Commit history for src/server/security/signatures.ts
426dd32⌁
- Move security data (advisories, alerts, SARIF, dependencies, settings) into RepoState and signing keys into AccountState7794e8f⌁taigrr committed
- Merge release/scratchcc94bde⌁taigrr committed
- Close pre-deploy auth gaps: deploy tokens die with repo transfers, password resets and lost admin; token revocation cascades through every descendant; agent tokens minted over REST stay within the caller's grant; TOTP failures lock out persistently; login, email removal, passkey counters, signing-key lookup and sign-out-everywhere hardened.c9c6455⌁taigrr committed
- Credit contributions by verified commit email from a per-repo commit index, let users keep several verified addresses, make mentions survive renames, add repo Insights, and move per-request counters, unread counts, webhook logs and git/download metering off D1 into Durable Objects so write load scales with entities instead of traffic.9517d99⌁taigrr committed
- Scope commit signature lookups to the repository, 404 on missing alerts, gate draft release assets, refuse private webhook targets, stop dequeued merges, report workflow compile failures, support git protocol v2 with the default branch as HEAD, and post every password form.20aff54⌁taigrr committed
- Harden git, LFS, CI, Pages, auth and pull requests against the security review findings, and add a token API for the gfd CLI.4e8720e⌁taigrr committed
- Merge roadmap/security: signatures, secret scanning, code scanning, advisories, dependency graphbad844a⌁taigrr committed