everywhere hardened.c9c6455⌁taigrr committed
- Credit contributions by verified commit email from a per-repo commit index, let users keep several verified addresses, make mentions survive renames, add repo Insights, and move per-request counters, unread counts, webhook logs and git/download metering off D1 into Durable Objects so write load scales with entities instead of traffic.9517d99⌁taigrr committed
- Skip dependency scans whose commit is no longer the default-branch head, so an out-of-order scan can't wipe newer results.056aadd⌁taigrr committed
- Merge roadmap/notify7417d6f⌁taigrr committed
- Merge roadmap/platformfixa662571⌁taigrr committed
- Scope commit signature lookups to the repository, 404 on missing alerts, gate draft release assets, refuse private webhook targets, stop dequeued merges, report workflow compile failures, support git protocol v2 with the default branch as HEAD, and post every password form.20aff54⌁taigrr committed
- Harden git, LFS, CI, Pages, auth and pull requests against the security review findings, and add a token API for the gfd CLI.4e8720e⌁taigrr committed
- Merge roadmap/security: signatures, secret scanning, code scanning, advisories, dependency graphbad844a⌁taigrr committed